Portland Community College | Portland, Oregon

BP 8101 Data Classification and Control

Statement of purpose

PCC¡¯s Information Security Policies support the following goals:

1. Promote a ¡°security is everyone¡¯s responsibility¡± philosophy to assist PCC in meeting its business and legal commitments.
2. Ensure that PCC complies with all applicable laws and regulations.
3. Ensure the integrity, reliability, availability, and superior performance of IT resources.
4. Ensure that users are protected from data breach and cybercrime.
5. Ensure that use of IT resources is consistent with the principles and values that govern the use of other college facilities and services.
6. Prevent unauthorized disclosure of controlled sensitive data.
7. Prevent disruption of the learning experience.
8. Ensure the college is protected from financial, legal, regulatory, and reputational harm.
9. Ensure that IT systems are used for their intended purposes.
10. Establish processes for addressing policy violations and sanctions for violators.

This policy supports the primary goal of regulatory compliance, which is to protect critical data such as student PII and other sensitive information. In order to do this, the data stored in PCC systems must be understood and appropriate controls (whether digital or physical) implemented to appropriately protect data from breach and manage access to the data. This policy seeks to ensure that PCC takes all necessary steps to meet regulatory compliance standards in respect to classifying and controlling critical data.

Scope statement

All Portland Community College (PCC) employees, students, and affiliates or other third parties that create, use, maintain, or handle PCC IT resources are subject to this policy. This policy applies to all controlled sensitive data stored or transmitted using PCC IT Resources and all users of such data.

Policy summary

All data stored and accessed on PCC information systems, whether managed by employees or a third party, shall be identified and classified by the data owner in collaboration with the data steward and data custodian. The classification level of the data shall be reviewed on a periodic basis, as applicable to current state and federal laws and regulations, and periodic reviews and audits of user access shall be performed.

This policy shall be subject to and superseded by applicable regulations and laws.

Policy

1. All controlled sensitive data shall be protected via access controls to ensure data is not improperly disclosed, modified, deleted, or rendered unavailable.
2. Upon creation or reception, all data shall be placed within a PCC data classification by a data owner who is responsible, in collaboration with data custodians, for establishing and maintaining appropriate safeguards applicable to that classification.
3. Users shall be granted access to PCC systems based on role, and to PCC data by data owners. Users shall be given enough access to view and update information as required to accomplish their jobs and no more.
4. All hardcopy materials and stationary electronic media containing confidential and/or sensitive information shall be protected by appropriate physical access controls.
5. Appropriate facility controls shall be used to limit and monitor individual physical access to systems that store controlled sensitive data. Facility controls shall include alarm procedures, user authorization (e.g. card access), coverage requirements, escalation procedures, and testing procedures.
6. Visitor logs and physical audit trails of access to controlled sensitive data by individuals who do not own the data shall be collected and retained for a minimum of three months, unless otherwise restricted by law.
7. The CISO, in collaboration with the PCC internal auditor, shall oversee a twice per year audit of IT resource authorizations to confirm access privileges are appropriate. The audit will consist of validating access rights for sample user populations.
8. Extensions for affiliate accounts shall be authorized by the CISO to provide an audit trail.

Exemptions

None.

Exceptions

Exceptions to this policy must be pre-approved in writing by the Chief Information Officer (CIO) / Chief Information Security Officer (CISO).

Policy violation

1. Violation of this policy may result in disciplinary action in accordance with PCC People, Strategy, Equity and Culture (PSEC) and/or Student Conduct guidelines.
2. PCC reserves the right to report security violations or compromises to the appropriate authorities. This may include reporting violations of Federal, State, and local laws and regulations governing computer and network use, or required accreditation reporting.
3. Anyone who violates this policy may be held liable for damages to PCC assets, including but not limited to the loss of information, computer software and hardware, lost revenue due to disruption of normal business activities or system down time, and fines and judgments imposed as a direct result of the violation.
4. PCC reserves the right to deactivate any User¡¯s access rights (whether or not the User is suspected of any violation of this policy) when necessary to preserve the integrity of IT Resources.

Complaint procedures

Report non-security-related violations (such as receipt of inappropriate content, other People, Strategy, Equity, and Culture (PSEC) policy violations, general college policy violations, or regulatory compliance violations) to a supervisor, PSEC, or EthicsPoint.

Report information security and general technical policy violations to the IT Service Desk at 971-722-4400 or servicedesk@pcc.edu, or contact the CIO or CISO.

