Policy 5407 – Information Security Program
Effective Date: 2/20/2004
Responsible Office: Financial Services
In order to continue to protect private information and data, and to comply with new federal laws effective May 23, 2003, the University has adopted this Information Security Program for certain highly critical and private financial and related information. This security program applies to customer financial information (“covered data”) the University receives in the course of business as required by these new federal laws, as well as other confidential financial information the University has voluntarily chosen as a matter of policy to include within its scope. This document describes many of the activities the University currently undertakes, and will undertake, to maintain covered data according to legal and University requirements. This Information Security Program document is designed to provide an outline of the safeguards that apply to this information. The practices set forth in this document will be carried out by and impact diverse areas of the University.
“Covered data” means all information required to be protected under the Gramm-Leach-Bliley Act (“GLB Act”). “Covered data” also refers to financial information that the University, as a matter of policy, has included within the scope of this Information Security Program. Covered data includes information obtained from a student in the course of offering a financial product or service, or such information provided to the University from another institution. “Offering a financial product or service” includes offering student loans, receiving income tax information from a current or prospective student’s parents as a part of a financial aid application, offering credit or interest bearing loans, and other miscellaneous financial services as defined in 12 CFR § 225.28. Examples of student financial information relating to such products or services are bank and credit card account numbers, income and credit histories and social security numbers. “Covered data” consists of both paper and electronic records that are handled by the University or its affiliates.
“Service Providers” refers to all third parties who, in the ordinary course of University business, are provided access to covered data. Service providers may include businesses retained to transport and dispose of covered data, collection agencies, and systems support providers, for example.
- Security Program Components
The GLB Act requires the University develop, implement, and maintain a comprehensive information security program containing the administrative, technical, and physical safeguards that are appropriate based upon the University’s size, complexity, and the nature of its activities. This Information Security Program has five components: (1) designating an employee or committee responsible for coordinating the program; (2) conducting risk assessments to identify reasonably foreseeable security and privacy risks; (3) ensuring that safeguards are employed to control the risks identified and that the effectiveness of these safeguards is regularly tested and monitored; (4) overseeing service providers, and (5) maintaining and adjusting this Information Security Program based upon the results of testing and monitoring conducted as well as changes in operations or operating systems.
- Information Security Committee
The Information Security Committee (“Committee”) will be responsible for implementing this Information Security Program. The Committee is composed of representatives from the following offices: Computing Center, Financial Information Systems, Internal Audit, Registrar, Personnel, Athletics, Financial Aid, and Comptroller.
The Committee will consult with responsible offices and will conduct a survey, or utilize other reasonable measures, to confirm that all areas with access to covered data are included within the scope of this Information Security Program. The Committee will maintain a list of areas and units of the University with access to covered data.
The Committee will ensure that risk assessments and monitoring, as set forth in sections V and VI below, are carried out for each unit or area that has covered data and that appropriate controls are in place for the identified risks. The Committee may require units with substantial access to covered data to further develop and implement comprehensive security plans specific to those units and provide copies of the plan documents. The Committee may designate, as appropriate, responsible parties in each area or unit to carry out activities necessary to implement this Information Security Program.
The Committee will work with responsible parties to ensure adequate training and education is developed and delivered for all employees with access to covered data. The Committee will, in consultation with other University offices, verify that existing policies, standards, and guidelines that provide for the security of covered data are reviewed and adequate. The Committee will make recommendations for revisions to policy, or the development of new policy, as appropriate.
The Committee will prepare an annual report on the status of the Information Security Program and provide that to the President’s Office. The Committee may prepare more frequent reports as necessary or requested. These reports may include copies of any unit-specific security plans, current risk assessments for each unit with access to covered data, a statement on the controls in place to mitigate those risks and the effectiveness of those controls, summaries of monitoring activities, actions taken or to be taken to correct any security concerns identified through monitoring, and such other information as required to provide assurance that this Information Security Program is implemented and maintained.
The Committee will update this Information Security Program, including this and related documents, from time to time. The Committee will maintain a written security plan containing the elements set forth above in Section III at all times and make the plan available to the University community.
- Risk Assessment
The Information Security Program will identify reasonable foreseeable external and internal risks to the security, confidentiality, and integrity of covered data that could result in the unauthorized disclosure, misuse, alteration, destruction, or otherwise compromise such information, and assess the sufficiency of any safeguards in place to control these risks. Risk assessments will include consideration of risks in each area that has access to covered information. Risk assessments will include, but not be limited to, consideration of employee training and management; information systems, including network and software design, as well as information processing, storage, transmission and disposal; and systems for detecting, preventing, and responding to attacks, intrusions, or other system failures.
The Committee will work with all relevant areas to carry out comprehensive risk assessments. Risk assessments will include system-wide risks, as well as risks unique to each area with covered data. The Committee will ensure that risk assessments are conducted at least annually, and more frequently where required. The Committee may identify a responsible party to conduct the system-wide assessment. The Committee may identify a responsible party in each unit with access to covered data to conduct the risk assessment considering the factors set forth above, or employ other reasonable means to identify risks to the security, confidentiality, and integrity of covered data in each area of the University with covered data.
The Committee will maintain copies of complete and current risk assessments for system-wide and unit-specific risks. The risk assessments already completed by the Committee are incorporated to and made part of this document.
