Revision History
This policy will be subject to revision in response to changes in technology and UCOP operational initiatives. Proposed changes will be shared with the UCOP IT Planning Group. Significant changes to this policy will be documented here.
Table of Contents
I. Background
II. Purpose of This PolicyIII. Electronic Information Security Policy
IV. Comments
I. Background
Appropriate IT security measures are required to support business processes and to protect information assets at the Office of the President. Information assets are at risk from potential threats that range from employee error to malicious or criminal action, system failure, and natural disasters. Such events could result in damage to or loss of information resources, corruption or loss of data integrity, interruption of the activities of the University, or compromise to the privacy of members of the University community.
Information Resources and Communications (IR&C) has been delegated leadership within the Office of the President to ensure effective, innovative, and accountable uses of information and communications technologies and responsible stewardship of UCOP IT assets. The Associate Vice President - IR&C directs information security planning at the Office of the President and is responsible for the development and maintenance of information technology related policies and procedures.
An important aspect of information security is the assurance that only authorized users have access to UCOP information resources, and that their use of those resources is conducted in a professional manner, consistent with University policy. The University of California Electronic Communications Policy (ECP) sets forth extensive provisions relating to electronic communications resources. At the Office of the President, the UCOP Policy on Acceptable Use of UCOP Electronic Information Resources implements selected provisions of the ECP. The UCOP acceptable use policy
II. Purpose of This Policy
The purpose of the UCOP Electronic Information Security Policy is to identify the obligations and responsibilities of UCOP departments and employees regarding their stewardship and protection of UCOP electronic information resources. Business and Finance Bulletin IS-3 Electronic Information Security identifies a broad set of measures that guide all University of California electronic information security strategies. This policy describes specific measures that comprise the information security program for UCOP. The Web site Information Security at the Office of the President offers informational resources to assist UCOP departments in improving information security.
III. Electronic Information Security Policy
Each member of the UCOP community is responsible for the protection and security of information assets and electronic information resources over which he or she has control (see Security Is Everyone's Responsibility).
A. Departmental Protection of Information Assets
Pursuit of the University's mission of teaching, research, and public service necessitates that information assets and administrative data be safeguarded and that the privacy of personally identifying information be maintained. In conformance with BFB IS-3 Electronic Information Security, UCOP departments should implement procedures and practices that ensure, to the extent possible, the confidentiality, integrity, and availability of the University's information assets, as well as the protection of sensitive data, such as Social Security numbers, personal financial data, health information, and student educational records. Sensitive data includes any information whose unauthorized access, modification, or loss could adversely affect the University. Departments may use the UCOP Information Security Checklist to document their information security program.
Department Security Review
Departmental Security Plan
All systems that host "restricted" data or provide "essential" services, as defined in BFB IS-3 Electronic Information Security, must meet specific requirements with respect to their physical environment; recovery procedures; and configuration management, change management, and patch procedures. A system administrator responsible for meeting these requirements must be designated.
The departmental security plan should be
See Department Security Review and Planning and Successful Risk Assessment for more information.
B. Security of Networked Resources
Shared resources are vulnerable to a variety of attacks; consequently, damage to any resource connected to the UCOP data network could result in broad impact across UCOP. Resources to be protected include the data network, computers, software, and data.
Access to and use of UCOP computer and network services are privileges accorded at the discretion of UCOP. No computer or other device may be connected to the UCOP network that is likely to pose a threat to the network, other devices connected to the network, or to information stored on a device connected to the network. Devices connected to the UCOP data network must conform to the requirements and minimum standards described in this policy.
If you are unable to meet the requirements or standards, or if your unit has non-Windows based servers or devices that require greater protections than specified in this policy, contact the IR&C Technology Service Desk at TechDesk@ucop.edu. Information Resources and Communications (IR&C) operates a data center that provides the appropriate physical environment and capabilities to meet these requirements. IR&C staff will work with your department to implement security requirements.
Requirements and Minimum Standards
for detailed information. These standards may change periodically. Users should frequently consult the minimum standards documents to make sure their practices are current. Personal productivity devices must comply with the minimum standards appropriate to their operating system or service.
IV. Comments
Comments or feedback on this policy should be directed to itpolicy@ucop.edu.
