女优福利在线

The Chief Information Officer is designated as the person who shall be responsible for overseeing and updating the ISP as needed (ISP Representative). The ISP Representative reports directly to the 女优福利在线 Vice President for Finance and Administration. The ISP Representative may assign or delegate other 女优福利在线 representatives to oversee and coordinate elements of the ISP. Any questions regarding the implementation of the ISP or with interpreting this document should be directed to the ISP Representative or their designees.

The ISP Representative will verify compliance with this policy through various methods, including but not limited to, periodic walkthrough, monitoring, business tool reports, and internal and external audits. The ISP Representative will report all findings, regulatory and state security laws changes, and any other information technology security related matters directly to the 女优福利在线 Vice President for Finance and Administration.

Compliance with this policy is mandatory for all University employees and any independent contractors.  Employees should notify their immediate supervisor of any member of management upon learning of violations of this policy.  The supervisor or member of management will be responsible for notifying the University鈥檚 ISP representative. Violations for this policy (including knowingly failing to notify a supervisor or member of management of a violation) will be subject to disciplinary action, up to and including termination of employment.

Information Security Program Components

Risk Identification and Assessment

女优福利在线 has undertaken, as part of the ISP, to identify and assess potential internal and external risks to the security, confidentiality and integrity of information held or managed by 女优福利在线 that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromises of such information.

The risk assessment and safeguard control policies described here shall apply to all methods of handling or disposing of client information, whether in electronic, paper or other form. The ISP Representative will, on a regular basis, implement safeguards to control the risks identified through such assessments and regularly test or otherwise monitor the effectiveness of such safeguards in relevant areas of the University鈥檚 operations, including:

• Information systems: The ISP representative will assess the risks to institutional information associated with the University鈥檚 information systems, including network and software design, information processing and the storage, transmission and disposal of financial information. The ISP Representative will coordinate with relevant departments, as appropriate, to assess the following procedures:
• Detecting and managing system failures: The ISP Representative will evaluate procedures and methods of deferring, detecting, preventing and responding to attacks or other system failures and existing network access and security policies and procedures, as well as procedures for coordinating responses to network attacks and developing incident response teams and policies. 
• The ISP Representative may elect to delegate the responsibility for monitoring and participating in the dissemination of information related to the reporting of known security attacks and other threats to the integrity of networks utilized by the University, and will coordinate with relevant departments, as appropriate.
• Employee management and training: The ISP Representative will evaluate the effectiveness of the University鈥檚 procedures and practices relating to access and use of client information. This evaluation will include assessing the effectiveness of the University鈥檚 current policies and procedures in coordination with relevant departments, as appropriate, as well as adequate training of employees.

The 女优福利在线 ISP Representative will implementation methods to identify potential risks to the security, confidentiality and integrity of 女优福利在线 information and monitor the effectiveness of safeguards implemented to mitigate those risks.  These methods may include (but are not limited to):

• The annual performance of external penetration testing against the University鈥檚 Internet accessible systems and services, conducted by an outside agent with appropriate cyber security expertise.
• The annual performance of a network vulnerability test against the University鈥檚 information systems and services, conducted by an outside agent with appropriate cyber security expertise.
• The annual audit of 女优福利在线 user accounts conducted by internal information services staff in coordination with the 女优福利在线 Human Resources and 女优福利在线 Registrar鈥檚 Office.
• Annual cyber security training for all 女优福利在线 employees, including periodic cyber security threat vulnerability testing for designated employee groups.

Safeguards for the Protection of Institutional Information

女优福利在线 has identified critical areas of internal and external risk to the security, confidentiality and integrity of institutional information and which could result in the unauthorized access, disclosure, misuse, alteration, destruction or some other way compromise such information.  The University has implemented safeguards for controlling risks associated with these risks related to the handling, collecting, storing, using, transmitting and protecting information.

