UPPM 87.53<\/strong><\/p>\n For more information contact:<\/strong> The purposes of the information assurance policies in UPPM Chapter 87: Information Technology and Security are to:<\/p>\n The policies in this chapter comply with Federal Information Processing Standards (FIPS 199<\/a>), which are intended to help organizations achieve a common level of quality and interoperability in information technology (IT) by requiring categorization of systems as low-impact, moderate-impact, or high-impact for the stated security objectives of confidentiality, integrity, and availability. To determine the potential consequence of a loss event, the Federal Information Processing Standards:<\/p>\n See UPPM 87.01<\/a> for definitions, general information, and violations related to this policy, as well as additional information regarding roles and responsibilities.<\/p>\n Institutional Information (as defined in UPPM 87.01<\/a>) is a valuable WSU asset that must be categorized and safeguarded based on sensitivity and risk. By establishing clear requirements for all classifications of data, this policy ensures that Institutional Information is carefully managed, maintained, protected, and used appropriately throughout its lifecycle, as well as protected from unauthorized access or disclosure.<\/p>\n This policy and UPPM Chapter 87 use the terms \u201cinformation\u201d and \u201cdata\u201d interchangeably.<\/p>\n This policy applies to all WSU system users who have contact with, or potentially may have contact with, WSU data, applications, and computing resources.<\/p>\n Security control exceptions to policy statements in UPPM Chapter 87 are managed and maintained in accordance with UPPM 87.23<\/a>.<\/p>\n The Chief Information Officer (CIO) of WSU, or designee, is responsible for administering this policy and reviewing it on an annual basis.<\/p>\n WSU Information System Owners, or their delegates, are responsible and accountable for developing appropriate Standard Operating Procedures (SOPs) for this policy’s implementation.\u00a0<\/p>\n WSU\u2019s Office of Information Security and Assurance (OISA) shall maintain the standard (PDF)<\/a> associated with this policy and provide guidance for the associated procedures for the implementation of this policy (see examples (PDF)<\/a>).<\/p>\n Note:<\/strong> While all units are required to adhere to the standard established by OISA (NIST SP 800-53<\/a>), procedural examples for implementation are optional.<\/p>\n Information Owners, or their delegates, must classify WSU Institutional Information for which they are responsible for according to following classifications (see also UPPM 87.01<\/a>):\u00a0<\/p>\n WSU Institutional Information must be properly administered, managed, and maintained throughout its entire life cycle. WSU Information Owners, or their delegates, are accountable for the security and privacy of WSU Institutional Information under their care.<\/p>\n Information Systems that store or process Confidential and\/or Regulated Data must geographically reside in the United States.\u00a0<\/p>\n WSU Institutional Information must be protected via appropriate encryption mechanisms in accordance with UPPM 87.33<\/a>.\u00a0<\/p>\n Information System Owners, or their delegates, must identify the digital and\/or non-digital media with access restrictions for specific personnel or roles.\u00a0<\/p>\n Information System Owners, or their delegates, must restrict the use of certain types of media on defined organizational systems or system components.\u00a0<\/p>\n Access to WSU Institutional Information is to be provided in accordance with UPPM 87.05<\/a>.\u00a0<\/p>\n System media is to be sanitized in accordance with UPPM 87.72<\/a><\/p>\n The use of portable storage devices is to be prohibited when the system or system component has no identifiable owner.\u00a0<\/p>\n In addition to the above, the following requirements apply to all moderate and high-impact systems.<\/p>\n Information Owners, or their delegates, of moderate- and high-impact systems must maintain an up-to-date inventory of WSU Institutional Information within their area of responsibility.