University Policies and Procedures Manual

WSU Information Security Roles, Responsibilities, and Definitions

UPPM 87.01

For more information contact:
   Information Technology Services

1.0     Overview and Purpose

1.1      Information Assurance Policies Generally

The purposes of the information assurance policies in UPPM Chapter 87: Information Technology and Security are to:

  • Set requirements to ensure the privacy, confidentiality, integrity, and availability of Washington State University (WSU) data;
  • Support institutional goals and strategies with appropriate methods for administratively, technically, and operationally protecting data; and
  • Define the criteria WSU follows to meet requirements for protecting data, which are determined by Information Owners.

The policies in this chapter comply with Federal Information Processing Standards (FIPS 199), which are intended to help organizations achieve a common level of quality and interoperability in information technology (IT) by requiring categorization of systems as low-impact, moderate-impact, or high-impact for the stated security objectives of confidentiality, integrity, and availability. To determine the potential consequence of a loss event, the Federal Information Processing Standards:

  • Define WSU Information Owners’ impact categorization rating (Low, Moderate, or High);
  • Dictate which security controls are mandatory based upon the categorization level;
  • Define the strength, frequency, and formalization of those controls; and
  • Influence audit burden and continuous monitoring rigor.

1.2      Specific Policy Overview and Purpose

Information security roles, responsibilities, and definitions enable effective communications by providing clarity, alignment, and defining expectations to those executing the work. A common lexicon is needed to share a common understanding and ensure consistency among related and dependent terms.

This policy supports all policies in the UPPM that are owned by WSU Information Technology Services.

2.0    Applicability

This policy applies to all WSU system users who have contact with, or potentially may have contact with, WSU data, applications, and computing resources.

Security control exceptions to policy statements in UPPM Chapter 87 are managed and maintained in accordance with UPPM 87.23.

3.0    Roles and Responsibilities

3.1      Area Technology Officer (ATO)

The ATO acts as the primary liaison between their area and central IT/security leadership, ensuring alignment with institutional policies, standards, and strategic objectives.

The key responsibilities of the ATO are to:

  • Support compliance activities with institutional information security policies, standards, and procedures;
  • Facilitate communication and coordination between their area and central IT/security offices;
  • Support risk management, data protection, and regulatory compliance efforts within their area; and
  • Represent area-specific technology needs and priorities in university-wide planning and governance processes.

3.2     Authorizing Official (AO)

AOs are senior officials or executives with the authority to authorize (i.e., assume responsibility for) the operation of an information system or the use of a designated set of common controls at an acceptable level of risk to operations (including mission, functions, image, or reputation), assets, and individuals.

3.3     Chief Information Officer (CIO)

The CIO of WSU, or designee, is responsible for administering this policy and reviewing it on an annual basis.

3.4     Chief Information Security Officer (CISO)

The CISO is the University official responsible for establishing and maintaining WSU’s enterprise-wide information security and privacy management program for the purpose of appropriately protecting WSUs information and technical assets.

The CISO is the CIO’s primary liaison to work with senior management and staff across the University to:

  • Implement practices that meet defined policies, standards, and regulatory requirements for information security and privacy;
  • Determine information security and privacy risk classifications; and
  • Drive information security and privacy objectives into business systems and processes throughout the University.

3.5     Data Custodian

A data custodian is a WSU administrator who is assigned by and accountable to an Information Owner. A data custodian has administrative and/or operational responsibility over specific institutional data sets delegated to them by an Information Owner. These individuals are responsible for facilitating, implementing, and enforcing institutional data policies, standards, and procedures established by the University and/or the Information Owner.

3.6     Information Owners

Information owners are executive heads of a major WSU system business unit (e.g., vice president, chancellor, or dean) reporting directly to the President or Provost. An Information Owner:

  • Is responsible for ensuring the information security and privacy of institutional data, to include its creation, collection, storage, processing, transmission, usage, access, release, maintenance, and disposal;
  • Has a duty to include appropriate stakeholders in evaluating risk and managing data (e.g., CIO, CISO, Chief Compliance and Risk Officer (CCRO)); and
  • Designates Information System Owners within their scope.
    • Information Owners may delegate these administrative duties to one or more WSU system administrators for specific institutional data sets or functional areas.
    • The Information Owner retains ultimate accountability to include when data is shared or released to third parties.

