Protected Level 1 (PL-1 Confidential)

• HIPAA: ePHI, Personal Health Records, Health Insurance Data
  
• Personally Identifiable Information (PII): Name with Personally Identifiable Information SSN, Passport, Visa, etc.
  
• Gramm-Leach-Bliley Act (GLBA): Name with Financial Information, Bank Accounts, Tax Returns, etc.
  
• Payment Card Industry Data Security Standard (PCI-DSS): Payment card information, Credit Card Numbers, Bank Account and Routing Numbers.
  
• Law Enforcement Records: Name with Driver’s License, Criminal Background.
  
• Campus Access Credentials: Passwords or credentials that grant access to level 1 and level 2 data.
  

• FERPA: Student Information: Educational Records not defined as directory” information, typically: Grades, Courses taken, Schedule, Test Scores, Advising records, Educational services received, Disciplinary actions, Student photo.
  
• Campus Financials.
  
• Campus Attorney-client communication.
  
• Employee Information: Name with: Home Address, Home Phone, Personal Email, Marital Status, Gender, Evaluation, Personnel Actions.
  

• Information publicly available Publications Web: The information which may be designated as publicly available and/or intended to be provided to the public.
  

---

The Academy primarily uses Google Drive for storage of our data. That said the IT department have created groups in order to share what is needed. We all must understand that access is a privilege and must be used with extreme responsibility.

Information Security Plan (ISP: Section 3.9)

• Protected Level 1 information should not be stored on SDSU laptops or desktops. This information should be stored on secured databases or file servers or on off-line media.
  
• Off-line media should be encrypted and must be stored in a secure location at the University or another site approved by management (including off-site backup services).
  
• All work computers are policy protected that mimic SDSU requirements where 15 minute no activity screen locks are enabled.  
  

• Personal equipment includes devices such as personal laptops, personal desktops, personal digital assistants (PDAs), cell phones. SDSU Protected Level 1 or PL-1 information must not be stored on any personal equipment.
  
• Users must not send or forward e-mails containing PL-1 information to person email accounts.
  
• Users should adopt the same anti-virus, anti-spyware, and patch management standards for personal equipment the same as University Systems. 
  
• Personal devices being used at the University must not be connected to the network behind an internal firewall without authorization. 
  

• IT managers are responsible for ensuring that access to information stored on file servers is limited to authorized users. Access to information should be granted according to job duties. PL-1 information that is stored on file servers should be encrypted. 
  

• IT managers are responsible for ensuring that access to information stored on file servers is limited to authorized users. Access control should include a combination of file read/write privilege and access control lists on the database data objects. These databases should be configured to encrypt PL-1 elements. 
  

• Requires institutions and creditors to implement a written identity theft prevention program designed to identify and detect identity theft schemes in response to "red flags". 
  
• The rule applies to any institution that provides goods or services that are not fully paid in advance (e.g. Tuition, room and board, etc. are not due in full prior to the start or a semester.)
  
• Types of accounts that must adhere to the Red Flag Rules:
  
• Financial Aid
  
• Employee loans
  
• Installment payments and short-term loans
  
• Accounts that are created for ongoing services and allow students to reimburse the University when billed over a period of time.
  
• Any type of collection account 
  

• University departments must monitor a number of variables and indicators which are described in the California State University Identity Theft Prevention ("Red Flag Rule") Implementation Plan section 4.3.1.
  
• Additional flags that need further investigation are:
  
• Request to change mailing address
  
• Request to change password or a execution of a password reset 
  
• Changes of forwarding email address
  
• Change of account names
  
•  Change of bank account
  
• Reports to security@sdsu.edu
  
• Reports to the campus ISO
  
• Reports to Public Safety
  

FERPA Training

• FERPA prohibits any person connected with the institution — including administrators and faculty — from improperly disclosing information.
  
• Training is required annually by SDSU students and staff. This training goes over who is targeted, the uses and misuses of malware that can access your computer through various methods such as phishing, zip files, thumb drives that exploit fears and/or curiosity such as a file labeled "confidential". 
  
• Simply understanding that an IT department cannot be the only entity standing in the way of a security breach. Everyone must play a part in educating themselves to stop data from being stolen or taken advantage of. 
  
• Faculty are required to take FERPA training. To complete, login into your CSU account @ csu.sumtotal.host with your work email and password > click Library on the top right > Library > Type in the search box "FERPA" > select the curriculum "Data Security and FERPA" and complete the certification.
  

Password Requirements

SDSU and CDSS requires strong passwords that should be changed annually. The CSU mandates that SDSU must have a policy that requires password changes. The current SDSU Information Security Plan requires all passwords must be changed every 12 months SDSU Information Security Plan. You will receive email notifications reminding you to change your password in the following schedule: 30 days, 14 days, 2 days, 1 day before expiration. 

• Password must contain at least 10 characters.
  
• Passwords must contain characters from 3 of the following 5 categories:
  
  • Uppercase characters of European languages (A through Z, with diacritic marks, Greek and Cyrillic characters)
    
  • Lowercase characters of European languages (a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters)
    
  • Base 10 digits (0 through 9)
    
  • Non-alphanumeric characters: ~ ! @ # $ % ^  * _ - + =  | \ ( ) { } [ ] : ;  , . ? /
    
  • Any Unicode character that is categorized as an alphabetic character but is not uppercase or lowercase. This includes Unicode characters from Asian languages.
    
• Passwords must not contain the user's logon ID, first name, middle name, or last name