Management Guide for Information Security

Selected Policies, Bulletins, and Web Resources

Statement of Ethical Values and Standards of Ethical Conduct

Presidential Policy

Electronic Communications Policy

• policy and procedures regarding the examination, monitoring, or disclosure of personal electronic communications records

Policy on Safeguards, Security and Emergency Management, Letter, Policy (pdf, January 25, 2006)

• policy to address crisis and consequence management capabilities across the University system

Academic Affairs Administration

Academic Personnel Manual, section 160

• description of the privacy rights of academic employees

Student Affairs Administration

Policies Applying to Campus Activities, Organizations, and Students, section 130.00

• guidelines governing privacy of student information

Human Resources Administration

Personnel Policy for Staff Members, Employment, Section 21 Appointment

• includes guidelines regarding job-related background checks

Selected Business and Finance Administration Bulletins

Information System Series

IS-2 Inventory, Classification, and Release of University Electronic Information (pdf, revised July 27, 2007)

• risk assessment: classification and security objectives
• release and disclosure requirements
• roles: proprietors and custodians

IS-3 Electronic Information Security (pdf, revised July 27, 2007)

• IT security program elements
• minimum requirements for connectivity
• encryption, log management, and other supporting guidelines

IS-7 Maintenance of Payroll System (pdf, revised December 19, 2006)

• identifies current governance and process

IS-10 Systems Development and Maintenance Standards (pdf, revised May 18, 2001)

• describes standards for developing/purchasing/installing/maintaining information systems applications for administrative purposes

IS-11 Identity and Access Management (pdf, issued July 27, 2007)

• concepts and core functions
• roles/responsibilities for credential providers and resource providers
• federated identity and access

IS-12 Continuity Planning and Disaster Recovery (pdf, issued July 27, 2007)

• inventory and classification of resources
• planning components
• specific requirements

Glossary of Terms (pdf, issued July 27, 2007)

• contains defintions of terms in all IS bulletins

Records Management and Privacy Series

RMP 2 Records Retention and Disposition

• establishes principles and processes for records dispositon
• outlines related roles and responsibilities

RMP 7 Privacy of and Access to Information Responsibilities

• identifies UCOP and campus responsiblities regarding privacy and access to administrative records

RMP 8 Legal Requirements on Privacy of and Access to Information Polices

• implements University compliance with state and federal privacy-related statutes

Web Resources

G-L-B Compliance Plan

• systemwide information security program in compliance with the FTC Safeguards Rule

UC HIPAA Website

• guidelines regarding the privacy and protection of health information

IT Security at the University of California

• links to major topics related to information security