University Policies and Procedures Manual (previously Business Policies and Procedures Manual)

Data Protection and Classification

UPPM 87.53

For more information contact:
Information Technology Services

1.0 Overview and Purpose
- 1.1 Information Assurance Policies Generally
- 1.2 Specific Policy Overview and Purpose
2.0 Applicability
3.0 Roles and Responsibilities
4.0 Requirements
- 4.1 General Requirements
- 4.2 Moderate- and High-Impact System Requirements
5.0 Training

1.0 Overview and Purpose

1.1 Information Assurance Policies Generally

The purposes of the information assurance policies in UPPM Chapter 87: Information Technology and Security are to:

Set requirements to ensure the privacy, confidentiality, integrity, and availability of Washington State University (WSU) data;
Support institutional goals and strategies with appropriate methods for administratively, technically, and operationally protecting data; and
Define the criteria WSU follows to meet requirements for protecting data, which are determined by Information Owners.

The policies in this chapter comply with Federal Information Processing Standards (FIPS 199), which are intended to help organizations achieve a common level of quality and interoperability in information technology (IT) by requiring categorization of systems as low-impact, moderate-impact, or high-impact for the stated security objectives of confidentiality, integrity, and availability. To determine the potential consequence of a loss event, the Federal Information Processing Standards:

Define WSU Information Owners’ impact categorization rating (Low, Moderate, or High);
Dictate which security controls are mandatory based upon the categorization level;
Define the strength, frequency, and formalization of those controls; and
Influence audit burden and continuous monitoring rigor.

See UPPM 87.01 for definitions, general information, and violations related to this policy, as well as additional information regarding roles and responsibilities.

1.2 Specific Policy Overview and Purpose

Institutional Information (as defined in UPPM 87.01) is a valuable WSU asset that must be categorized and safeguarded based on sensitivity and risk. By establishing clear requirements for all classifications of data, this policy ensures that Institutional Information is carefully managed, maintained, protected, and used appropriately throughout its lifecycle, as well as protected from unauthorized access or disclosure.

This policy and UPPM Chapter 87 use the terms “information” and “data” interchangeably.

2.0 Applicability

This policy applies to all WSU system users who have contact with, or potentially may have contact with, WSU data, applications, and computing resources.

Security control exceptions to policy statements in UPPM Chapter 87 are managed and maintained in accordance with UPPM 87.23.

3.0 Roles and Responsibilities

3.1 Chief Information Officer

The Chief Information Officer (CIO) of WSU, or designee, is responsible for administering this policy and reviewing it on an annual basis.

3.2 Information System Owners

WSU Information System Owners, or their delegates, are responsible and accountable for developing appropriate Standard Operating Procedures (SOPs) for this policy’s implementation.

3.3 Office of Information Security and Assurances (OISA)

WSU’s Office of Information Security and Assurance (OISA) shall maintain the standard (PDF) associated with this policy and provide guidance for the associated procedures for the implementation of this policy (see examples (PDF)).

Note: While all units are required to adhere to the standard established by OISA (NIST SP 800-53), procedural examples for implementation are optional.

4.0 Requirements

4.1 General Requirements

Information Owners, or their delegates, must classify WSU Institutional Information for which they are responsible for according to following classifications (see also UPPM 87.01):

Public: Information in this classification does not need protection from unauthorized access or disclosure; however, there may be requirements to protect the integrity and availability of data in this classification. The appropriate Information Owner or the appropriate WSU administrator must approve the release of Public Information.
Internal: Information in this classification may be made available to authorized personnel in support of the performance of their assigned roles/duties. WSU Internal Information is generally not released to the public unless specifically requested and must be approved for release by the appropriate Information Owner, by the appropriate WSU administrator, or as required by law. Unauthorized access, disclosure, or loss of integrity or availability of this classification of information could result in some harm to WSU and to individuals.
Confidential: Access may be granted to this classification of information by the appropriate Information Owner to only authorized personnel with a strict need-to-know. Confidential Information may be released to authorized affiliates or third parties only with explicit approval from the appropriate Information Owner, the appropriate WSU administrator, or as required by contract or law. Unauthorized access, disclosure, or loss of integrity or availability of this information could cause significant harm to WSU and its operations, assets, or to individuals, and may include significant reputational, legal, and financial consequences.
Regulated: Access may be granted to this classification of information by the appropriate Information Owner to only authorized personnel with strict need-to-know. Regulated information may be released to authorized affiliates or third parties only with explicit approval from the appropriate Information Owner or the appropriate WSU administrator, and in accordance with applicable statutes, regulations, and agreements. Unauthorized access, disclosure, or loss of integrity or availability of this information could cause serious harm to WSU and its operations, assets, or to individuals, and may include serious reputational, legal, financial, and health and safety consequences, including civil and criminal penalties.

WSU Institutional Information must be properly administered, managed, and maintained throughout its entire life cycle. WSU Information Owners, or their delegates, are accountable for the security and privacy of WSU Institutional Information under their care.

Information Systems that store or process Confidential and/or Regulated Data must geographically reside in the United States.

WSU Institutional Information must be protected via appropriate encryption mechanisms in accordance with UPPM 87.33.

Information System Owners, or their delegates, must identify the digital and/or non-digital media with access restrictions for specific personnel or roles.

Information System Owners, or their delegates, must restrict the use of certain types of media on defined organizational systems or system components.

Access to WSU Institutional Information is to be provided in accordance with UPPM 87.05.

System media is to be sanitized in accordance with UPPM 87.72

The use of portable storage devices is to be prohibited when the system or system component has no identifiable owner.

4.2 Moderate- and High-Impact Systems

In addition to the above, the following requirements apply to all moderate and high-impact systems.

Information Owners, or their delegates, of moderate- and high-impact systems must maintain an up-to-date inventory of WSU Institutional Information within their area of responsibility.

Information System Owners, or their delegates, are responsible for maintaining a record of users who have access to the system components where those types of information are processed and stored.

Moderate- and high-impact systems must use automated tools to identify information by information type on system components to ensure controls are in place.

Moderate- and high-impact system media must be marked with the distribution limitations, handling caveats, and applicable security markings. Information Owners, or their delegates, can exempt defined types of system media from marking within defined controlled areas.

Information System Owners, or their delegates, must define the moderate- and high-impact system media that needs to be physically controlled and securely stored within defined areas. The defined system media must be protected and destroyed in accordance with UPPM 87.72.

Information System Owners, or their delegates, must define the moderate- and high-impact system media that needs protection during transport outside of controlled areas and must maintain accountability, document transport activities, and restrict access outside controlled areas to authorized personnel.

5.0 Training

See UPPM 87.21 for training requirements related to UPPM Chapter 87.

In addition to the requirements in UPPM 87.21, Information System Owners are responsible for ensuring that users receive appropriate information security and privacy training commensurate with their roles, responsibilities, and authorized access to information systems under the Information System Owner’s authority.

_______________________
Revisions: Feb. 2026 (Rev. 651); Mar. 2022 (Rev. 102); June 2020 (Rev. 91); May 2018 (Rev. 79); Feb. 2015 (Rev. 59); Dec. 2007 (Rev. 29); Apr. 2006 (Rev. 22); Nov. 2001 – new policy (Rev. 3)