1.0 Purpose

The Information Sensitivity Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of EckerdCollege without proper authorization.

The information covered in these guidelines includes, but is not limited to, information that is either stored or shared via any means. This includes: electronic information, information on paper, and information shared orally or visually (such as telephone and video conferencing).

All employees should familiarize themselves with the information labeling and handling guidelines that follow this introduction. It should be noted that the sensitivity level definitions were created as guidelines and to emphasize common sense steps that you can take to protect Eckerd College Confidential information (e.g., Eckerd College Confidential information should not be left unattended in conference rooms).

Please Note: The impact of these guidelines on daily activity should be minimal.

Questions about the proper classification of a specific piece of administrative information should be addressed to your manager. Questions about the proper classification or a specific piece of academic information should be addressed to the Registrar’s Office. Questions about these guidelines should be addressed to ITS.

2.0 Scope

All EckerdCollege information is categorized into four main classifications:

· EckerdCollege Public (Administrative)

· EckerdCollege Confidential (Administrative)

· EckerdCollege Directory Information (Academic)

· EckerdCollege Confidential (Academic)

Eckerd College Public (Administrative) information is information that has been declared public knowledge by someone with the authority to do so, and can freely be given to anyone without any possible damage to EckerdCollege.

Eckerd College Confidential (Administrative) contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Information that should be protected very closely should be outlined in departmental and campus GLB guidelines. Also included in Eckerd College Confidential is information that is less critical, such as telephone directories, general college information, personnel information, etc., which does not require as stringent a degree of protection. Individuals may themselves grant some access to their own personal information

A subset of Eckerd College Confidential (Administrative) information is "Eckerd College Third Party Confidential" information. This is confidential information belonging or pertaining to another institution or corporation which has been entrusted to EckerdCollege by that company under non-disclosure agreements and other contracts. Information in this category ranges from extremely sensitive to information about the fact that we've connected a supplier / vendor into EckerdCollege's network to support our operations.

Eckerd College Public (Academic) information is information that has been declared directory information in the Eckerd College Catalog. The information should still only be released in reasonable cases. If an employee is uncertain of the sensitivity of a particular piece of information, he/she should contact the Registrar or Dean of Faculty. A student may request to the Registrar that all data related to them remains confidential, and if the request is made all information is Confidential.

Eckerd College Confidential (Academic) contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Information that should be protected very closely should be outlined in departmental and campus GLB guidelines. If an employee is uncertain of the sensitivity of a particular piece of information, he/she should contact the Registrar or Dean of Faculty. Individuals may themselves grant some access to their own personal information.

EckerdCollege personnel are encouraged to use common sense judgment in securing Eckerd College Confidential (Administrative and Academic) information to the proper extent. If an employee is uncertain of the sensitivity of a particular piece of information, he/she should contact their manager.

3.0 Policy

The Sensitivity Guidelines below provides details on how to protect information at varying sensitivity levels. Use these guidelines as a reference only, as Eckerd College Confidential information in each column may necessitate more or less stringent measures of protection depending upon the circumstances and the nature of the Eckerd College Confidential information in question.

3.1 Minimal Sensitivity: General college information; some personnel and technical information

Marking guidelines for information in hardcopy, visual, or electronic form.

Note: any of these markings may be used with the additional annotation of "3rd Party Confidential".

Marking is at the discretion of the owner or custodian of the information. If marking is desired, the words "Eckerd College Confidential" may be written or designated in a conspicuous place on or in the information in question. Other labels that may be used include "Eckerd College Proprietary" or similar labels at the discretion of your individual business unit or department. Even if no marking is present, EckerdCollege information is presumed to be "Eckerd College Confidential" unless expressly determined to be Eckerd College Public information by an EckerdCollege employee with authority to do so.

Access:EckerdCollege employees, contractors, people with a business need to know.

Distribution within EckerdCollege: Standard interoffice mail, approved electronic mail and electronic file transmission methods.

Distribution outside of EckerdCollege internal mail: U.S. mail and other public or private carriers, approved electronic mail and electronic file transmission methods.

Electronic distribution: No restrictions except that it be sent to only approved recipients.

Visual: No restrictions except that it be available to only approved recipients.

Storage: Keep from view of unauthorized people; erase whiteboards, do not leave in view on tabletop. Machines should be administered with security in mind. Protect from loss; electronic information should have individual access controls where possible and appropriate.

Disposal/Destruction: Deposit outdated paper information in specially marked disposal bins on EckerdCollege premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.

Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.

3.2 More Sensitive: Business, financial, student record, technical, and most personnel information

Marking guidelines for information in hardcopy, visual or electronic form.

Note: any of these markings may be used with the additional annotation of "3rd Party Confidential". As the sensitivity level of the information increases, you may, in addition or instead of marking the information "EckerdCollege Confidential" or "EckerdCollege Proprietary", wish to label the information "EckerdCollege Internal Use Only" or other similar labels at the discretion of your individual business unit or department to denote a more sensitive level of information. However, marking is discretionary at all times.

