Topics Map > UW-Madison > Records Management
Topics Map > UW-Madison > Cybersecurity > Configuration and Maintenance
Topics Map > UW-Madison > Cybersecurity > Monitoring and Mitigation
UW-Madison - CIO - Restricted Data Security Management Policy
Applies to all Schools, Colleges, Divisions, Centers and other units of UW-Madison, including any associated contractors or other entities or persons.
The policy requires that all UW-Madison units find restricted data in their possession, dispose of any that is no longer needed, store as much as practical of what remains in approved storage locations, and annually report any that is not stored in approved storage locations and provide an appropriate level of protection for it. The policy also requires that, to the extent practical, the responsible parties eliminate or reduce the presence of restricted data in business processes, applications, and data that is used for university business. The Restricted Data Security Management Procedures are the implementation of the policy.
The policy requires that all UW-Madison units find restricted data in their possession, dispose of any that is no longer needed, store as much as practical of what remains in approved storage locations, and annually report any that is not stored in approved storage locations and provide an appropriate level of protection for it. The policy also requires that, to the extent practical, the responsible parties eliminate or reduce the presence of restricted data in business processes, applications, and data that is used for university business.
The Restricted Data Security Management Procedures are the implementation of the policy.
The deadline for reports has been extended one year, to Dec 31, 2017. No reports are due in 2016.
The provisions mandating annual discovery, reduction and protection of SSN's have not been suspended.
- Of interest to:
- IT Security Staff
- IT Staff
- Cloud Services
- Mobile Devices
- Personally-owned Dev.
- Config and Maintenance
- Monitoring and Mitigation
- Data Handling Activities:
- Business Use
The Restricted Data Security Management policy will initially only apply to UW-Madison Social Security Numbers (SSN’s) during the period from January 1st 2015 through December 31st 2017. The initial period may be extended.
"Restricted Data", (defined at Data Classifications,) includes at least six different kinds of data, one of which is Social Security Number (SSN). “UW-Madison Restricted Data” is Restricted Data for which the institution has an ownership, stewardship or custodial interest. It does not include data which is unrelated to UW-Madison business.
All Schools, Colleges, Divisions, Departments, Centers and other units of UW-Madison must at least annually find, reduce, protect, and report the storage locations of UW-Madison Restricted Data related to the unit’s business, including Restricted Data stored by contractors or other entities or persons associated with the unit.
Find UW-Madison Restricted Data on all computing devices and services that are used for UW-Madison business, including Restricted Data on personally-owned devices and privately-contracted services when the device or service is used for UW-Madison business.
Dispose of unneeded files, data records, or data sets that contain UW-Madison Restricted Data, being careful to retain UW-Madison records according to the approved records retention schedules.
Move as many of the remaining instances of UW-Madison Restricted Data as practical into any of the offline or online storage locations that are approved by the Office of Cybersecurity for the long-term storage of Restricted Data, retaining in other locations only those instances that are necessary for immediate operations.
Report all remaining instances of UW-Madison Restricted Data to the Office of Cybersecurity using the currently established reporting procedures.
Accountability and responsibility for compliance with provision (1) of the policy is distributed as follows:
Management for each School, College, Division, Department, Center or other unit of UW-Madison is accountable to higher management for the compliance of their unit, including all employees, contractors and associates.
Employees, contractors and associates of each unit are responsible for making computing devices and services that they own, operate, or possess available for inspection if that device or service is used for UW-Madison business.
Some UW-Madison Restricted Data is stored on personally-owned devices or privately-contracted services that are being used for UW-Madison business. UW-Madison is obligated to assure that UW-Madison Restricted Data is appropriately protected, regardless of the ownership or location of the device or service.
The university respects the privacy of individuals and non-university entities. As an alternative to inspection, employees, contractors and associates may provide satisfactory assurances that either:
there is not significant storage or use of UW-Madison Restricted Data on the device or service.
if there is significant storage or use, either:
the storage or use will be reduced in a timely manner so it is no longer significant, or
the device or service is, or soon will be, protected as described by the mandatory portions of the applicable data security standard.
The threshold for “significant use” is specified in the associated implementation procedures.
