Policy: Data Classification and Protection

DATA PROTECTION

Educational institutions generate, handle, and store large amounts of data, including student, employee, educational, research, and financial data. These data need to be protected from “corruption, misapplication, compromise, misuse, and loss.” Data protection focuses on “how to apply the three critical information security imperatives: confidentiality, integrity, and availability” (EDUCAUSE Center for Analysis and Research, Data Protection Primer for Higher Education, ECAR Working Group Paper, June 20, 2016).

 

PURPOSE

The purpose of this policy is to establish a data classification scheme and set of protocols to ensure that Massasoit Community College remains in compliance with pertinent federal and Massachusetts state laws; to protect Massasoit students, faculty, and staff from unauthorized disclosure of confidential information; and to protect the College and its employees from financial and reputational harm.

 

SCOPE

This policy applies to all college employees, contractors, and individuals who have access to MCC data and information.  Data protected under this policy can reside on or in a variety of media (e.g., electronic files, paper documents, shred bins, physical servers, virtual servers, databases, file servers, personal computers, USB drives, and mobile devices) and can move through a variety of methods (human, network, wireless, etc.).

 

POLICY

All Massasoit employees and affiliated individuals with access to non-public data and information that are produced, stored, or managed by the College will be informed of the data security classification levels outlined in this document (page 2) and must adhere to the specific protocols established for each classification level (pages 3-4).

 

TRAINING

The effectiveness of this policy depends upon increasing awareness of information security responsibilities. Informational materials will be distributed to all current employees, and all new employees will be provided with policy information during their onboarding.  Specific objectives include ensuring that Massasoit employees and affiliates:

• Are aware of the need to protect data and information in accordance with federal and state laws.
• Are informed of the data classification scheme and understand the different security measures required for each classification level.
• Are knowledgeable about the College’s information security policies and practices.
• Clearly understand their responsibilities for protecting non-public data and information.

ENFORCEMENT

Any employee found to have violated, intentionally or unintentionally, this policy may be subject to disciplinary action, up to and including termination of employment.

 

DATA CLASSIFICATION

Data classification, in the context of information security, is the classification of data based on their level of sensitivity and the impact on the College should that data be disclosed, altered, or destroyed without authorization. Classification of data aids in determining baseline security controls for the  protection of the data.  This policy hereby formalizes the classification of all institutional data into one of four sensitivity levels (tiers), or classifications:

 

Classification	Examples	Access	Security
Tier 1: Restricted Data   Data whose access is restricted by law or non-disclosure agreements. Restricted data are specific types of confidential data requiring an extra level of security.	Social Security numbers Credit Card numbers Student grades Employee or student medical information Proprietary information shared by a 3rd party under a non-disclosure agreement *See “Types of Restricted Data” in the next section.	Limited to individuals in roles requiring access for fulfillment of professional responsibilities, and who have been authorized access by the area VP.	Highest   See section on “Storage and Handling of Restricted Data.”
Tier 2: Confidential Data   Data whose unauthorized disclosure could constitute an invasion of privacy, or cause financial loss or damage to the college’s reputation and the loss of community confidence	Student information that is not an official part of the record covered by FERPA Employee personnel files Performance evaluations Student evaluation forms Budget data	Limited to individuals in roles requiring access for fulfillment of professional responsibilities, and who have been authorized access by a manager at or above Director level.	High   Store in a secure server or locked file cabinet. Share files with authorized users via authorized file sharing applications. Do not email unless encrypted.
Tier 3: Internal/Private Data   Data whose unauthorized disclosure, alteration or destruction could result in a moderate risk to the college and its affiliates.	Information contained in Massasoit’s internal portal Students’ academic work Faculty academic work MCC statistics and performance metrics Student survey data Any information that has not been explicitly classified as either public, confidential, or restricted	Limited to the Massasoit community on a “need to know basis.” Access is granted by the data owner/manager.   Students, as owners of their academic work, must grant access before faculty or others may use it for purposes other than assessing student learning in a course.   Access may be extended to community groups by permission settings on authorized file sharing applications.	Moderate   Apply professional judgment on a case-by-case basis regarding data storage and transmission.
Tier 4: Public Data   Data that is accessible to the public by law, or whose disclosure presents little or no risk to the College and its affiliates.	Information contained on Massasoit’s public website Data reported to, and made public by, the U.S. Department of Education (IPEDS, etc.) and MA Department of Higher Education	Access is unrestricted; Data and information are available to the public.	Low   No security to access, but precautions taken to protect the integrity of the data.