- Information Safeguards and Monitoring
The Information Security Program will verify that information safeguards are designed and implemented to control the risks identified in the risk assessments set forth above in Section V. The Committee will ensure that reasonable safeguards and monitoring are implemented and cover each unit that has access to covered data. Such safeguards and monitoring will include the following:
- Employee Management and Training
Safeguards for security will include management and training of those individuals with authorized access to covered data. The University has adopted comprehensive policies setting forth the procedures and recommendations for preserving the security of private information, including covered data. These are set forth in this policy and Section X.
The Committee will, working with other responsible offices and units, identify categories of employees or others who have access to covered data. The Committee will ensure that appropriate training and education is provided to all employees who have access to covered data. Such training will include education on relevant policies and procedures and other safeguards in place or developed to protect covered data. Training and education may also include newsletters, promotions, or other programs to increase awareness of the importance of preserving the confidentiality and security of confidential data.
Other safeguards will also be used, as appropriate, including job-specific training on maintaining security and confidentiality, requiring user-specific passwords and required periodic changes to those passwords, limiting access to covered data to those with a business need for access to information, requiring signed certification of responsibilities prior to authorizing access to systems with covered data, requiring signed releases for disclosure of covered data, establishing methods for prompt reporting of loss or theft of covered data or media upon which covered data may be stored, and other measures that provide reasonable safeguards based upon the risks identified.
- Information Systems
Information systems include network and software design, as well as information processing, storage, transmission, retrieval, and disposal.
Network and software systems will be reasonably designed to limit the risk of unauthorized access to covered data. This may include designing limitations to access, and maintaining appropriate screening programs to detect computer hackers and viruses and implementing security patches.
Safeguards for information processing, storage, transmission, retrieval, and disposal may include: requiring electronic covered data be entered into a secure, password-protected system; using secure connections to transmit data outside the University; using secure servers; ensuring covered data is not stored on transportable media (floppy drives, zip drives, etc); permanently erasing covered data from computers, diskettes, magnetic tapes, hard drives, or other electronic media before transferring, recycling, or disposing of them; storing physical records in a secure area and limiting access to that area; providing safeguards to protect covered data and systems from physical hazards such as fire or water damage; disposing of outdated records under a document disposal policy; shredding confidential paper records before disposal; maintaining an inventory of servers or computers with covered data; and other reasonable measures to secure covered data during its life cycle in the University’s possession or control.
- Managing System Failures
The University will maintain effective systems to prevent, detect, and respond to attacks, intrusions, and other system failures. Such systems may include maintaining and implementing current anti-virus software; checking with software vendors and others to regularly obtain and install patches to correct software vulnerabilities; maintaining appropriate filtering or firewall technologies; alerting those with access to covered data of threats to security; imaging documents and shredding paper copies; backing up data regularly and storing back up information off site, as well as other reasonable measures to protect the integrity and safety of information systems.
- Monitoring and Testing
Monitoring systems will be implemented to regularly test and monitor the effectiveness of information security safeguards. Monitoring will be conducted to reasonably ensure that safeguards are being followed, and to swiftly detect and correct breakdowns in security. The level of monitoring will be appropriate based upon the potential impact and probability of the risks identified, as well as the sensitivity of the information provided. Monitoring may include sampling, system checks, reports of access to systems, reviews of logs, audits, and any other reasonable measures adequate to verify that Information Security Program’s controls, systems, and procedures are working.
The Committee will provide a report on the status of the information safeguards and monitoring implemented for covered data as described in Section IV.
- Employee Management and Training
- Service Providers
In the course of business, the University may from time to time appropriately share covered data with third parties. Such activities may include collection activities, outsourcing activities, transmission of documents, destruction of documents or equipment, or other similar services. This Information Security Program will ensure that reasonable steps are taken to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue and requiring service providers by contract to implement and maintain such safeguards.
The Committee, by survey or other reasonable means, will identify service providers who are provided access to covered data. The Committee will work with Purchasing, and other offices as appropriate, to make certain that service provider contracts contain appropriate terms to protect the security of covered data.
- Program Maintenance
The Committee, working with responsible units and offices, will evaluate and adjust the Information Security Program in light of the results of testing and monitoring described in Section VI, as well as any material changes to operations or business arrangements, and any other circumstances which may reasonably have an impact on the Information Security Program.
This Information Security Program document will be reviewed at least annually by the Committee.
- Deans, Directors, Department Heads, and Other Managers. The dean, department head, director, or other manager responsible for managing employees with access to “covered data” will designate a responsible contact to work with the Committee to assist in implementing this program. The designated contact will ensure that risk assessments are carried out for that unit and that monitoring based upon those risks takes place. The designated responsible contact will report the status of the Information Security Program for covered data accessible in that unit to the Committee at least annually, and more frequently where appropriate.
Employees with Access to Covered Data. Employees with access to covered data must abide by University policies and procedures governing covered data, as well as any additional practices or procedures established by their unit heads or directors.
Information Security Committee. The Information Security Committee is responsible for implementing the provisions of this Information Security Program.
Computing Center Director. The Computing Center Director will designate individuals who have the responsibility and authority for information technology resources; establish and disseminate enforceable rules regarding access to and acceptable use of information technology resources; establish reasonable security policies and measures to protect data and systems; monitor and manage system resource usage; investigate problems and alleged violations of University information technology policies; and refer violations to appropriate University offices such as Personnel, Student Affairs, and the University Police Department for resolution or disciplinary action.
Louisiana Tech University policies and procedures relating to information security.