[ { "page": 1, "items": [ { "page": 1, "type": "TEXT", "location": { "l": 224.16, "t": 730.32, "r": 525.36, "b": 685.68 }, "text": "KENTUCKY STATE UNIVERSITY\nPOLICIES AND PROCEDURES", "reading_order": 0 }, { "page": 1, "type": "TEXT", "location": { "l": 34.08, "t": 660.48, "r": 136.32, "b": 626.16 }, "text": "POLICY TITLE: IT Security Policy", "reading_order": 1 }, { "page": 1, "type": "TEXT", "location": { "l": 33.36, "t": 611.76, "r": 219.12, "b": 578.4 }, "text": "VOLUME, SECTION & NUMBER: 4.2.9", "reading_order": 2 }, { "page": 1, "type": "TEXT", "location": { "l": 33.6, "t": 561.84, "r": 359.52, "b": 479.28 }, "text": "ENTITIES AFFECTED:\nStudents\nFaculty\nStaff\nIndividuals Using KSU Technology Services or Resources", "reading_order": 3 }, { "page": 1, "type": "TEXT", "location": { "l": 33.36, "t": 462, "r": 279.12, "b": 411.12 }, "text": "ADMINISTRATIVE AUTHORITY:\nInformation Technology\nDepartment of Finance & Business Affairs", "reading_order": 4 }, { "page": 1, "type": "TEXT", "location": { "l": 33.36, "t": 396, "r": 288.72, "b": 362.88 }, "text": "APPROVED BY:\nKentucky State University Board of Regents", "reading_order": 5 }, { "page": 1, "type": "TEXT", "location": { "l": 34.08, "t": 347.04, "r": 149.76, "b": 314.64 }, "text": "EFFECTIVE DATE:\nDecember 18, 2023", "reading_order": 6 }, { "page": 1, "type": "TEXT", "location": { "l": 33.84, "t": 298.32, "r": 192.96, "b": 264.96 }, "text": "REVISED FROM:\nApril 2020 Edition of Policy", "reading_order": 7 }, { "page": 1, "type": "TITLE", "location": { "l": 33.6, "t": 249.36, "r": 153.36, "b": 234.96 }, "text": "POLICY STATEMENT:", "reading_order": 8, "level": 2 }, { "page": 1, "type": "TEXT", "location": { "l": 33.6, "t": 218.4, "r": 577.68, "b": 174.72 }, "text": "The purpose of this policy is to communicate the security measures required to ensure the appropriate protection and safeguarding of Kentucky State University's Information Technology resources and systems from unauthorized access and misuse.", "reading_order": 9 }, { "page": 1, "type": "TITLE", "location": { "l": 34.08, "t": 159.12, "r": 115.68, "b": 144.72 }, "text": "DEFINITIONS:", "reading_order": 10, "level": 2 }, { "page": 1, "type": "TITLE", "location": { "l": 33.36, "t": 127.92, "r": 183.84, "b": 114.72 }, "text": "Information Security Incident", "reading_order": 11, "level": 2 }, { "page": 1, "type": "TEXT", "location": { "l": 33.6, "t": 113.04, "r": 578.16, "b": 70.08 }, "text": "An actual or suspected event such as a violation of computer security policies, acceptable use policies, or standard security practices. These events may adversely affect the security of KSU's information resources or systems. Examples include:", "reading_order": 12 }, { "page": 1, "type": "LIST_ITEM", "location": { "l": 51.36, "t": 54, "r": 174.96, "b": 40.32 }, "text": "Website defacement", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 13 } ] }, { "page": 2, "items": [ { "page": 2, "type": "LIST_ITEM", "location": { "l": 50.64, "t": 754.32, "r": 577.68, "b": 726.72 }, "text": "Theft or loss of a computing device that may contain Personally Identifiable Information (PII) whether or not such device is owned by KSU", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 0 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.6, "t": 723.6, "r": 211.92, "b": 711.36 }, "text": "Unauthorized access to data", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 1 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.6, "t": 708.72, "r": 516.24, "b": 695.76 }, "text": "Computer infected with malware (examples include a worm, virus, Trojan Horse, or botnet)", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 2 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.36, "t": 693.12, "r": 561.84, "b": 679.92 }, "text": "Reconnaissance activities (such as network or vulnerability scanning, or hacking/penetration testing)", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 3 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.6, "t": 677.76, "r": 133.44, "b": 666 }, "text": "Data Breach", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 4 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.6, "t": 662.64, "r": 289.2, "b": 650.4 }, "text": "Misuse of Information Resources or Systems", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 5 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.84, "t": 