Information Security Policy: Difference between revisions

Latest revision as of 14:34, 14 December 2020

Policy 903

Introduction

The purpose of this policy is to outline the framework for the University’s comprehensive Information Security Program to help safeguard the confidentiality, integrity, and availability of campus Information Resources, and comply with federal and state law, and UNC System policies.

Scope

This policy applies to all Appalachian State University employees, students, vendors and visitors.

Definitions

Information Security

The preservation of the confidentiality, integrity and availability of Information Resources and Institutional Data.

Information Security Program

Policies, assessments, protocols, and training designed to govern the security of Information Resources.

Information Resources

Same meaning as defined in Appalachian Pollicy 901 - IT Governance Policy.

Control

The management of risk which can be of an administrative, technical, management, or legal nature. Examples include policies, procedures, guidelines, practices or organizational structures.

Information Security Event

An identified occurrence of a system, service, or network state indicating a possible breach of Information Security policy or failure of safeguards, or a previously unknown situation that may be security relevant.

Information Security Incident

An unwanted or unexpected Information Security Event that has a significant probability of compromising business operations and threatening Information Security.

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

Independent international organizations responsible for the creation of industry technical and administrative security standards.

Policy and Procedure Statements

Information Security Program

The University shall develop, implement, and maintain a comprehensive Information Security Program (the “Program”). The Program will be updated on a periodic basis or as necessitated by significant changes to the University's mission, major initiatives, or opportunities. The development of the plan will be guided by the following elements:

ISO/IEC 27002 - The Program shall be guided and informed by the ISO/IEC 27002 standard, adopted as the common security framework baseline for campuses of the UNC system;
Legal, Contractual, and Policy Requirements - In relation to the management and protection of Information Resources, the University shall conduct all business in accord with relevant federal and state law, and UNC System policies; and
Proactive Risk Management - The Program shall be driven by the identification, assessment, communication, and cost-effective treatment of risks related to University Information Resources.

Governance, Coordination, and Security Services

4.2.1 Board of Trustees Audit Committee

Appalachian’s Board of Trustees Audit Committee will review and provide oversight of Information Security on at least an annual basis including, but not limited to, emerging Information Security matters, institutional Program activities, information technology security Controls, and risk assessments.

4.2.2 Information Security Advisory Council

To ensure the Program is aligned with the University’s mission, values, and operational needs, the Chancellor will appoint a University Information Security Advisory Council to oversee the collaborative development of the plan and associated policies, major initiatives, and campus security solutions.

4.2.3 Information Security Liaisons

To ensure that campus units are informed about security initiatives, practices, and requirements, University units that maintain and manage their own Information Technology will appoint Information Security Liaisons to act as central points of contact for communication and coordination with the ITS - Office of Information Security.

4.2.4 ITS - Office of Information Security

The ITS Office of Information Security shall be responsible for providing Information Security services that help identify risks, establish protective measures, and validate conformance with relevant University Information Security policies and standards.

Roles and Responsibilities

4.3.1 Shared Responsibilities

Information Security is a shared responsibility. All employees, students, visitors and vendors of the University share in the responsibility to help protect University Information Resources. The roles and responsibilities for University Information Security include:

4.3.2 Chancellor and Chancellor’s Cabinet

The Chancellor and Chancellor’s Cabinet shall be responsible for:

Approval of the University’s Information Security policy;
Providing executive oversight and support of the Information Security Program;
Providing guidance concerning institutional risk tolerance levels;
Providing resources to meet approved security objectives; and
Periodically reviewing the University’s Information Security posture.

4.3.3 The Chief Information Officer

The Chief Information Officer shall be responsible for oversight of Information Security in accordance with UNC System policies, and has authority and accountability for:

The campus-wide adoption, implementation, and enforcement of the Information Security Program;
Deploying all reasonable measures to maintain the confidentiality, integrity, and availability of Information Resources;
Periodically reporting Information Security posture to the Chancellor and Chancellor’s Cabinet and Board of Trustees Audit Committee; and
Delegating select authority to the Chief Information Security Officer and/or other institutional officers as needed to meet the objectives listed elsewhere in this policy.