3.7     Information System Owners 

WSU Information System Owners, or their delegates, are responsible and accountable for developing appropriate Standard Operating Procedures (SOPs) for this policy’s implementation. Responsibilities of the Information System Owner include:

  • Addressing and satisfying the mission, business, and operational requirements of the institution or a specific business unit;
  • Ensuring compliance with applicable information security and privacy requirements;
  • Obtaining approvals for required security authorizations; and
  • Maintaining required information system security, privacy, risk and compliance documentation.

3.8     Information Technology Governance Councils

WSU Information Technology Governance Councils are charged with advising and providing recommendations on information technology issues to the executive leadership team. Information Technology Governance Councils ensure that:

  • The WSU system makes the best possible decisions in advancing the acquisition, deployment, and use of technology in support of the goals outlined in the IT strategic plan; and
  • Planning, pursuing new directions, institutional actions, and changes are implemented and integrated in a coordinated, collaborative, and transparent fashion.

3.9     Office of Information Security and Assurance (OISA)

WSU’s Office of Information Security and Assurance (OISA) shall maintain the standards associated with ITS-owned policies and provide guidance for the associated procedures for the implementation of ITS-owned policies.

3.10    User

A data user, system user, or user is any WSU employee, student, individual, affiliate, or third party who is authorized to access institutional systems and data.

Data users who use WSU-owned or employee-owned endpoints to access WSU data, or to conduct WSU business, are responsible for complying with all applicable WSU policies and state and federal laws and regulations, including privacy requirements that govern the use and handling of WSU’s institutional data in accordance with UPPM 87.15.

4.0   Definitions

Assurance: The measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediate and enforce the security policy.

Auditable Events: Those information system security-relevant events which, when collected, analyzed, and correlated, can identify inappropriate, unusual, or suspicious activities and support after-the-fact investigations of security incidents.

Auto-Forward: The act of forwarding email through an automated forwarding mechanism. Once configured, these mechanisms automatically forward email from one server to another without any user intervention and/or oversight. 

Availability: Ensuring timely and reliable access to and use of information.

Bluetooth: An open wireless technology standard for transmitting fixed and mobile electronic device data over short distances using short-wavelength radio waves in the 2.402 GHz to 2.480 GHz range. It is used primarily to establish wireless personal area networks (WPANs), allowing users to form ad hoc networks between a wide variety of devices to transfer voice and data. 

Business Application: A hardware/software system implemented to satisfy a particular set of requirements. WSU System Business Applications can be developed internally or sourced externally. 

Business Associate: A business associate is an individual, organization, or agency that provides services to a HIPAA-covered entity which requires them to have access to, store, use, or transmit protected health information.

Certificate Authority: A trusted entity that issues and revokes public key certificates.

Collaborative Computing Devices and Applications: Includes remote meeting devices and applications, networked whiteboards, cameras, and microphones.

Common Configuration Scoring System (CCSS): A SCAP specification for measuring the severity of software security configuration issues.

Common Control: A situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides.

Common Control Provider: An organizational official responsible for the development, implementation, assessment, and monitoring of common controls (i.e., security or privacy controls inheritable by systems).

Common Vulnerability Scoring System (CVSS): An SCAP specification for communicating the characteristics of vulnerabilities and measuring their relative severity.

Concurrent Session Control: Concurrent session control addresses concurrent sessions for system accounts on a single system. It does not address concurrent sessions by single users via multiple system accounts. 

Confidential Information:

Information that is:

  • Not covered under the definition of regulated information; and
  • Specifically protected by law, contracts, third-party agreements; or
  • For other WSU business purposes as established by Information Owners.