Management for each unit determines what assurances are satisfactory, consistent with the guidelines provided in the associated implementation procedures, subject to review by higher management in consultation with the Office of Cybersecurity.
Responsibility for providing technical or procedural support may be delegated to IT staff, but this does not relieve others from their accountability and responsibility as described in (2)(a-b).
UW-Madison data stewards, data custodians, business process owners and others with similar responsibilities for managing data must, when practical, eliminate or reduce the presence of UW-Madison Restricted Data in forms, files, data records, data sets, databases, applications, processes, and other similar locations.
- The Restricted Data Security Management policy and the associated implementation procedures provide general criteria for managing UW-Madison Restricted Data. When more specific guidance is needed, the data stewards or their delegates, in consultation with the Office of Cybersecurity, make the final decision on the conditions under which UW-Madison Restricted Data may be present in particular circumstances.
- The Restricted Data Security Management policy applies to all computing devices and services that are used for UW-Madison business, regardless of who owns, operates, or possesses them, including both UW-Madison-owned and non-UW-Madison-owned devices and services. The associated implementation procedures provide guidance on how to address personally-owned devices and privately-contracted services in a manner that respects the privacy of individuals and non-university entities.
- This policy applies to graduate and undergraduate student employees in the performance of their job duties. Students are otherwise exempt from this policy.
- Exceptions are described in the associated implementation procedures.
The long-term purpose of the Restricted Data Security Management policy is to locate and secure UW-Madison Restricted Data.
In order to identify and manage the highest risk data as quickly as practical, the policy will initially only apply to UW-Madison SSN’s.
Unauthorized access to Restricted Data can have significant detrimental effects on individuals or the institution. Restricted Data can be used for fraud and identity theft. Cyber criminals regularly attack computers and networks in higher education institutions. There have been sizeable information security breaches at institutions that resulted in financial impacts of many hundreds of thousands dollars. Those amounts do not account for the loss of reputation and trust that can have a serious ongoing impact on both instruction and research.
The university is obligated to protect UW-Madison Restricted Data and to report possible incidents. Protection of Restricted Data is governed by a number of different laws and standards, including for example, the Health Insurance Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security Standard (PCI-DSS), and the Wisconsin Data Breach Notification Law.
In order to protect Restricted Data the institution must have up-to-date information about where it is stored. There is a significant reduction in risk if the presence of Restricted Data is reduced to the extent practical. In addition to finding and reporting the presence of the data, the annual discovery and reporting process is a convenient time to consider how the presence of the data can be reduced.
The university’s obligation to protect UW-Madison Restricted Data does not depend upon the location or ownership of the computing device or service which is used to store, transmit or process it. For this reason, the policy and procedures address both UW-Madison-owned and non-UW-Madison-owned computing devices and services that are used for UW-Madison business.
The university respects the privacy of employees, contractors, and associates. The university is obligated to appropriately manage all UW-Madison data no matter how it is stored, transmitted, or processed. The policy and associated implementation procedures include provisions that protect privacy while at the same time enabling the institution to fulfill its obligations.
Issued by the UW-Madison Vice Provost for Information Technology.
Failure to comply may result in appropriate action to enforce compliance, and/or denial of access to UW-Madison Restricted Data or other UW-Madison information resources. In addition:
UW-Madison employees who do not comply may be subject to disciplinary action up to and including termination of employment.
Contractors or associates who do not comply may be subject to penalty under the governing agreement. Compliance with the policy may be a consideration affecting new or renewed agreements.
Computing services or devices may be denied access to UW-Madison information resources to assure that UW-Madison Restricted Data is only present in known locations that are adequately protected.
Please address questions or comments to firstname.lastname@example.org.
The "IT Policy Glossary" defines a number of terms used in this policy.
There are numerous other policies that govern the protection of UW-Madison Restricted Data. These may vary according to the specific type of Restricted Data, or how that data is collected or used.
The DoIT Knowledge Base (KB) has a document on Getting Started with Sensitive Data Manager (formerly Identity Finder), which includes training and links to other KB articles. There is also an Sensitive Data Manager (formerly Identity Finder) FAQ, and a list of all related articles.
The deadline for reports has been extended one year, to Dec 31, 2017. No reports are due in 2016.