4.3.4 Chief Information Security Officer

The Chief Information Security Officer shall be responsible for:

Leading the development and execution of the Program;
Facilitating Information Security governance and collaboration;
Advising the Chief Information Officer and senior leadership on security needs and resource investments; and
Development of Information Security policies, standards, and guidelines.

4.3.5 Deans and Department Heads

Deans and Department Heads shall be responsible for:

Ensuring that units adhere to Information Security policies and standards; and
Ensuring that reporting staff receives any required security training.

4.3.6 University Employees and Students

All University employees and students shall be responsible for:

Awareness and adherence to Information Security policies, standards, and guidelines;
Attending any required Information Security training; and
Prompt reporting of Information Security Events and Incidents to Information Technology Services without delay.

4.3.7 Vendors

Complying with all federal and state laws, UNC System policies, Appalachian policies, and contractual obligations with the University concerning the protection of information resources and information technology.

Additional References

Appalachian Policy 503.8 - Payment Card Services Policy

Appalachian Policy 901 - Information Technology Governance Policy

Appalachian Policy 902 - Data Governance Policy

Authority

Contact Information

Office of the Chief Information Officer (828-262-6278)

Chief Information Security Officer (828-262-6277)

Original Effective Date

March 16, 2015

Revision Dates

November 28, 2018

December 7, 2020

@@ Line 34: / Line 34: @@
 <li style="list-style-type:lower-alpha">ISO/IEC 27002 - The Program shall be guided and informed by the ISO/IEC 27002 standard, adopted as the common security framework baseline for campuses of the UNC system;</li>
 <li style="list-style-type:lower-alpha">Legal, Contractual, and Policy Requirements - In relation to the management and protection of Information Resources, the University shall conduct all business in accord with relevant federal and state law, and UNC System policies; and</li>
-<li style="list-style-type:lower-alpha">Proactive Risk Management - The Program shall be driven by the identification, assessment, communication, and cost-effective treatment of risks related to University Information Resources</li>
+<li style="list-style-type:lower-alpha">Proactive Risk Management - The Program shall be driven by the identification, assessment, communication, and cost-effective treatment of risks related to University Information Resources.</li>
 </ol>
 === Governance, Coordination, and Security Services ===
-.2.1 Board of Trustees Audit Committee
+'''4.2.1 Board of Trustees Audit Committee'''
 Appalachian’s Board of Trustees Audit Committee will review and provide oversight of Information Security on at least an annual basis including, but not limited to, emerging Information Security matters, institutional Program activities, information technology security Controls, and risk assessments.
-.2.2 Information Security Advisory Council
+'''4.2.2 Information Security Advisory Council'''
 To ensure the Program is aligned with the University’s mission, values, and operational needs, the Chancellor will appoint a University Information Security Advisory Council to oversee the collaborative development of the plan and associated policies, major initiatives, and campus security solutions.
-.2.3 Information Security Liaisons
+'''4.2.3 Information Security Liaisons'''
 To ensure that campus units are informed about security initiatives, practices, and requirements, University units that maintain and manage their own Information Technology will appoint Information Security Liaisons to act as central points of contact for communication and coordination with the ITS - Office of Information Security.
+'''4.2.4 ITS - Office of Information Security'''
-.2.4 ITS - Office of Information Security
 The ITS Office of Information Security shall be responsible for providing Information Security services that help identify risks, establish protective measures, and validate conformance with relevant University Information Security policies and standards.
@@ Line 58: / Line 57: @@
 === Roles and Responsibilities ===
-Information Security is a shared responsibility. All employees of the University share in the responsibility to help protect University information resources.
