Data Classification, Security and Roles (Procedure 7.0500)

Purpose

Seminole State College provides valuable technological resources to support educational activities and administrative functions. These resources, including computing systems and software, as well as internal and external data, voice, and video networks, are relational and shared resources. To preserve these resources for the common good, the College expects all users, including students, faculty, staff, administrators, other employees, and members of the general public using Seminole’s information technology resources, to comply in all respects with institutional and external standards for their appropriate use.

Procedure

• Data Classification
  • Data must be maintained in a secure, accurate, and reliable manner and be readily available for authorized use. Data will be classified in one of the categories listed below in order to: implement security at the appropriate level commensurate with data value, sensitivity, and risk; establish guidelines for legal/regulatory compliance; and reduce or eliminate conflicting standards and controls over data.
    

    Data Category	Description	Examples
    Restricted	Data protected by law or regulation whose improper use or disclosure could: Adversely affect the ability of the College to accomplish its mission Lead to possibility of identity theft by release of personally identifiable information of College constituents Put the College into a state of non-compliance with various state and federal regulations such as FERPA, HIPAA and GLBA Put the College into a state of non-compliance with contractual obligations	Social security numbers Grades Financial aid data
    Sensitive	Data that Data Managers have decided NOT to publish or make public Data protected by contractual obligations. By default, ALL INSTITUTIONAL DATA are classified as SENSITIVE	Purchasing data Information covered by non-disclosure agreements
    Public	Low level of sensitivity Data that the general public may be granted access to in accordance with Florida Statutes Chapter 119 Public Records and FERPA	Directory information Academic course descriptions

• Data Security
  1. Data in Restricted, Sensitive and Public categories require security measures appropriate to the degree to which the loss or corruption of the data would impair the business or research functions of the College, result in financial loss, or violate law, policy or College contracts.
  2. Security access by employees of the College will be implemented in compliance with FERPA requirements as follows:
     1. FERPA makes it clear that school officials with legitimate educational interests may be given access to personally identifiable information about students.
     2. A person employed by the College in an administrative, counseling, supervisory, academic, student affairs, research position, or a support person to these positions may be granted access to FERPA-protected data when that data is relevant to the accomplishment of assigned duties or a determination about a student.
     3. Persons must complete an online FERPA module and satisfactorily pass an exam prior to classes starting before security approval and access to student records will be granted. An exception may be provided for new faculty and adjunct instructors in their first term, if they complete the module and exam within two weeks after the start of the semester to maintain security access.
  3. Security measures for data are set by the Data Custodian, working in cooperation with the Data Stewards, as defined below. The following roles and responsibilities are established for carrying out data policy:
• Security Roles and Responsibilities 
  1. The functional requirements listed in a job description determine the type of data and the level of system access an employee will need to perform his/her job. These requirements are used to develop and assign a specific User Profile and Security Role to the employee. When implemented, the User Profile and the Security Role provide the employee with access needed to perform his/her job while maintaining the security and integrity of College data. CTS is responsible for maintaining a list of security access assigned to each employee.
  2. Data Trustees, Data Stewards, and Data Custodians
     Data Trustees, Stewards, and Custodians are responsible for establishing and carrying out College data policy. They will:
     1. Implement the security plan.
     2. Ensure that users receive the appropriate access to the system.
     3. Resolve functional security issues as well as troubleshoot custodial security problems.
     4. Assure cross-functional security compatibility.
     5. Audit security compliance regularly.
     6. Review and update the security plan regularly.
  3. Data Trustee (Administrator)
     Data Trustees are senior College officials (or their designees) who have planning and policy-level responsibility for data within their functional areas and management responsibilities for defined segments of institutional data. Responsibilities include assigning Data Stewards, participating in establishing policies, and promoting data resource management for the good of the entire College.
     

     Data Trustees	Data Type
     President	All College Data
     Chief Financial Officer	Financial Data and HR Data
     Chief Information Officer	Information Technology Data
     Chief Student Affairs Officer	Student Data

  4. Data Steward (Approver)
     Data Stewards are College officials having direct operational-level responsibility for information management – usually department directors. Data Stewards are responsible for data access and policy implementation issues.
     

     Data Stewards	Data Type
     Associate Director, Payroll Services	Payroll, Time and Labor; Payroll, Time and Labor Setup Tables
     Associate Director, Student Accounting	Student Financials Data, Student Financials System Setup
     Associate Vice President, Financial Services	Financial Data, Financial Data Setup Tables
     Associate Vice President, Human Resources	Human Resources Data, Human Resources Setup Tables
     Associate Vice President, Information Technology and Resources	Information Technology, Data Correction
     Director, Curriculum, Credit and Academic Scheduling	Curriculum, Instructor and Scheduling Information, Associated System Setup
     Director, Enrollment Services/Registrar	Student Data (including Counseling, Admissions, Testing, and Enrollment Services), System Setup for Student Data, Row-Level Security
     Director, Facilities	Maintenance Management Data, Maintenance Management Setup
     Director, Student Financial Resources	Student Financial Aid Data, Student Financial Aid System Setup

     
     
     
  5. Data Custodian (Owner)
     The Computing and Telecommunication Services Department (CTS) is the Data Custodian. The Custodian is responsible for providing a secure infrastructure in support of the data, including, but not limited to, providing physical security, backup and recovery processes, granting access privileges to system users as authorized by data trustees or their designees (usually the data stewards), and implementing and administering controls over the information.
     Data Custodians include:
     VP, Information Technology and Resources/CIO
     Associate Vice President, Information Technology and Resources
     Director, Network and User Support Services
  6. Data User (User)
     Most College Faculty and Staff are assigned the role of “Data User.” Data Users are individuals who need and use College data as part of their assigned duties or in fulfillment of assigned roles or functions within the College community. Individuals who are given access to sensitive data have a position of special trust and as such are responsible for protecting the security and integrity of those data.
     
     Detailed information regarding User access and inactivation is located in:
     Procedure 7.0100 Access to Information Technology and Reassignment, and
     Procedure 7.0200 Inactivation of Access to Information Technology Systems for Terminating Employees.
• Security Review
  1. Each Data Steward will conduct an annual data security review. In addition, CTS will conduct an annual review of procedures, incidents, and responses, and will publish all relevant materials except in those cases where publication may lead to breaches of security or privacy. Publication of these materials is for the purpose of educating the College community on information technology security and privacy issues. CTS will assure that procedures and responses are appropriately reflective of those widely practiced at other colleges.
• Confidentiality
  1. Confidentiality of data and/or records subject to this procedure shall be determined in accordance with State and federal laws including, but not limited to, Florida’s Public Records Act, Chapter 119, Florida Statutes, and the Family Educational Rights and Privacy Act (FERPA).
  2. Confidentiality Agreement
     Seminole State College maintains information that is sensitive and valuable. Such information is often protected by Federal and State laws that prohibit its unauthorized use or disclosure. The exposure of such information to unauthorized individuals could cause permanent harm to the College or members of the College community. All employees are expected to sign the Confidentiality Agreement (at the end of this document) before access can be granted to College restricted data.