University Policy 117

Information Security Policy

Initially Approved: June 24, 2013
Revised and approved: April 25, 2016
Revised and approved: March 24, 2020
Technical Corrections: December 8, 2022

Policy Topic: Information Technology
Administering Office: Office of CIO

I. POLICY STATEMENT

Information security is the ongoing process of exercising due care and due diligence to protect the confidentiality, integrity and availability of information and information technology resources. Institutional information is both a valuable asset and a potential liability to the University. As such, the stewardship and security of institutional information are important responsibilities for every member of Western Carolina University (hereinafter “University” or “WCU”) that has access to it. As an academic institution we must encourage the free flow of most information, while protecting critical institutional information.

The purpose of this policy is to:

Define information security, its overall objectives and scope and the importance of security as an enabling mechanism for institutional information sharing;
State the commitment of University leadership to support the goals and principles of information security;
Provide a framework for referencing supporting security policies and standards; and
Define who is responsible for ensuring that institutional information is handled in an appropriate manner and the procedures for reporting information security incidents.

II. SCOPE AND APPLICATION OF THE POLICY

This policy applies to any person having responsibility for institutional information and any person making use of the University’s information technology resources, whether located on or off-campus, whether University-owned or contracted for use by the University.
The Policy is an overarching information security policy that refers to a group of more specific related University policies and information security standards.

III. DEFINITIONS

The term “Information Security” shall mean thepreservation of confidentiality, integrity and availability of information; in addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved.
The term “Standards” shall mean mandatory actions or rules that give this policy support and reinforcement in direction.
The term “Information Technology Resource” shall mean any system, media or software used to transmit, store or process information or data.
The term “Institutional Information”shall meaninformation generated, collected, maintained and/or owned by the University regardless of format.
The term “ISO 27002” shall meanan information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), entitled Information security, cybersecurity and proviacy protection - Information security controls .
The term “Information Owner”shall mean the individual or department that makes decisions regarding how to define, process and handle institutional information.
The term “Workforce Member” includes, but is not limited to, faculty, staff, employees, guests, consultants, vendors, volunteers, interns, student workers or temporary workers associated with the University.

IV. UNIVERSITY COMMITMENT

The following is an excerpt from the WCU Board of Trustees resolution adopted December 9, 2011:

WHEREAS, The University of North Carolina Information Technology Security Council recommended, and the University of North Carolina Chief Information Officers Council has approved, the adoption of ISO/IEC 27002 Information Technology – Security Techniques – Code of practice for information security management (the “ISO Standards”)as the common security framework to be used by the University and other University of North Carolina constituent institutions in the development of information technology security policies; and

WHEREAS, the ISO Standards provide a comprehensive and systematic approach to ensure that appropriate information technology security controls are in place as well as flexibility to meet the specific needs of the constituent institutions; and

BE IT RESOLVED, that this Board of Trustees hereby approves the adoption of the ISO Standards as the security framework for the University.

V. SECURITY POLICY FRAMEWORK

The University of North Carolina and WCU have adopted ISO 27002 as the framework for university information security policy. This policy is the umbrella University information security policy that will refer to existing and future policies and standards that support it. Related university policies and standards will reference security clauses from the ISO 27002 framework.

VI. RESPONSIBILITIES

The Chancellor, Provost, Vice Chancellors, General Counsel, the CIO, the Chief of Staff and the Director of Athletics are responsible for ensuring the appropriate handling of the institutional information produced and managed by their division/unit. These positions are the institutional Data Stewards.
The Information Technology Division is responsible for ensuring that the appropriate technologies and system policies and permissions are in place to ensure appropriate access to electronic data.
The Chancellor has established a Data Security and Stewardship Committee, which reports to the Chancellor. The charge of this Committee is to oversee the implementation of this policy, ensure procedures are up to date, coordinate all relevant security policy and standards reviews, and assist offices with risk assessments, etc.
Department managers are responsible for all general and regulatory information security training of workforce members, and for enforcing information security policies and standards.
All workforce members are responsible for reporting information security incidents and assisting the Information Security Incident Response Team in investigating and mitigating computer security incidents.

VII. COMPLIANCE

All workforce members are:

Responsible for protecting any institutional information and systems that they access, process or handle;
Responsible for the consequences of their decisions and actions associated with institutional information access and processing; and
Responsible for discussing and reporting any suspicious or harmful behavior and activity to the IT Division and the owner of the institutional information, if known.