+'''4.3.1 Shared Responsibilities'''
-The roles and responsibilities for University Information Security include:
+Information Security is a shared responsibility. All employees, students, visitors and vendors of the University share
+in the responsibility to help protect University Information Resources. The roles and responsibilities for University
+Information Security include:
-.3.1 Chancellor and Chancellor’s Cabinet - The Chancellor and Chancellor’s Cabinet shall be responsible for:
+'''4.3.2 Chancellor and Chancellor’s Cabinet'''
-#Approval of the University’s Information Security policy.
-#Providing executive oversight and support of the Information Security Program.
-#Providing guidance concerning institutional risk tolerance levels.
-#Providing resources to meet approved security objectives.
-#Periodically reviewing the University’s information security posture.
-.3.2 The Chief Information Officer - As defined in the UNC Information Security Policy (1400.2), the Chief Information Officer shall have authority and accountability for:
+The Chancellor and Chancellor’s Cabinet shall be responsible for:
-#The campus-wide adoption, implementation, and enforcement of the Information Security Program.
+<ol><li style="list-style-type:lower-alpha">Approval of the University’s Information Security policy;</li>
-#Deploying all reasonable measures to maintain the confidentiality, integrity, and availability of information resources.
+<li style="list-style-type:lower-alpha">Providing executive oversight and support of the Information Security Program;</li>
-#Periodically reporting information security posture to the Chancellor and Chancellor’s Cabinet and Board of Trustees Audit Committee.
+<li style="list-style-type:lower-alpha">Providing guidance concerning institutional risk tolerance levels;</li>
-#Delegating select authority to the Chief Information Security Officer and/or other institutional officers as needed to meet the objectives listed elsewhere in this Policy.
+<li style="list-style-type:lower-alpha">Providing resources to meet approved security objectives; and</li>
+<li style="list-style-type:lower-alpha">Periodically reviewing the University’s Information Security posture.</li>
+</ol>
-.3.3 Chief Information Security Officer - The Chief Information Security Officer shall be responsible for:
+'''4.3.3 The Chief Information Officer'''
-#Leading the development and execution of the University’s security program.
-#Facilitating information security governance and collaboration.
-#Advising the Chief Information Officer and senior leadership on security needs and resource investments.
-#Development of information security policies, standards, and guidelines.
-.3.4 Deans and Department Heads - Deans and Department Heads shall be responsible for:
+The Chief Information Officer shall be responsible for oversight of Information Security in accordance with UNC System
-#Ensuring that units adhere to information security policies and standards.
+policies, and has authority and accountability for:
-#Ensuring that reporting staff receives any required security training.
-.3.5 University Employees - All University employees shall be responsible for:
+<ol><li style="list-style-type:lower-alpha">The campus-wide adoption, implementation, and enforcement of the Information Security Program;</li>
-#Awareness and adherence to information security policies and standards.
+<li style="list-style-type:lower-alpha">Deploying all reasonable measures to maintain the confidentiality, integrity, and availability of Information
-#Attending any required information security training.
+Resources;</li>
-#Prompt reporting of potential information security incidents to Office of Information Security without delay.
+<li style="list-style-type:lower-alpha">Periodically reporting Information Security posture to the Chancellor and Chancellor’s Cabinet and Board of Trustees
+Audit Committee; and</li>
+<li style="list-style-type:lower-alpha">Delegating select authority to the Chief Information Security Officer and/or other institutional officers as needed to
+meet the objectives listed elsewhere in this policy.</li></ol>
-=== Key Control Requirements ===
+'''4.3.4 Chief Information Security Officer'''
-To address relevant policy, legal, and contractual obligations, the following key security control requirements will be addressed through existing controls, compensating controls, or prioritized implementation planning consistent with available resources.