647.28, "r": 192.48, "b": 635.28 }, "text": "Denial of Service attacks", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 6 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.12, "t": 631.92, "r": 406.56, "b": 618.96 }, "text": "Security vulnerabilities (such as an un-patched or vulnerable system)", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 7 }, { "page": 2, "type": "TITLE", "location": { "l": 33.6, "t": 602.88, "r": 204.24, "b": 590.4 }, "text": "Information Technology Resource", "reading_order": 8, "level": 2 }, { "page": 2, "type": "TEXT", "location": { "l": 32.88, "t": 587.76, "r": 578.16, "b": 470.88 }, "text": "Any data, information, or system used by KSU. This includes, but is not limited to, procedures, equipment, facilities, software, and data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, share, and transmit information. This may include, but is not limited to, any and all computer printouts, online display devices, mass storage media, and all computer-related activities involving any device capable of receiving email, browsing websites, or otherwise capable of receiving, storing, managing, or transmitting data, including, but not limited to, servers, personal computers, notebook computers, handheld computers, mobile devices, pagers, distributed processing systems, telecommunication resources, network environments, telephones, fax machines, printers, and hosted services.", "reading_order": 9 }, { "page": 2, "type": "TITLE", "location": { "l": 33.36, "t": 456.24, "r": 195.12, "b": 443.76 }, "text": "Information Technology System", "reading_order": 10, "level": 2 }, { "page": 2, "type": "TEXT", "location": { "l": 33.12, "t": 441.12, "r": 379.44, "b": 427.92 }, "text": "Any electronic system that processes, stores, or transmits information.", "reading_order": 11 }, { "page": 2, "type": "TITLE", "location": { "l": 33.6, "t": 412.56, "r": 225.84, "b": 399.6 }, "text": "Personal Identifiable Information (PII)", "reading_order": 12, "level": 2 }, { "page": 2, "type": "TEXT", "location": { "l": 33.84, "t": 397.92, "r": 577.68, "b": 369.84 }, "text": "Per KRS 365.732, this is defined as an individual's first name or first initial and last name, combined with any one (1) or more of the following data elements, when the name or data element is not redacted:", "reading_order": 13 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.12, "t": 353.28, "r": 188.64, "b": 340.56 }, "text": "Social Security number;", "marker": "•", "list_id": "L2", "level": 0, "reading_order": 14 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.84, "t": 337.44, "r": 205.44, "b": 325.2 }, "text": "Driver's license number; or", "marker": "•", "list_id": "L2", "level": 0, "reading_order": 15 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.12, "t": 322.08, "r": 576.48, "b": 294.48 }, "text": "Account number or credit or debit card number, in combination with any required security code, access code, or password to permit access to an individual's financial account", "marker": "•", "list_id": "L2", "level": 0, "reading_order": 16 }, { "page": 2, "type": "TITLE", "location": { "l": 33.84, "t": 278.4, "r": 119.28, "b": 264.48 }, "text": "PROCEDURES:", "reading_order": 17, "level": 2 }, { "page": 2, "type": "TEXT", "location": { "l": 33.12, "t": 246.96, "r": 578.16, "b": 203.52 }, "text": "It is the policy of KSU to implement security measures to prevent unauthorized access or destruction of Information Technology resources and systems. The security measures will ensure the confidentially, integrity, and availability of Information Technology resources and systems. By implementing this policy, KSU will address:", "reading_order": 18 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.6, "t": 187.44, "r": 149.28, "b": 175.44 }, "text": "Acceptable Use", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 19 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 52.08, "t": 171.6, "r": 189.6, "b": 158.88 }, "text": "Awareness and Training", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 20 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.84, "t": 156, "r": 145.68, "b": 144.72 }, "text": "Access Control", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 21 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.84, "t": 141.6, "r": 193.68, "b": 