This includes:

  • Information about individuals that may be considered sensitive that is not defined as “personal information” in RCW 19.255.010 and 42.56.590;
  • Information about public employees as defined by RCW 42.56.250;
  • Financial information;
  • Donor information;
  • Intellectual property;
  • Attorney/client privileged information;
  • Information regarding critical infrastructure of WSU system physical structures and assets;
  • Security infrastructure of information technology systems, networks, and services;
  • Passwords;
  • Cryptographic private or shared keys;
  • Cryptographic secrets;
  • Authentication secrets or hashes; and
  • Institutional strategies and methods that may be considered to provide a competitive advantage.

Confidentiality: Preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information.

Controlled Unclassified Information (CUI): Unclassified information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under federal Executive Order 13526.

For further information regarding WSU CUI, see DoD Proposals to Require Cybersecurity Certification from the Office of Research.

Covered Entity: Covered entities are defined in the HIPAA rules as:

  • Health plans;
  • Health care clearinghouses; and
  • Health care providers who electronically transmit any health information in connection with transactions for which the Department of Health and Human Services has adopted standards. (See 45 CFR 160.103).

Generally, these transactions concern billing and payment for services or insurance coverage. For example, hospitals, academic medical centers, physicians, and other health care providers who electronically transmit claims transaction information directly or through an intermediary to a health plan are covered entities. Covered entities may be institutions, organizations, or persons.

Criticality: A measure of the importance of the data to the WSU system’s mission and business operations. Data considered confidential may not necessarily be considered critical.  Determining the criticality of a particular information system or data set must take into consideration the following:

  • What is the impact to the University if the data is not recovered?
  • How long will the data recovery process take?
  • What is the effect of the loss of the data set during the recovery time, to include potential risks to the WSU system (e.g., information security and privacy, strategic, financial, legal, regulatory, reputational, and operational)?

See also UPPM 90.15 regarding essential records protection.

Criticality Analysis: An end-to-end functional decomposition performed by systems engineers to identify mission critical functions and components, including:

  • Identification of system missions;
  • Decomposition into the functions to perform those missions; and
  • Traceability to the hardware, software, and firmware components that implement those functions.

Criticality is assessed in terms of the impact of function or component failure on the component’s ability to complete the system mission(s). 

Cryptographic Mechanism: An element of a cryptographic application, process, module or device that provides a cryptographic service, such as confidentiality, integrity, source authentication, and access control (e.g., encryption and decryption, and digital signature generation and verification).

Data Breach: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where:

  • A person other than an authorized user accesses or potentially accesses personally identifiable information; or
  • An authorized user accesses personally identifiable information for another than authorized purpose.

Good faith acquisition of confidential or regulated information by an employee or agent of WSU for the purposes of conducting appropriate WSU business or operations is not a breach of the security of the system when the information is not used or subject to further unauthorized disclosure.

Development Tools: Programming languages and computer-aided design systems. 

Device Lock: A temporary action taken to prevent logical access to WSU systems when users stop work and move away from the immediate vicinity of those systems but do not want to log out because of the temporary nature of their absences.

A proximity lock may be used to initiate the device lock (e.g., via a Bluetooth-enabled device or dongle). User-initiated device locking is behavior or policy-based and, as such, requires users to take physical action to initiate the device lock. 

Digital Media: Includes diskettes, magnetic tapes, external or removable hard disk drives (e.g., solid state, magnetic), flash drives, compact discs, and digital versatile discs. 

Employee: Includes faculty, administrative professional, civil service, bargaining unit, temporary hourly, student and graduate student employees, and volunteers authorized to access WSU information systems and/or network.

Endpoint: Any device that is used to access a digital identity on a network, such as laptops, desktops, mobile phones, tablets, servers, Internet of Things devices, and virtual environments.

Environmental Controls: Controls that monitor and maintain temperature, humidity, pressure, and/or radiation. 