+The Chief Information Security Officer shall be responsible for:
+<ol><li style="list-style-type:lower-alpha">Leading the development and execution of the Program;</li>
+<li style="list-style-type:lower-alpha">Facilitating Information Security governance and collaboration;</li>
+<li style="list-style-type:lower-alpha">Advising the Chief Information Officer and senior leadership on security needs and resource investments; and</li>
+<li style="list-style-type:lower-alpha">Development of Information Security policies, standards, and guidelines.</li></ol>
-.4.1 Risk Management
+'''4.3.5 Deans and Department Heads'''
-#Regular identification and analysis of risks will be performed for information assets identified as having a high level of importance.
-#Risk treatment options, including any cost-effective controls, will be analyzed and identified.
-#Appreciable risks and treatment options will be communicated on a regular basis for decision review. ''Reference: ISO 27002:2013-6.1.1; GLBA:16 CFR §314.4; HIPAA: 45 CFR §164.308(a)(1)(ii)(A); PCI-DSS 3.2-12.2, UNC Information Security Policy (1400.2, Section III)''
-.4.2 Human Resource Security
+Deans and Department Heads shall be responsible for:
-#Screening/Background Checks - Prospective employees who receive an offer of employment will be vetted via a background check including a criminal background investigation. ''Reference: ISO 27002:2013-7.1.1; HIPAA:45 CFR §164.308(a)(3)(ii)(B); PCI-DSS 3.2-12.7''
+<ol><li style="list-style-type:lower-alpha">Ensuring that units adhere to Information Security policies and standards; and</li>
-#Security Awareness Training - All University employees will receive regular security awareness training in addition to any specific training associated with job responsibilities and employee roles. ''Reference: ISO 27002:2013-7.2.2, PCI-DSS 3.2-12.6''
+<li style="list-style-type:lower-alpha">Ensuring that reporting staff receives any required security training.</li></ol>
-#Disciplinary Process - Employee disciplinary processes will include applicable provisions to cover any egregious violations of approved information security policies or requirements. ''Reference: ISO 27002:2013 - 7.2.3; HIPAA: 45 CFR §164.308(a)(1)(ii)(C)''
-#Termination of Employment - Access to University information resources, work areas, and processing facilities will be revoked and assets returned upon full termination of employment with University. Retirees may retain an institutional email account and associated services to maintain connection to campus. ''Reference: ISO 27002:2013-7.3, 8.1.4; HIPAA: 45 CFR § 164.308(a)(3)(ii)(C); PCI-DSS 3.2: 8.1.3; 9.3''
-.4.3 Asset Management
+'''4.3.6 University Employees and Students'''
-#Data Governance - All institutional data will be considered the property of the University and will be treated as an asset. A data management structure will be established that defines responsibilities for secure and effective management of institutional data.
-#Data Classification – The University will adopt a consistent data classification scheme that takes into account associated business needs and risks related to sharing or restricting information. ''Reference: ISO 27002:2013-8.2''
-#Acceptable Use and Security Requirements - Appropriate utilization of University information assets will be clearly defined, including secure practices for handling data classified as sensitive. ''Reference: ISO 27002:2013-8.1.3,8.2.3''
-#Inventory of Important Assets - An inventory of all information assets that have a high level of importance will be maintained and indicate their owner, location, and management information. ''Reference: ISO 27002:2013-8.1.1,8.1.2; HIPAA: 45 CFR §164.310(d)(2)(iii)''
-#Information Asset Transfer and Destruction - Information assets will be reliably transferred and any data they contain rendered unreadable prior to transfer to another employee, sale or other disposition. ''Reference: ISO 27002:2013-8.1.4,8.3.2,11.2.7; HIPAA: 45 CFR §164.310(d)(2)(i),§164.310(d)(2)(ii); PCI-DSS 3.2-9.8''
-.4.4 Access Control
+All University employees and students shall be responsible for:
-#Role Based Access Control - University information asset owners will define appropriate roles associated with the fulfillment of legitimate business needs. These roles should be defined based on two functions:
+<ol><li style="list-style-type:lower-alpha">Awareness and adherence to Information Security policies, standards, and guidelines;</li>
-##Data Maintenance Roles - The access for data maintenance in administrative systems will be determined based on the employee position and location, and will be governed by the business requirements.
+<li style="list-style-type:lower-alpha">Attending any required Information Security training; and</li>
-##Data Inquiry Roles - The access for data inquiry will be determined by the required data set and associated data classification level, and will be governed by the data steward assigned the requested data set. These roles will have associated access control rules, access rights, and restrictions that provide a sufficient degree of access needed to efficiently accomplish these business needs. Assignments to these roles should be periodically reviewed. ''Reference: ISO 27002:2013-9.1; HIPAA: 45 CFR §164.312(a)(1); PCI-DSS 3.2 -7.1''
+<li style="list-style-type:lower-alpha">Prompt reporting of Information Security Events and Incidents to Information Technology Services without delay.</li></ol>
-#Network Access Control - Local and remote access to University networks and information services will be limited to authorized individuals with legitimate business needs. ''Reference: ISO 27002:2013-9.1.2; HIPAA: 45 CFR §164.312(a)(1); PCI-DSS 3.0 9.1.2''
-#User Access Management - Formal user provisioning and deprovisioning processes will be implemented to ensure that creation of new accounts is authorized, users are uniquely identified, redundant userIDs are periodically removed, and that userIDs are disabled when no longer required. ''Reference: ISO 27002:2013-9.2.1,9.2.2; HIPAA: 45 CFR §164.312(a)(2)(i),§164.312(a)(2)(d); PCI-DSS 3.2-8.1.2''
-#Management of Privileged Access - Privileged access rights will be appropriately evaluated, approved, periodically reviewed, and limited to only those users and applications with legitimate and sufficient business need. ''Reference: ISO 27002:2013-9.2.3; PCI-DSS 3.2-7.1''
-#Password Management - Passwords used to access University resources will be established and managed in a formally approved and consistently secure manner. ''Reference: ISO 27002:2013-9.2.4, HIPAA: 45 CFR §164.308(a)(5)(ii)(D)''
-#Secure Logon - Common secure logon practices will be defined and implemented to ensure that means of access to University systems and applications effectively minimize the risks of unauthorized access threats. ''Reference: ISO 27002:2013-9.4.2; HIPAA: 45 CFR §164.312(a)(2)(iii)''
-#Source Code Control - Access to program source code for University systems will be strictly controlled to authorized individuals only. ''Reference: ISO 27002:2013-9.4.5''
-.4.5 Cryptographic Security
+'''4.3.7 Vendors'''
-#Use of Cryptographic Controls - University information systems will utilize cryptographic controls to address appreciable risks related to the confidentiality and integrity of sensitive information and non-repudiation of electronic transactions with University systems. ''Reference: ISO 27002:2013-10.1.1; HIPAA: 45 CFR §164.312(a)(2)(e); PCI DSS 3.2-3.4''
-#Key Management - University cryptographic keys will be generated, stored, and managed in a secure and approved manner. ''Reference: ISO 27002:2013-10.1.2; PCI-DSS 3.2-3.5,3.6''
-.4.6 Physical and Environmental Security
-#Physical Security Perimeters - Information processing facilities and other secure areas will have well defined physical boundaries and implement sufficient physical barriers and restrictions to prevent unauthorized entry and physical access. ''Reference: ISO 27002:2013-11.1.1; HIPAA: 45 CFR §164.310(a)(1); PCI-DSS 3.2-9.1,9.3''
-#Physical Entry Controls - Only authorized personnel will be allowed to enter information processing facilities and other secure areas. All access attempts will be monitored and logged. Unauthorized access attempts will be addressed. ''Reference: ISO 27002:2013-11.1.2; HIPAA: 45 CFR §164.310(a)(2); PCI-DSS 3.2-9.1,9.2''
-#Environmental Threats - Information processing facilities will be protected against natural disasters and damage from environmental accidents. ''Reference: ISO 27002:2013-11.1.14''
-#Information Processing Facilities - Work conducted in Information Processing Facilities will adhere to all documented safety and security requirements. ''Reference: ISO 27002:013-11.1.5''