Access: EckerdCollege employees and non-employees with signed non-disclosure agreements who have a business need to know.

Distribution within EckerdCollege: Standard interoffice mail, approved electronic mail and electronic file transmission methods.

Distribution outside of EckerdCollege internal mail: Sent via U.S. mail or approved private carriers.

Electronic distribution: No restrictions to approved recipients within Eckerd College, but should be encrypted or sent via a private link to approved recipients outside of Eckerd College premises.

Visual: No restrictions to only approved recipients within EckerdCollege, but should be presented or projected in a manner that prevents viewing by other observers.

Storage: Individual access controls are highly recommended for electronic information.

Disposal/Destruction: In specially marked disposal bins on EckerdCollege premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.

Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.

3.3 Most Sensitive: Trade secrets & marketing, operational, personnel, financial, student record, & technical information integral to the success of our college.

Marking guidelines for information in hardcopy or electronic form.

Note: any of these markings may be used with the additional annotation of "3rd Party Confidential". To indicate that EckerdCollege Confidential information is very sensitive, you may should label the information "EckerdCollege Internal: Registered and Restricted", "EckerdCollege Eyes Only", "EckerdCollege Confidential" or similar labels at the discretion of your individual business unit or department. Once again, this type of EckerdCollege Confidential information need not be marked, but users should be aware that this information is very sensitive and be protected as such.

Access: Only those individuals (EckerdCollege employees and non-employees) designated with approved access and signed non-disclosure agreements.

Distribution within EckerdCollege: Delivered direct - signature required, envelopes stamped confidential, or approved electronic file transmission methods.

Distribution outside of EckerdCollege internal mail: Delivered direct; signature required; approved private carriers.

Electronic distribution: No restrictions to approved recipients within EckerdCollege, but it is highly recommended that all information be strongly encrypted.

Visual: No restrictions to only approved recipients within EckerdCollege, but should be presented or projected in a manner that prevents viewing by other observers.

Storage: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer.

Disposal/Destruction: Strongly Encouraged: In specially marked disposal bins on EckerdCollege premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.

Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.

4.0 Enforcement

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

5.0 Definitions

Terms and Definitions

Appropriate measures

To minimize risk to EckerdCollege from an outside business connection. EckerdCollege computer use by competitors and unauthorized personnel must be restricted so that, in the event of an attempt to access EckerdCollege corporate information, the amount of information at risk is minimized.

Configuration of Eckerd College-to-other business connections

Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.

Delivered Direct; Signature Required

Do not leave in interoffice mail slot, call the mail room for special pick-up of mail.

Approved Electronic File Transmission Methods

Includes supported FTP clients and Web browsers.

Envelopes Stamped Confidential

You are not required to use a special envelope. Put your document(s) into an interoffice envelope, seal it, address it, and stamp it confidential.

Approved Electronic Mail

Includes all mail systems supported by ITS. These include, but are not necessarily limited to, IMP Webmail, Netscape, Mozilla, and Thunderbird. If you have a business need to use other mailers contact the appropriate support organization.

Approved Encrypted email and files

Techniques include the use of DES and PGP. DES encryption is available via many different public domain packages on all platforms. PGP use within EckerdCollege is done via a license. Please contact the appropriate support organization if you require a license.

Company Information System Resources

Company Information System Resources include, but are not limited to, all computers, their data and programs, as well as all paper information and any information at the Internal Use Only level and above.

Expunge

To reliably erase or expunge data on a PC or Mac you must use a separate program to overwrite data, supplied as a part of Norton Utilities. Otherwise, the PC or Mac's normal erasure routine keeps the data intact until overwritten. The same thing happens on UNIX machines, but data is much more difficult to retrieve on UNIX systems.

Individual Access Controls

Individual Access Controls are methods of electronically protecting files from being accessed by people other than those specifically designated by the owner. This entails use of appropriate Novell and Windows file permissions on workstations and careful use of the UNIX chmod and chown commands on servers.

Insecure Internet Links

Insecure Internet Links are all network links that originate from a locale or travel over lines that are not totally under the control of EckerdCollege.

Encryption

Secure Eckerd College Sensitive information in accordance with the Acceptable Encryption Policy. International issues regarding encryption are complex. Follow corporate guidelines on export controls on cryptography, and consult your manager and/or corporate legal services for further guidance.

Physical Security

Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.

Private Link

A Private Link is an electronic communications path that EckerdCollege has control over it's entire distance. For example, all EckerdCollege networks are connected via a private link. A computer with modem connected via a standard land line (not cell phone) to another computer have established a private link. ISDN lines to employee's homes is a private link. EckerdCollege also has established private links to other companies, so that all email correspondence can be sent in a more secure manner. Companies which EckerdCollege has established private links include all announced acquisitions and some short-term temporary links

6.0 Revision History

Original Draft: 04/12/2005