Export Administration Regulations (EAR): A set of regulations found at 15 CFR 730 et seq. The EAR are administered by the Bureau of Industry and Security, which is part of the U.S. Department of Commerce.

In general, the EAR governs items considered to be of “dual use”. A dual use item is one that has civil applications as well as military. The EAR oversees all exports, reexports, and deemed exports that are considered duel use.

The EAR applies to physical things (sometimes referred to as “commodities”) as well as technology and software.

For further information on EAR at WSU, see Export Control Regulations from the Office of Research.

External Email Account: An email account, including a personal email account, which is provided by an organization not affiliated with WSU. This may be a Gmail, Yahoo, or other account, or may be provided by another organization (such as a professional organization, or another University with which the user is affiliated).  

External System: A system not controlled by WSU. 

Factor of Authentication: An authenticator that conforms to one of the following types:

  • Something you know – e.g. a password, passphrase, or PIN.
  • Something you have – e.g. a physical object like a key, cellular telephone, smart card, or other “hard token.”
  • Something you are – biometrics, e.g. a fingerprint, facial scan, or voice print.”

Functional Properties: Describe the functionality (i.e., security or privacy capability, functions, or mechanisms) visible at the interfaces of security and privacy controls and specifically exclude functionality and data structures internal to the operation of the controls. 

Health Care Information: Any information, whether oral or recorded in any form or medium, that identifies or can readily be associated with the identity of a patient and directly relates to the patient’s health care, including a patient’s DNA and identified sequence of chemical base pairs. The term includes any required accounting of disclosures of health care information. See RCW 70.02.010.

High-Impact System: A FIPS 199 High-Impact System is an information system where the loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, assets, or individuals.

A severe or catastrophic adverse effect means that, for example, the loss of confidentiality, integrity, or availability might:

  • Cause a severe degradation in or loss of mission capability to an extent and duration that the University is not able to perform one or more of its primary functions;
  • Result in major damage to University assets;
  • Result in major financial loss; or
  • Result in severe or catastrophic harm to individuals involving loss of life or serious life-threatening injuries.

Human Research Subject Information: Information collected, stored, processed, or shared while conducting research activities that involve human subjects.

For further information regarding human research subject information and the WSU Human Research Protection Program, see UPPM 45.50 and the Institutional Review Board.

Impact: The magnitude of legal, financial, and/or reputational harm that can be expected to result from the consequences of unauthorized disclosure of information, unauthorized modification of information, unauthorized destruction of information, or loss of information or information system availability.  See FIPS 199.

Information Assurance: The practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes. Information assurance includes protection of the integrity, availability, authenticity, non-repudiation and confidentiality of user data.

Information Availability: The practice of ensuring timely and reliable access to and use of information.

Information Flow Control: A procedure to ensure that information transfers within an information system are not made in violation of the security policy. 

Information Integrity: The practice of ensuring information has not been improperly modified or destroyed and includes ensuring information nonrepudiation and authenticity.

Information Privacy: The practice of ensuring freedom from intrusion into the private life or affairs of individuals when that intrusion results from undue or illegal gathering and use of data about that individual.

Information Security: The ability to ensure the confidentiality, integrity, and availability of institutional data held by WSU, regardless of its source or storage location.

Information Security Incident: An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of WSU system information systems, services, devices, and data. See also UPPM 87.55.

Institutional Data: Items of information which are collected, used, and maintained by WSU for strategic and operational functions, to include administrative data and other data maintained and safeguarded for institutional purposes.

This data may be held across the WSU system by central administrative offices, colleges, departments, and/or workforce members (e.g., administrative staff, temporary and part-time employees, student employees, contractors, volunteers, third parties, and other authorized affiliates).

The WSU system data policies apply to all institutional data, to include data held for the purposes of administration, research, scholarship, education, outreach, and engagement. See UPPM Chapter 87.

Institutional Information Systems and Services: The infrastructure, processes, procedures, and capabilities that allow WSU devices to manage, collect, store, transmit, process, and share information in pursuit of its mission and business objectives.