-#Removal of Assets - Equipment, information, or software will not be taken off-campus without prior authorization. ''Reference: ISO 27002:2013-11.2.5; HIPAA: 45 CFR §164.310(d)(1)''
-#Unattended Equipment - Unattended user equipment will have appropriate protection controls and measures to prevent unauthorized use. ''Reference: ISO 27002:2013-11.2.8; PCI-DSS 3.2-8.1.8''
-.4.7 Operations Security
-#Change Management - Changes to business processes, information processes, facilities, and systems that may impact University information security will be appropriately identified, evaluated, communicated, and controlled. ''Reference: ISO 27002:2013-12.1.3; PCI-DSS 3.2-6.4''
-#Capacity Management - The utilization of high value information resources will be monitored, assessed, and optimized to maximize availability in conjunction with appropriate controls. ''Reference: ISO 27002:2013-12.1.3''
-#Separation of Development, Testing, and Operational Environments - Development, testing, and operational environments will be sufficiently separated and any sensitive information stored in these environments will have at least equivalent protection measures. ''Reference: ISO 27002:2013-12.1.4; PCI-DSS 3.2-6.4.1''
-#Malware Protection - Detection, Prevention, and Recovery measures will be established to protect University information systems against malicious software applications. ''Reference: ISO 27002:2013-12.2; HIPAA: 45 CFR §164.308(a)(5)(ii)(B); PCI-DSS 3.2-5.1''
-#Information Backups - Backup copies of valuable data will be regularly created, stored securely, validated, and periodically tested for recoverability. ''Reference: ISO 27002:2013-12.3; GLBA: 16 CFR §314.4(2); HIPAA: 45 CFR §164.310(d)(2)(4); PCI-DSS 3.2-9.5''
-#Logging and Monitoring - Important events related to University information assets will be reliably archived, regularly reviewed, and protected from tampering and unauthorized access. ''Reference: ISO 27002:2013-2.4; HIPAA: 45 CFR §164.312(b); PCI-DSS 3.2-10''
-#Clock Synchronization - University information systems’ clocks will be synchronized against a single authorization reference time source. ''Reference: ISO 27002:2013-12.4.4; PCI-DSS 3.2-10.4''
-#Vulnerability Management - Security weaknesses related to University information systems will be promptly identified, assessed, and remediated according to the associated risks they present to the University. ''Reference: ISO 27002:2013-12.6; PCI-DSS 3.2-11.2''
-#Information System Audits - Audit activities involving verification of production information systems will be carefully planned, formally authorized, and executed by qualified personnel only. ''Reference: ISO 27002:2013-12.7''
-.4.8 Communications Security
+Complying with all federal and state laws, UNC System policies, Appalachian policies, and contractual obligations with
-#Network Service Authority - The management and provisioning of University network connections, services, and devices will be limited to authorized staff only. ''Reference: ISO 27002:2013-13.1.1,13.1.2''
+the University concerning the protection of information resources and information technology.
-#Network Filtering - Network traffic traversing University owned networks will be filtered to address any appreciable risks and to preserve equitable availability of University network resources. ''Reference: ISO 27002:2013 - 13.1.1.g,13.1.2; GLBA: 16 CFR §314.4(2); PCI-DSS 3.2-1.1''
-#Network Attack Detection and Prevention - Network traffic traversing University owned networks will be inspected for active attacks against University information assets. Interdiction capabilities will be maintained to effectively block attacks that present appreciable risks to the University. ''Reference: ISO 27002:2013-13.1.1.d; GLBA: 16 CFR §314.4(3); PCI-DSS 3.2-11.4''
-#Network Segregation - Network services, users, and information services will be segregated on networks based on trust levels and associated risks. ''Reference: ISO 27002:2013-13.13; GLBA: 16 CFR §314.4(2)''
-#Information Transfer - Transfer methods and controls will be defined and adhered to in order to protect University sensitive information traversing all forms of communication facilities to both internal and external senders and recipients. ''Reference: ISO 27002:2013-13.2.1; GLBA: 16 CFR §314.4(2)''
-#Electronic Messaging - Protection measures will be established to safeguard University electronic messaging solutions from unauthorized access, modification or denial of service. Retention of electronic messaging communication will be maintained in an approved manner. ''Reference: ISO 27002:2013-13.2.3''