 

TYPES OF RESTRICTED DATA

“Restricted data” are defined as ‘any confidential or personal information that is protected by law or policy and that requires the highest level of access control and security protection, whether in storage or in transmission.’  Restricted data include, but is not necessarily limited to:

• Personally Identifiable Information (PII) – Described below
• Private Educational Records protected under FERPA – Described below
• Payment Card Information (PCI) – Described below
• Electronic Protected Health Information (ePHI) protected by Federal HIPAA legislation or Massachusetts medical privacy laws
• Information whose confidentiality is legally protected by a contract or non-disclosure agreement
• Other information whose unauthorized access or disclosure could have a high degree of adverse effect on individuals or the College

 

Personally Identifiable Information (PII)

Protected under state law – MA 201 CMR 17.00

Unencrypted electronic information that includes an individual’s first name or first initial and last name, in combination with any one or more of the following:

• Social security number
• Driver’s license or state-issued ID number (does not include a Massasoit ID or V#)
• Financial account number, credit card number, or debit card number with or without any security code, access code, or password

 

Payment Card Information (PCI)

Per widely accepted Data Security Standards (PCI DSS) issued by the Payment Card Industry Security Standards Council

Credit card account number with any of the following:

• Cardholder name
• Service code
• Expiration date

 

Private Educational Record

Protected under federal law - FERPA

The Family Educational Rights and Privacy Act of 1974 (FERPA) is a federal law protecting the privacy of student records.  An ‘education record’ is any record maintained by the College or its employees in which a student can be personally identified. FERPA applies to any and all student data unless specifically exempted as ‘directory information’ that may be made public unless a student requests that it remain confidential.  (The allowable directory exemptions are listed in the Massasoit Student Handbook.) 

 

Examples of student data restricted by FERPA.

Unencrypted electronic information that includes an individual’s name, student ID or any other personal identifier, in combination with any one or more of the following:

• Address
• Birth date
• Gender
• Citizenship
• Marital status
• Disciplinary status
• Financial aid, tuition, payments, account balances
• Grades, exam scores, or GPA
• Applications and admissions information
• Evaluations, forms, memos, or correspondence to and about the student

 

STORAGE AND HANDLING OF RESTRICTED DATA

For each restricted data type, the data handling requirements and restrictions are defined to appropriately safeguard the information. Authorization to access restricted data will be based on an employee’s position and job responsibilities and granted by the area Vice President, in consultation with the Chief Information Officer and Associate Dean of Institutional Research. All employees must adhere to the following requirements and restrictions regarding the storage and handling of unencrypted restricted data

 

Technologies Used	PCI/ HIPAA	PII		FERPA
On-premises storage device (MCC network shared drive)	No	Yes – With access limited to authorized persons only		Yes – With access limited to authorized persons only
Authorized cloud storage provider (Massasoit OneDrive Google Drive)	No	Yes – With access limited to authorized persons only		Yes – With access limited to authorized persons only
Workstation   (on-campus college owned and managed computer)	No	Data on server should not be stored on workstation hard drive/internal memory except in rare cases, and only with authorization.		Data on server should not be stored on workstation hard drive/internal memory except in rare cases, and only with authorization.
Copying/printing	No	Should only be printed for legitimate need.  Print should not be left unattended on a printer/fax or in a public area. Must be sent via confidential envelope.		Should only be printed for legitimate need. Print should not be left unattended on a printer/fax or in a public area. Must be sent via confidential envelope.
Mobile computing devices (College-owned laptops, tablets, smart phones)	No	Requires authorization and should be rare. Requires password protection.		Requires authorization and should be rare. Requires password protection.
Removable media (CDs, USB drives)	No	Requires authorization and should be rare. Requires password protection and encryption.		Requires authorization. Requires password protection and encryption.
Electronic file transfer	No	Requires secure file transfer protocol (SFTP)		Requires secure file transfer protocol (SFTP)
College-provided email	No	Only Name, College ID, and Directory Information are permitted		Only Name, College ID, and Directory Information are permitted
Personal email	No	No		No
Personally managed computer (home computer or personal laptop)	No	No		No
Personal smart phone	No	No		No

 

ROLES AND RESPONSIBILITIES

 

ROLE	RESPONSIBILITY
Chief Information Officer	Responsible for managing the Information Security and Data Protection training and awareness initiative regarding storage and transmission of data.
Associate Dean of Institutional Research	Responsible for assigning data classifications in consultation with senior administrators and data stewards, and for educating administrators and data stewards about access restrictions.
All Managers	Responsible for ensuring that all employees are appropriately trained and understand their roles in adhering to the Information Security and Data Protection Policy.
All College Employees	Encouraged to complete IT security training.  Review and understand all MCC “Information Security Policies and Guidelines”