Integrity: Guarding against improper information modification or destruction includes ensuring information non-repudiation and authenticity.

International Traffic in Arms Regulations (ITAR): The United States regulation overseen by the U.S. Department of State that controls the manufacture, sale, and distribution of defense and space-related articles and services as defined in the United States Munitions List.

For more information, see Export Control Regulations from the Office of Research.

Internet of Things (IoT): A system of interrelated computing devices and mechanical and digital machines provided with unique identifiers and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction. 

IT Governance (ITG): The processes that ensure the effective and efficient use of IT in enabling an organization to achieve its goals. 

Least Functionality: A principle providing that information systems are configured to provide only essential capabilities and to prohibit or restrict the use of non-essential functions, such as ports, protocols, and/or services that are not integral to the operation of that information system.

Least Privilege: The principle that a security architecture is designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.

Low-Impact System: A FIPS 199 Low-Impact System is an information system where the loss of confidentiality, integrity, or availability would have only a limited adverse effect on organizational operations, assets, or individuals.

A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might:

  • Cause a degradation in mission capability to an extent and duration that the University is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced;
  • Result in minor damage to University assets;
  • Result in minor financial loss; or
  • Result in minor harm to individuals.

Mobile Device: A mobile device is any hand-portable device capable of text, voice, e-mail, instant messaging (IM), photographic messaging, or other types of data communication. Desktop and laptop computers are not considered mobile devices. See UPPM 87.10 for description of applicable types of mobile devices.

Mobile Device Management (MDM): Software that allows agency support staff to manage a “sandbox” or container on a mobile device where institutional data and applications can be added, deleted, or monitored. Additional functions may include issuance, inventory tracking, and policy enforcement on the device. See UPPM 87.10.

Moderate-Impact System: A FIPS 199 Moderate-Impact System is an information system where the loss of confidentiality, integrity, or availability could result in serious adverse effects on organizational operations, assets, or individuals.

A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availability might:

  • Cause a significant degradation in mission capability to an extent and duration that the University is able to perform its primary functions, but the effectiveness of the functions is significantly reduced;
  • Result in significant damage to University assets;
  • Result in significant financial loss; or
  • Result in significant harm to individuals that does not involve loss of life or serious life threatening injuries.

Multi-Factor Authentication (MFA): An authentication method in which a computer user is granted access only after successfully presenting two or more of the following pieces of evidence (or factors) to an authentication mechanism:

  • knowledge (something the user and only the user knows)
  • Possession (something the user and only the user has)
  • Inherence (something the user and only the user is) 

National Security Information: Information that has been determined pursuant to federal Executive Order 12356, or any predecessor order, to require protection against unauthorized disclosure and is marked to indicate its classified status when in documentary form.

Non-digital Media: Includes paper and microfilm. 

Nonrepudiation: Protection against an individual falsely denying having performed a particular action. Provides the capability to determine whether a given individual took a particular action such as creating information, sending a message, approving information, and receiving a message.

Official WSU Business: Activities performed by an authorized person to accomplish WSU business.  

Operationally Feasible: A control or solution is operationally feasible when it can be implemented, maintained, and sustained within the organization’s day-to-day processes, staffing, and resources — without causing unacceptable disruption to operations or violating policy, legal, or contractual obligations.

Organization: Any group organized under a Supervisory Organization from Workday. Organizations can have organizations under them.

Output Devices: Monitors, printers, scanners, audio devices, facsimile machines, and copiers. 

Personal Information: Defined in RCW 42.56.590 as an individual’s first name or first initial and last name in combination with one or more of the following data elements:

  • Social security number; or the last four or more digits of the social security number;
  • Driver’s license number or Washington identification card number;
  • Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account, or any other numbers or information that can be used to access a person’s financial account;
  • Full date of birth;
  • A private key that is unique to an individual and that is used to authenticate or sign an electronic record;
  • Student, military, or passport identification number;
  • Health insurance policy number or health insurance identification number;
  • Any information about a consumer’s medical history, mental or physical condition, or a health care professional’s medical diagnosis or treatment of the consumer; or
  • Biometric data generated by automatic measurements of an individual’s biological characteristics, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that may identify a specific individual.