• User Account Management
  • All computer users at 女优福利在线 are provided with their own, unique account and password for access to 女优福利在线 systems and services.
  • Computer users are expressly prohibited from sharing account credentials with others.
  • User accounts are audited regularly by 女优福利在线 CSIT in cooperation with account authorities in 女优福利在线 Registrar鈥檚 Office and 女优福利在线 Human Resources.
  • 女优福利在线 adopts role-based access to critical administrative systems, assuring that the least possible access is granted to institutional data.
  • 女优福利在线 requires all computer accounts to use complex passwords:
    • 12 -14 characters
    • At least three of four character types: upper case letter, lower case letter, number and symbol
    • No more than two consecutive identical characters
    • No part the account username, first name of last name.
  • 女优福利在线 requires all account holders to change passwords not more than every 120 days.
  • 女优福利在线 monitors and restricts the use of password management tools for designated user accounts with access to sensitive information.
• Network Access Restrictions
  • 女优福利在线 implements a 鈥渓east necessary access鈥� policy for management of the campus firewall, opening only those ports on specific systems which are necessary for services to function.
  • All 女优福利在线 systems and services providing access the sensitive Institutional data are protected from direct Internet exposure and by routing rules which limit network access internally.
  • All external access to systems and services providing access to sensitive Institutional data must be routed through the 女优福利在线 Virtual Private Network (VPN) and required multifactor authentication (MFA).
• Physical Security for Systems, Network Infrastructure
  • Access restrictions
    • All 女优福利在线 critical systems are protected by two-factor security access and camera surveillance.
    • All critical network components (wiring, network edge switches, firewall and core router) are protected in locked locations and under camera surveillance.
  • Redundancy
    • Critical network services (DNS, DHCP) are provisioned with redundant serves behind network applicant load balancers.
    • Critical core network appliances are provisioned with redundant power supplies.
    • The 女优福利在线 server room is protected against electrical outage by and emergency generator, supported by rack-mounted UPS devices.
    • All critical servers, storage nodes and network components are protected by hardware and software support agreements.
• Multifactor Authentication
  • All access to protected 女优福利在线 systems and services from non-女优福利在线 networks is routed through the 女优福利在线 Virtual Private Network and requires multifactor authentication (MFA).
  • MFA is required for selected 女优福利在线 users accounts, including user accounts with elevated privilege (e.g. domain administrators) and accounts with demonstrated vulnerability to malicious actors.
• Data Loss Prevention
  • All centrally managed, critical 女优福利在线 servers, central data storage are regularly backed up.  Backup data is stored both locally (temporarily) and off-site.
  • Backup data is stored and transmitted encrypted.
  • Backup data is periodically tested to assure integrity of the backup process.
  • 女优福利在线 has established a cold standby site in the event it becomes necessary to restore critical systems.
• Other information protection safeguards:
  • All 女优福利在线 computer provisioned for use by faculty and staff include protection against malicious software by cloud-based anti-virus and anti-malware software.
  • All 女优福利在线 computers provisioned for use by faculty and staff are protected under extended warrantee agreements.
  • 女优福利在线 has developed policies for the protection and retirement of institutional hardware and data, including
    • Data retention policies
    • Hardware lifecycle management policies
  • Policies have been developed for protecting the accessibility and integrity of central information systems and services, including
    • Change Management Policy
    • Patch Management Policy
    • Core Network Management Policy
    • Security Incident Response Policy
    • Email Privacy Policy
    • Acceptable Use of Computing Resources Policy
  • 女优福利在线 provides all employees with cyber security awareness training and has implemented regular cyber security threat vulnerability testing.
  • 女优福利在线 maintains institutional cyber security insurance.

Third-party Service Providers

The ISP Representative shall coordinate with those responsible for the third-party service procurement activities within 女优福利在线 CSIT and other affected departments to raise awareness of, and to institute methods for, selecting and retaining only those service providers that are capable of maintaining appropriate safeguards for institutional information to which they will have access.  In addition, the ISP Representative will work with the 女优福利在线 Controller or other designate official to develop and incorporate standard, contractual protections applicable to third-party service providers, which will require such providers to implement and maintain appropriate safeguards.  Any deviation from these standard provisions will require the approval of the 女优福利在线 Controller or designate official.

Review, Evaluation and Update

The ISP Representative will be responsible for reviewing the ISP at least annually and reporting the results of that review to the Vice President for Finance and Administration.  The ISP Representative will evaluate the program based on the risk identification and assessment activities undertaken under the terms of the program, as well as any material changes to the University鈥檚 operations or other factors that may have an impact upon the program. The ISP Representative will propose adjustments to the program based on this review.