Data Security Procedures, Roles and Responsibilities

Procedure Section: 
Information Technology Services
Effective: 
Monday, October 19, 2015
Procedure: 
ROLES AND RESPONSIBILITIES It is the policy of the College that all confidential and other sensitive information be safeguarded from unauthorized access, use, modification or destruction. All members of the College community share in the responsibility for protecting the confidentiality and security of data. This section of the policy assigns specific duties to each of the roles of Vice President and Deans, Sponsors, Data Security Officers, Users, and the Chief Human Resources Officer. However, it is likely that an individual will have responsibilities reflecting multiple roles with respect to certain information.
Data Security Committee
  • The College has established the Data Security Committee to formulate College-wide procedures and guidelines concerning the collection, storage, use and safekeeping of data, to update as necessary this policy, and to direct the responsive actions in the event of any material violation of this policy or any Security Breach.
  • The Data Security Committee shall from time to time review the implementation of this policy and compliance with the Computer System Security Requirements and Data Security Directives.
  • The Data Security Committee shall periodically review identifiable risks to the security, confidentiality, and integrity of data, and shall review this policy and the scope of Computer System Security Requirements at least annually to assess its effectiveness and determine whether any changes are warranted.
  • The Data Security Committee is authorized to:
    • Issue Data Security Directives.
    • Promulgate amendments to this policy, including the Computer System Security Requirements.
    • Take actions to ensure compliance with this policy, which may include, without limitation, the commissioning of internal audits and investigations.
    • Take actions in response to violations of this policy or any Security Breach.
    • Discuss any material violations of this policy and Security Breaches, the College’s actions in response, and recommend any further actions or changes in practice or policy Establish data privacy and security training and awareness programs for the College community and periodically assess whether these programs are effective
 Chief Information Security Officer

The Chief Information Security Officer shall, with input from the Data Security Committee, identify and assess reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of College data. This identification and risk assessment shall include adopting means for detecting security system failures and monitoring the effectiveness of the Computer System Security Requirements.

The Director shall oversee the implementation of the Computer System Security Requirements and recommend changes to address risks, failures, or changes to business practices to the Data Security Committee. The Director shall work with other College administrators to investigate any violation of this policy and any incident in which the security or integrity of College data may have been compromised, including taking the steps set forth below in response to a security breach. The Director shall work with other College administrators to develop and review training materials to be used for employee training under this policy.

 Vice Presidents and Deans

The President, College Vice Presidents and Deans are responsible for promoting the institutional awareness of this policy and for ensuring overall compliance by their staff.

In particular, Vice Presidents and Deans are responsible for:

  • Ensuring that all staff have the training and support necessary to protect data in accordance with this policy, all Data Security Directives, and any Specific Security Procedures applicable to such data.
  • Designating and managing the efforts of one or more Sponsors and Data Security Officers for all Information Resources maintained in their area of responsibility
  • Approving access authorization of all Users of Information Resources maintained in their area of responsibility having a data classification of Confidential
  • Promulgating Specific Security Procedures
  • Ensuring that Confidential or Internal Use Only data sponsored within their area of responsibility are not provided or accessible to, or created or maintained by College vendors or other third-parties without assistance from the Chief Information Security Officer and the College Risk Manager
    • verifying that the third party has the capability of adequately protecting such data;
    • review and approval of the relevant contract and the underlying terms and specifications by the College Risk Manager and Chief Information Security Officer unless approved otherwise by the Assistant Attorney General
    • verifying that the third party has executed the College’s standard form of Privacy and Security Addendum.
  Sponsors (Data Stewards)
  • A Sponsor or Data Steward has primary responsibility for overseeing the collection, storage, use and security of a particular Information Resource.
  • In cases where a Sponsor is not identified for any Information Resource, the cognizant Vice President or Dean shall be deemed the Sponsor.
  • A Sponsor is responsible for the following specific tasks associated with the security of the information
    • Ensuring that the Information Resource is assigned a security classification and that such data is marked where appropriate.
    • Identifying authorized Users of the Information Resource, whether by individual identification or by job title, and obtaining approval for such access from their Vice President or Dean.
    • Proposing to their Vice President or Dean Specific Security Procedures for the handling of data under their sponsorship, consistent with this policy and other applicable College policies and procedures. <\ul>
Users

Users are responsible for complying with all security-related procedures pertaining to any Information Resource to which they have authorized access.