The term “personal information” includes any of the above-listed data elements, alone or in combination, without the consumer’s first name or first initial and last name, if encryption has not rendered the data elements unusable and if the data elements would enable a person to commit identity theft against a consumer. See RCW 19.255.010.

Personal information also includes username and email address in combination with a password or security questions and answers that would permit access to an online account.

Personally Identifiable Information (PII): Includes, as defined under FERPA, refers to identifiable information that is maintained in education records. PII includes, but is not limited to:

  • A student’s name;
  • The name of the student’s parent or other family members;
  • The address of the student or student’s family;
  • A personal identifier, such as the student’s social security number, student number, or biometric record;
  • Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
  • Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
  • Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

See 34 CFR 99.3 for a complete definition of PII specific to education records and for examples of data elements that are defined as PII. See also UPPM Chapter 88: Information Privacy.

Plan of Action and Milestones (PoA&M): A document that identifies tasks that need to be accomplished. It details resources required to accomplish the elements of the plan, milestones for meeting the tasks, and the scheduled completion dates for the milestones.

Privileged Functions and Commands: Functions and commands that can only be executed by a person or process that has access to system control, monitoring, or administration functions (e.g., system administrator, information system security officer, maintainer, system programmer.)

Privileged User: A user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform.

Protected Health Information (PHI): Any information, including demographic information collected from an individual, that:

  • Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
  • Relates to the:
  • The past, present, or future physical or mental health or condition of an individual;
  • The provision of health care to an individual;
  • The past, present, or future payment for the provision of health care to an individual; and:
  • Identifies the individual; or
  • For which there is a reasonable basis to believe that the information can be used to identify the individual.

See HIPAA and UPPM 88.25 and 88.05.

Public Information: Information that can be, or is currently, released to the public without restriction.

Examples of public information are:

  • Employee directory information;
  • Widely distributed materials;
  • Public WSU outreach and research publications;
  • Press releases; and
  • Information on the public WSU website.

Public Record: Includes any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics.

Note: Writing in this definition means any form of communication or representation, including but not limited to letters, papers, maps, other communication on paper, as well as communication on e-mail, tape, film, video, magnetic or punched card, disk, sound recording, and computer data.

See RCW 42.56.010(3) and UPPM 90.05.

Reconstitution: Takes place following recovery and includes activities for returning systems to fully operational states. 

Recovery: Executing contingency plan activities to restore organizational mission and business functions. 

Registered Certificate Authority: A trusted entity that establishes and vouches for the identity and authorization of a certificate applicant on behalf of some authority (e.g., a Certificate Authority).

Regulated Information: Confidential information that is specifically protected from disclosure by law and for which there are strict information handling requirements that are dictated by statutes, regulations, or agreements.

As an institution of higher education, WSU collects, stores, and processes a vast quantity of very sensitive data in conducting its day-to-day business operations and is therefore subject to the various information security and privacy laws that regulate the access, use, and handling of that information. The includes, but is not limited to, the following specific laws and regulations:

Risk Assessment: The process of identifying risks to agency operations (including mission, functions, image, or reputation), agency assets, or individuals by determining the probability of occurrence, the resulting impact, and additional security controls that would mitigate this impact.

Risk Management: The process of managing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the nation, resulting from the operation of an information system, and includes:

  • Conduct of a risk assessment;
  • Implementation of a risk mitigation strategy; and
  • Employment of techniques and procedures for the continuous monitoring of the security state of the information system.

Risk Treatment: The process of selecting and implementing actions to modify unacceptable risks, typically by reducing their likelihood or impact, or by accepting, avoiding, transferring, or sharing them, to align with organizational objectives and risk criteria.

Rogue Device: An unauthorized client or access point on the WSU network, or an unauthorized access point seeking to impersonate the official WSU network.