<\/p>\n Information System Owners, or their delegates, are responsible for maintaining a record of users who have access to the system components where those types of information are processed and stored.\u00a0\u00a0<\/p>\n Moderate- and high-impact systems must use automated tools to identify information by information type on system components to ensure controls are in place.<\/p>\n Moderate- and high-impact system media must be marked with the distribution limitations, handling caveats, and applicable security markings. Information Owners, or their delegates, can exempt defined types of system media from marking within defined controlled areas.\u00a0<\/p>\n Information System Owners, or their delegates, must define the moderate- and high-impact system media that needs to be physically controlled and securely stored within defined areas. The defined system media must be protected and destroyed in accordance with UPPM 87.72<\/a>.<\/p>\n Information System Owners, or their delegates, must define the moderate- and high-impact system media that needs protection during transport outside of controlled areas and must maintain accountability, document transport activities, and restrict access outside controlled areas to authorized personnel.\u00a0\u00a0<\/p>\n See UPPM 87.21<\/a> for training requirements related to UPPM Chapter 87.<\/p>\n In addition to the requirements in UPPM 87.21<\/a>, Information System Owners are responsible for ensuring that users receive appropriate information security and privacy training commensurate with their roles, responsibilities, and authorized access to information systems under the Information System Owner\u2019s authority.<\/p>\n _______________________ University Policies and Procedures Manual (previously Business Policies and Procedures Manual) Data Protection and Classification UPPM 87.53 For more information contact:\u00a0 \u00a0Information Technology Services Contents 1.0 \u00a0\u00a0 Overview and Purpose 1.1 […]<\/p>\n","protected":false},"author":49281,"featured_media":0,"parent":50633,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"wsuwp_university_location":[],"wsuwp_university_org":[],"_links":{"self":[{"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/pages\/68273"}],"collection":[{"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/users\/49281"}],"replies":[{"embeddable":true,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/comments?post=68273"}],"version-history":[{"count":7,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/pages\/68273\/revisions"}],"predecessor-version":[{"id":69993,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/pages\/68273\/revisions\/69993"}],"up":[{"embeddable":true,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/pages\/50633"}],"wp:attachment":[{"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/media?parent=68273"}],"wp:term":[{"taxonomy":"wsuwp_university_location","embeddable":true,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/wsuwp_university_location?post=68273"},{"taxonomy":"wsuwp_university_org","embeddable":true,"href":"https:\/\/policies.wsu.edu\/prf\/wp-json\/wp\/v2\/wsuwp_university_org?post=68273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u00a0 \u00a0Information Technology Services<\/a><\/p>\n
\nContents<\/h3>\n
\n
\n
\n
\n
1.0\u00a0\u00a0\u00a0\u00a0 Overview and Purpose<\/h3>\n
1.1\u00a0\u00a0\u00a0\u00a0\u00a0 Information Assurance Policies Generally<\/h4>\n
\n
\n
1.2\u00a0\u00a0\u00a0\u00a0\u00a0 Specific Policy Overview and Purpose<\/h4>\n
2.0\u00a0\u00a0\u00a0 Applicability<\/h3>\n
3.0\u00a0\u00a0\u00a0 Roles and Responsibilities<\/h3>\n
3.1\u00a0\u00a0\u00a0\u00a0\u00a0 Chief Information Officer<\/h4>\n
3.2\u00a0\u00a0\u00a0\u00a0 Information System Owners<\/h4>\n
3.3\u00a0 \u00a0 \u00a0Office of Information Security and Assurances (OISA)<\/h4>\n
4.0 Requirements<\/h3>\n
4.1\u00a0\u00a0\u00a0\u00a0 General Requirements<\/h4>\n
\n
4.2\u00a0\u00a0\u00a0\u00a0 Moderate- and High-Impact Systems<\/h4>\n
5.0\u00a0\u00a0\u00a0 Training<\/h3>\n
\n
Revisions:<\/strong>\u00a0 Feb. 2026 (Rev. 651<\/a>); Mar. 2022 (Rev. 102<\/a>); June 2020 (Rev. 91<\/a>); May 2018 (Rev. 79<\/a>); Feb. 2015 (Rev. 59); Dec. 2007 (Rev. 29); Apr. 2006 (Rev. 22); Nov. 2001 – new policy (Rev. 3)<\/p>\n
<\/p>","protected":false},"excerpt":{"rendered":"