Specifically, a User is responsible for:

  • Becoming familiar with and complying with all relevant College policies, including, without limitation, this policy, and all Data Security Directives contemplated hereby, the policy on Professional Standards and Business Conduct, and other policies related to data protection, technology use and privacy rights (including the College Student Education Records).
  • Providing appropriate physical security for information technology equipment, storage media, and physical data. Such equipment and files shall not be left unattended without being locked or otherwise protected such that unauthorized Users cannot obtain physical access to the data or the device(s) storing the data.
  • Ensuring that Confidential or Internal Use Only information is not distributed or accessible to unauthorized persons. Users must not share their authorization passwords under any circumstances. Users must avail themselves of any security measures, such as encryption technology, security updates or patches, provided by Data Security Officers. Users must log off from all applications, computers and networks, and physically secure printed material, when not in use.
  • To the extent possible, making sure that any Massachusetts PI accessed by the User is stored only on secure servers maintained by the College and not on local machines, unsecure servers, or portable devices.
  • SPSCC Confidential or Internal Use Only data, when removed from the campus or when accessed from off-campus, is subject to the same rules as would apply were the data on campus. Sponsors and Users will comply with this Policy and all relevant Data Security Directives irrespective of where the College data might be located, including, for example, on home devices, mobile devices, on the Internet, or other third-party service providers.
  • When access to information is no longer required by a User, disposing of it in a manner to insure against unauthorized interception of any Confidential or Internal Use Only information. Generally, paper-based duplicate copies of Confidential documents should be properly shredded, and electronic data taken from Confidential databases should be destroyed.
  • Immediately notifying his or her cognizant Data Security Officer of any incident that may cause a security breach or violation of this policy.
Chief Human Resources Officer
The Chief Human Resources Officer shall be responsible for:
  • Working with the Data Security Committee to educate incoming employees (including temporary and contract employees) regarding their obligations under this policy and to provide on-going employee training regarding data security
  • Ensuring that terminated employees no longer have access to College systems that permit access to Confidential or Internal Use Only information
  • Carrying out any disciplinary measures against an employee taken in response to a violation of this policy as required by the Data Security Committee

 

Definitions: 
Information Resource. An Information Resource is a discrete body of information created, collected and stored in connection with the operation and management of the College and used by members of the College having authorized access as a primary source. Information Resources include electronic databases as well as physical files. Information derived from an Information Resource by authorized users is not an Information Resource, although such information shall be subject to this policy.
Personally Identifiable Information   Personally identifiable information (PII), or Sensitive Personal Information (SPI)  is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context.
 Sponsors Sponsors are those members of the College community that have primary responsibility for maintaining any particular Information Resource. Vice Presidents and Deans may designate sponsors in connection with their administrative responsibilities (as in the case of the College Registrar with respect to student academic records), or by the actual sponsorship, collection, development, or storage of information (as in the case of individual faculty members with respect to their own research data, or student grades).
 Data Security Officers Data Security Officers are those members of the College community, designated by their College Vice President or Dean, who provide administrative support for the implementation, oversight and coordination of security procedures and systems with respect to specific Information Resources in consultation with the relevant Sponsors.
Users Users include virtually all members of the SPSCC community to the extent they have authorized access to College Information Resources, and may include students, faculty, staff, contractors, consultants and temporary employees and volunteers.
Data Security Committee The Data Security Committee shall be chaired by the Chief Information Officer and shall include all of the Vice Presidents and Chiefs, or their representatives
 Computer System Security Requirements Computer System Security Requirements shall mean a written set of technical standards and related procedures and protocols designed to protect against risks to the security and integrity of data that is processed, stored, transmitted, or disposed of through the use of College information systems, and shall include computer system security requirements that meet or exceed the requirements of regulations ????? GET RCW’s, etc. The Computer System Security Requirements establish minimum standards and may not reflect all the technical standards and protocols in effect at the College at any given time.
 Data Security Directives Data Security Directives shall be issued from time to time by the Data Security Committee to provide clarification of this policy, or to supplement this policy through more detailed procedures or specifications, or through action plans or timetables to aid in the implementation of specific security measures. All Data Security Directives issued by the Committee shall be deemed incorporated herein.
 Specific Security Procedures Specific Security Procedures are procedures promulgated by a College Vice President or Dean to address particular security needs of specific Information Resources sponsored within their area of responsibility, not otherwise addressed by this policy, or any Data Security Directives.
 Security Breach A Security Breach is any event that causes or is likely to cause Confidential Information to be accessed or used by an unauthorized person and shall include any incident in which the College is required to make a notification under applicable law, including ????? GET RCW’s, etc.
Procedure Code: 
PRITSV4641