Security Authorization (Authorization to Operate): The official management decision given by a senior WSU system official to:

  • Authorize the operation of a system or the common controls inherited by designated organizations systems; and
  • Explicitly accept the risk to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, and other organizations, based on the implementation of an agreed-upon set of security and privacy controls.

Security Content Automation Protocol (SCAP): A suite of specifications that standardize the format and nomenclature by which software flaw and security configuration information is communicated, both to machines and humans.

Semantics: The meaning or interpretation of statements or data within a system. Semantics ensure that inputs are logical and make sense in the context of the system’s operations.

Separation of Duties: A security principle that divides critical functions among different staff members in an attempt to ensure that no one individual has enough information or access privilege to perpetrate damaging fraud.

Syntax: The set of rules that define the correct structure and format for statements or data in a system. Syntax ensures inputs follow expected patterns, such as proper use of characters, symbols, or grammar.

System Administrator: Under the supervision of the Information System Owner, a system administrator is the individual responsible for the installation and maintenance of an information system, providing effective information system utilization, adequate security parameters, and sound implementation of established policies and procedures.

System Facilities: Include mechanical rooms, custodial rooms, pipe chases, steam tunnels, and rooms containing electrical, telephone, or computer control panels.

System Media: Includes both digital and non-digital media. 

Transmission: The state that exists when information is being electronically sent from one location to one or more other locations. 

Trust Anchor: A public key and its associated accompanying information that serve as an authority to verify the authenticity of digital signatures.  

University Email Account: Email accounts provided by WSU ITS for transacting official University business. A University email account address ends in “wsu.edu.”  

WSU Internal Information: Information that is for internal WSU business purposes only and may not be specifically protected from disclosure by law. Examples of WSU internal information may include information concerning various WSU system business transactions and operations.

WSU System: Washington State University campuses, research and learning centers, and extension centers committed to one set of operational principles. 

WSU-Managed: A device that is configured and maintained by Washington State University or its authorized IT personnel. These devices are subject to university security standards, including centralized management, regular updates, and compliance monitoring.

5.0    Acronyms

ATO: Area Technology Officer

BU: Business Unit

CCRO: Chief Compliance and Risk Officer

CCSS: Common Configuration Scoring System

CIO: Chief Information Officer

CISO: Chief Information Security Officer

CUI: Controlled Unclassified Information

CVSS: Common Vulnerability Scoring System

EAR: Export Administration Regulations

FIPS: Federal Information Processing Standard

IoT: Internet of Things

IT: Information Technology

ITAR: International Traffic in Arms Regulations

ITG: Information Technology Governance

ITS: Information Technology Services

LAN: Local Area Network

MDM: Mobile Device Management

MFA: Multi-Factor Authentication

NIST: National Institute of Standards and Technology

PHI: Protected Health Information

PII: Personally Identifiable Information

PIN: Personal Identification Number

PKI: Public Key Infrastructure

PoA&M: Plan of Action and Milestones

SCAP: Security Content Automation Protocol

SIEM: Security Information and Event Management

SOC: Security Operations Center

SSP: System Security Plan

USML: United States Munitions List

6.0    Training

See UPPM 87.21 for training requirements related to UPPM Chapter 87.

In addition to the requirements in UPPM 87.21, Information System Owners are responsible for ensuring that users receive appropriate information security and privacy training commensurate with their roles, responsibilities, and authorized access to information systems under the Information System Owner’s authority.

7.0    Violations

Persons determined to have violated any ITS-owned policy are subject to sanctions imposed using the procedures set forth in applicable University or state policies and handbooks (e.g., the WSU Faculty Manual, the Administrative Professional Handbook, WAC 357-40 Civil service employees, applicable collective bargaining agreements, or WAC 504-26 Standards of conduct for students).

_______________________
Revisions:  Sept. 2026 (Rev. 658); Mar. 2022 (Rev. 589); June 2020 – new policy (Rev. 547).