-#Confidentiality Agreements - Confidentiality agreements will be used to establish legally enforceable terms of utilization and access for University confidential information for both external parties and employees. ''Reference: ISO 27002:2013-13.2.4''
-.4.9 System Acquisition, Development and Maintenance
-#Security Requirements Analysis - The development and acquisition of information systems will include the regular evaluation of security requirements in the earliest possible stages of related information system projects. ''Reference: ISO 27002:2013-14.1.1''
-#Secure Development - Secure program techniques and modeling methods will be employed to ensure that coding practices adhere to best practices to limit potential for abuse. ''Reference: ISO 27002:2013-14.2.1''
-#System Change Control - Change control procedures will be documented and enforced to ensure the confidentiality, integrity, and availability of information systems throughout maintenance efforts. ''Reference: ISO 27002:2013-14.2.2''
-#System Security Testing - System acceptance testing will include security testing and validation of effectiveness of controls related to any identified information security requirements. ''Reference: ISO 27002:2013-14.2.2''
-#Test data - If viable options are available, data that contains sensitive information will not be used for system or application testing purposes. Test systems that do contain this data must adhere to common data security standards. ''Reference: ISO 27002:2013-14.2.8''
-.4.10 Supplier Relationship
-#Supplier Security Agreements - Security requirements will be documented and agreed with each supplier that may access, process, store, or communicate University owned data. ''Reference: ISO 27002:2013 - 15.1.1, 15.1.2; GLBA: 16 CFR §314(d1), 16 CFR 314(d2)''
-#Monitoring and Review of Supplier Services - Periodic review of supplier services will be conducted to ensure that related security agreements are being adhered to and enforced. ''Reference: ISO 27002:2013-15.2.1''
-.4.11 Information Security Incident Management
-#Reporting of Information Security Events - Information security events will be reported through an approved channel and reviewed promptly by authorized employees. ''Reference: ISO 27002:2013-16.1.2; PCI-DSS 3.2 12.5.3, 12.10.1''
-#Reporting of Information Security Weaknesses - Employees and contractors will be encouraged to note and report any appreciable information security weaknesses observed in systems or services. ''Reference: ISO 27002:2013-16.1.3''
-#Response to Information Security Incidents - Response actions related to security incidents will adhere to a documented set of procedures, including appropriate communication and coordination of efforts. ''Reference: ISO 27002:2013-16.1.4, 16.1.5; GLBA: 16 CFR §314.4(b)(3); UNC Information Security Policy (1400.2, Section III)''
-#Learning From Information Security Incidents - Knowledge gained during the analysis of security incidents will be captured, reviewed, and appropriately shared to identify security corrections or control measures that may help address similar events. ''Reference: ISO 27002:2013-16.1.6''
-#Collection of Evidence - Methods to preserve electronic evidence will follow adequate standards of discovery and preservation to prevent spoliation. ''Reference: ISO 27002:2013-16.1.7''
-.4.12 Business Continuity Management
-#Information Security Continuity - Planning will be undertaken to ensure that appropriate levels of information security protection measures are maintained during emergencies or other adverse events. Periodic verification of these plans will be performed on an annual basis. ''Reference: ISO 27002:2013-17.1.1,17.1.2,171.3''
-#Redundant Information Processing Facilities - Information processing facilities will be implemented with redundancy sufficient to meet identified and documented availability needs. ''Reference: ISO 27002:2013-17.2''
-.4.13 Compliance Management
-#Identification of Compliance Requirements - Regular periodic review will be conducted to ensure that relevant policies, legal and contractual requirements are identified for the University and relevant information systems. ''Reference: ISO 27002:2013-18.1.1''
-#Intellectual Property Rights - Procedures will be implemented to ensure compliance with applicable legal, regulatory, and contractual requirements related to intellectual property rights and use of proprietary software products. ''Reference: ISO 27002:2013-18.1.2''
