Data Owners must approve access to their data. User will submit completed access request forms from the Intranet with approval for access to the IT Help Desk.

IT will fulfill all completed and approved forms, incomplete forms will be returned to owners

Requestor will be notified via email when completed.

A request form must be submitted for all additions or changes to access.

When and employee changes departments the IT Help Desk must be notified, so access to that department's data can be removed. If access is still required by the employee it must be approved again by the data owner.

When and employee leaves the University the IT Helpdesk must be notified, so access to University systems can be removed.

Ex-employees may continue to have access to University email for a limited time with approval from their Vice President.

Risk Management with assistance from IT will periodically send out security reports to all data owners for review.

Periodic audit reviews will be conducted by Risk Management Department with assistance from IT.

Information Technology as custodians of data will perform daily backups and store tapes in a fireproof safe.

The IT department will maintain a weekly archive of backup tapes in a secure offsite storage location.

The IT department will maintain a six-month archive of data tapes in a secure offsite storage location.

The IT department will maintain an annual archive of data tapes in a secure offsite storage location.

The IT department will maintain a Recovery Point Objective within one day in the event of a disaster.

The IT department will maintain a Recovery Time Objective within two weeks, to rebuild infrastructure and to get essential systems functioning in the event of a disaster.

The IT department along with the Payroll department will maintain a process to transmitting a payroll file within 3 days in the event of a disaster.

Questions regarding this policy should be directed to the Information Technology Help Desk at helpdesk@kysu.edu.

Entities Affected