ÌÇÐÄvlog¹ÙÍø

Data Protection Standards

  1. Home
  2. About
  3. Offices, Centers, & Institutes
  4. Information Technology Services
  5. Policies
  6. Data Protection Standards

Standards Type

Administrative

Last Revised

August 2022

Review Date

August 2022

Owner

ITS

Contact Name

Blake Penn

Contact Title

Chief Information Security Officer

Contact Email

bpenn@colgate.edu

 

Reason for Standards

These standards describe the protections that must be in place for different categories of ÌÇÐÄvlog¹ÙÍø data.

Standards

ÌÇÐÄvlog¹ÙÍø data shall be afforded the following by University data custodians. ÌÇÐÄvlog¹ÙÍø Information Technology Services (ITS) shall help data custodians provide these protections. 

Public data

  • Public data does not require any specific protections due to the nature of this data. Commonsense protections of such data are recommended, however.

Protected data

  • Protected data shall be afforded the following protections:
    • Backed up on a regular basis to a secure location with secure data restore procedures tested regularly
    • Strong encryption during storage and transit
    • Access control conforming to the principle of least privilege and based on user role
    • Only reside on approved platforms and in approved locations (consult ITS for these)
    • Systems housing this data shall maintain  current security path levels
    • Systems housing this data shall maintain effective endpoint protection controls 
    • All access shall be via authorized and authenticated access 
    • All access shall be centrally logged and monitored 

Regulated data

  • Regulated data must adhere to all cumulative protection required by all applications laws, rules, and regulations. Regulated data must also adhere to all applicable ÌÇÐÄvlog¹ÙÍø protection standards as well. 
  • ÌÇÐÄvlog¹ÙÍø data in the custodianship of third parties shall conform to these same protections. If particular protections are not available or feasible while in the custodianship of third parties, then alternate similar protections shall be identified with the help of ITS and these protections shell be afforded to the data. 

Scope

This policy applies to all ÌÇÐÄvlog¹ÙÍø data and all ÌÇÐÄvlog¹ÙÍø faculty, staff, and students.

Related Documents

ÌÇÐÄvlog¹ÙÍø Data Categorization Policy

ÌÇÐÄvlog¹ÙÍø Data Inventory Policy 

ÌÇÐÄvlog¹ÙÍø Data Privacy Policy

ÌÇÐÄvlog¹ÙÍø Data Protection Policy

ÌÇÐÄvlog¹ÙÍø Data Retention and Disposal Policy