-#Protection of Records - University records will be protected from loss, destruction, falsification, and unauthorized release in accordance with legal, regulatory, and contractual business requirements. ''Reference: ISO 27002:2013-18.1.3''
-#Privacy and Protection of Personally Identifiable Information - The privacy and protection of personally identifiable information will be ensured as required in relevant legal and regulatory frameworks. ''Reference: ISO 27002:2013-18.1.4''
-.4.14 Information Security Review
-#Independent Review of Information Security - Assessment of the University’s approach to and management of information security objectives will be performed periodically by a qualified independent third party. ''Reference: ISO 27002:2013-18.2.1''
-#Compliance with Security Policies and Standards - Periodic review will be conducted to review the adherence of University units and employees to applicable information security policies and standards. ''Reference: ISO 27002:2013-18.2.2''
-#Technical Compliance Evaluations - Periodic technical evaluations, including both automated and manual security assessments, should be performed to ensure that technical controls and security measures adhere to applicable information security policies and standards. ''Reference: ISO 27002:2013-18.2.3''
 == Additional References ==
-:[https://policy.appstate.edu/Payment_Card_Services_Policy Payment Card Industry Data Security Standard]
+:[[Payment Card Services Policy|Appalachian Policy 503.8 - Payment Card Services Policy]]
-:[http://security.appstate.edu/sites/security.appstate.edu/files/Standards/DataManagementStandard.pdf Data Management Standard]
+:[[Information Technology Governance Policy|Appalachian Policy 901 - Information Technology Governance Policy]]
-:[https://security.appstate.edu/sites/security.appstate.edu/files/enterprisepasswordstandard.pdf Enterprise Password Management Standard]
+:[[Data_Governance|Appalachian Policy 902 - Data Governance Policy]]
-:[http://policy.appstate.edu/Payment_Card_Services_Policy Payment Card Services Policy]
-:[http://security.appstate.edu/sites/security.appstate.edu/files/Standards/RiskManagementStandard.pdf Information Security Risk Management Standard]
-:[https://its.appstate.edu/data-governance/secure-data-handling-standard Secure Data Handling Standards]
 == Authority ==
-:[https://www.nccu.edu/formsdocs/proxy.cfm?file_id=3561 UNC Policy Manual, Chapter 100.1, Section 502]
+#[https://security.appstate.edu/sites/security.appstate.edu/files/enterprisepasswordstandard.pdf Enterprise Password Management Standard]
-:[https://www.northcarolina.edu/apps/policy/index.php?pg=dl&id=19846&format=pdf&inline=1 UNC Policy Manual - 1400.2 Information Security]
+#[http://security.appstate.edu/sites/security.appstate.edu/files/Standards/RiskManagementStandard.pdf Information Security Risk Management Standard]
-:[https://www.ftc.gov/tips-advice/business-center/privacy-and-security/gramm-leach-bliley-act Gramm-Leach-Bliley Act (Public Law 106-102; 113 Stat. 1338) 16 CFR Part 314]
+#[https://its.appstate.edu/data-governance/secure-data-handling-standard Secure Data Handling Standards]
-:[http://www.gpo.gov/fdsys/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191; 110 Stat. 1936) 45 CFR Part 164]
+#[https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss- Payment Card Industry Data Security Standard]
+#[https://www.nccu.edu/formsdocs/proxy.cfm?file_id=3561 UNC Policy Manual, Chapter 100.1, Section 502s]
+#[https://www.northcarolina.edu/apps/policy/index.php?pg=dl&id=19846&format=pdf&inline=1 UNC Policy Manual - 1400.2 Information Security]
+#[https://www.ftc.gov/tips-advice/business-center/privacy-and-security/gramm-leach-bliley-act Gramm-Leach-Bliley Act (Public Law 106-102; 113 Stat. 1338) 16 CFR Part 314]
+#[http://www.gpo.gov/fdsys/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191; 110 Stat. 1936) 45 CFR Part 164]
 == Contact Information ==
-:[http://security.appstate.edu/ ITS Office of Information Security], 828-262-6277
+:Office of the Chief Information Officer (828-262-6278)
+:Chief Information Security Officer (828-262-6277)
 == Original Effective Date ==
@@ Line 210: / Line 136: @@
 == Revision Dates ==
 :November 28, 2018
+:December 7, 2020
+[[Category:Contents]]
+[[Category:Information Technology]]