Governing standards, policies, and guidelines

• US Dept of Education: Guidance Letter ¨C Protecting Student Information
• US Dept of Education: Family Educational Rights and Privacy Act (FERPA)
• US Dept of Homeland Security: Federal Information Security Management Act (FISMA)
• Gramm-Leach-Bliley Act (GLBA)
• FTC Red Flags Rule
• Health Insurance Portability and Accountability Act (HIPAA)
• International Organization for Standardization (ISO)
• National Institute Standards and Technology (NIST)
• Payment Card Industry Data Security Standard (PCI DSS)
• Sarbanes-Oxley (SOX) for Colleges and Universities

Definitions

• Access Control
  The selective restriction of access to a place or computing resource for security purposes.
  • The act of accessing may mean consuming, entering, or using. For example, the lock on your front door is an access control mechanism to limit who can enter your house. Similarly, entering a user ID and password restricts access to your computer account.
• Affiliate
  Any person or entity that has been sponsored by a PCC manager to receive controlled temporary access to PCC services.
  • This is generally as a result of a contractual relationship with PCC. For example, an air conditioning vendor may require affiliate access to test the HVAC system. A consultant project manager may require affiliate access to access project plans on a PCC system.
• Authorization
  Permission to access a specific piece of data or system function is called authorization.
  • A common form of authorization is ¡°role-based¡± ¨C a system may look up the role assigned to a particular user and only grant that user access to the functions of a computer program that are authorized for that role. For example, users associated with the ¡°Payroll Administrator¡± role in Banner can access the payroll functions that they need to perform their job, but other Banner users cannot.
• Automatic Clearing House (ACH)
  An electronic network for financial transactions in the United States.
  • ACH allows PCC to execute electronic financial transactions with other financial institutions. ACH credit transfers include direct deposit, payroll, and vendor payments.
• Chief Information Officer (CIO)
  Senior manager of the Information Technology (IT) Department and a member of Cabinet.
  • At PCC, the CIO is responsible for all technology, with the exception of:
    • Online Learning (Academic Affairs)
    • Some specialized technology that supports CTE or other engineering programs (e.g. software that supports machine labs, specialized dental technology, etc.)
    • Some technology that supports auxiliary services (e.g. Point of Sale systems in the cafeterias and bookstores)
• Chief Information Security Officer (CISO)
  Senior manager responsible for information security compliance at PCC.
• Controlled Sensitive Data (CSD)
  A general categorization that is used in PCC¡¯s Information Technology (IT) policies (primarily the Information Security Policy and the Acceptable Use Policy) to represent all confidential and protected private information governed by those policies.
  • CSD includes: PII, PHI, HIPAA, FERPA, regulated, private, personal, or sensitive information for which PCC is liable if publicly disclosed.
• Data Custodian
  The individuals who are responsible for the implementation and configurations of how data is structured, stored, and transmitted.
• Data Owner
  The individuals or groups responsible for overseeing information and that it meets requirements defined by data management policies and procedures.
• Data Steward
  The individuals who help define, implement, and enforce data management policies and procedures.
• Electronic Media
  Technology that stores and accesses data in electronic form.
  • In contrast to static media (e.g. print media). Digital Content is stored on Electronic Media.
• Hardcopy
  A printed version on paper of data held in a computer.
• IT Resource
  (At PCC) All Information Technology (IT) resources that are the property of PCC and include, but are not limited to, all network-related systems; business applications; network and application accounts; administrative, academic and library computing facilities; college-wide data, video and voice networks; electronic mail; video and web conferencing systems; access to the Internet; voicemail, fax machines and photocopiers; classroom audio/video; computer equipment; software and operating systems; storage media; Intranet, VPN, and FTP.
  • IT Resources include resources administered by IT, as well as those administered by individual departments, college laboratories, and other college-based entities.
• Information Security Manager (ISM)
  (aka Associate CISO) Manager of the PCC Information Security team, reporting to the CIO and/or CISO.
• Personally Identifiable Information (PII)
  Any data or combination of data that could potentially identify a specific individual.
  • Any information that can be used to distinguish one person from another and can be used for de-anonymizing anonymous data can be considered PII.
• System
  (In Information Technology [IT]) A computer system consists of hardware components that work with software components to achieve a defined outcome.
  • The main software component that runs on a system is an operating system that manages and provides services to other programs that can be run in the computer. Computer systems may also include peripheral devices such as printers, A/V equipment, operating machinery, etc.
• Third Party
  (In Information Technology [IT]) A vendor. Can be applied to any vendor (¡°third party provider¡±), but mostly used regarding ¡°vendor software¡± to distinguish it from software developed ¡°in house.¡±
• User
  Any person who makes any use of any PCC IT resource from any location (whether authorized or not).

Responsible executive

Chief Information Officer

Responsible officer

Chief Information Security Officer (CISO)

Responsible office

IT Information Security

Last revision date

09-09-2024