128.88 }, "text": "Audit and Accountability", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 22 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.84, "t": 126.24, "r": 163.2, "b": 114.48 }, "text": "Data Classification", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 23 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 51.84, "t": 110.88, "r": 279.6, "b": 97.68 }, "text": "Business Continuity and Disaster Recovery", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 24 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 52.08, "t": 95.52, "r": 163.2, "b": 83.28 }, "text": "Incident Response", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 25 }, { "page": 2, "type": "LIST_ITEM", "location": { "l": 52.32, "t": 80.16, "r": 136.8, "b": 68.16 }, "text": "Enforcement", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 26 } ] }, { "page": 3, "items": [ { "page": 3, "type": "TEXT", "location": { "l": 33.6, "t": 754.32, "r": 577.68, "b": 726 }, "text": "Every user of KSU's Information Technology resources and systems bears responsibility for protecting these technology resources.", "reading_order": 0 }, { "page": 3, "type": "TEXT", "location": { "l": 33.6, "t": 710.88, "r": 577.68, "b": 682.08 }, "text": "KSU will adhere to federal, state laws, rules, regulations, policies, and procedures governing the confidentiality and protection of data.", "reading_order": 1 }, { "page": 3, "type": "TITLE", "location": { "l": 33.12, "t": 666, "r": 168.48, "b": 651.36 }, "text": "INCIDENT REPORTING:", "reading_order": 2, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 32.4, "t": 635.04, "r": 577.92, "b": 605.76 }, "text": "Any member of the KSU community who suspects or becomes aware of an Information Security Incident must report the incident immediately by:", "reading_order": 3 }, { "page": 3, "type": "LIST_ITEM", "location": { "l": 50.4, "t": 591.36, "r": 549.6, "b": 577.92 }, "text": "Contacting the IT Help Desk or Chief Information Officer by phone (preferred), e-mail or in person.", "marker": "1.", "list_id": "L4", "level": 0, "reading_order": 4 }, { "page": 3, "type": "LIST_ITEM", "location": { "l": 50.88, "t": 576, "r": 458.88, "b": 562.32 }, "text": "Contacting the department supervisor, who must contact the CIO immediately.", "marker": "2.", "list_id": "L4", "level": 0, "reading_order": 5 }, { "page": 3, "type": "TEXT", "location": { "l": 33.6, "t": 547.2, "r": 577.68, "b": 518.64 }, "text": "If the department supervisor is not available, then the individual must contact the department Vice President, who must contact the CIO immediately.", "reading_order": 6 }, { "page": 3, "type": "TEXT", "location": { "l": 33.6, "t": 503.28, "r": 559.44, "b": 488.88 }, "text": "Suspected violations of this policy should be reported to the Chief Information Officer or Human Resources.", "reading_order": 7 }, { "page": 3, "type": "TITLE", "location": { "l": 33.6, "t": 473.76, "r": 129.12, "b": 459.12 }, "text": "ENFORCEMENT:", "reading_order": 8, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 33.6, "t": 442.08, "r": 578.64, "b": 398.16 }, "text": "Any employee, student, or individual who commits, or refuses to cooperate in the investigation of, a violation of this policy may be subject to disciplinary action, including but not limited to termination, loss of data-access privileges, administrative sanctions, and personal civil and criminal liability.", "reading_order": 9 }, { "page": 3, "type": "TITLE", "location": { "l": 33.6, "t": 383.28, "r": 118.56, "b": 368.64 }, "text": "APPLICATION:", "reading_order": 10, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 33.36, "t": 351.6, "r": 578.16, "b": 307.68 }, "text": "This policy and all implementing standards and procedures applies to all KSU students, faculty, staff, Regents, and all others who use, have access to, store, transmit or oversee KSU information technology resources. This applies to access of any KSU information resource from any device.", "reading_order": 11 }, { "page": 3, "type": "TITLE", "location": { "l": 33.84, "t": 292.8, "r": 146.4, "b": 277.92 }, "text": "RELATED POLICIES:", "reading_order": 12, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 33.6, "t": 261.6, "r": 200.16, "b": 232.32 }, "text": "IT Appropriate Usage Policy\nIT Audit and Accountability Policy", "reading_order": 13 } ] } ]