Office

Exception Process

Exception Process and Compliance

Updated 6/11/14

 

Anyone not in compliance with an Information Security Standard is subject to sanctions including suspension of computer and network privileges and/or the full range of current Institute personnel and student disciplinary processes.

In a small number of circumstances, it may not be possible to comply with an Information Security Standard.   The Information Security Office has provided the following method for obtaining an exception to compliance with a published information security standard.  Exceptions should be approved and signed by the appropriate Information Trustee (VP, Dean, or CIO).  (An email endorsing the exception request is acceptable.)

An exception MAY be granted by the RIT Information Security Office for non‑compliance with a standard resulting from:

  • Implementation of a solution with equivalent protection.
  • Implementation of a solution with superior protection.
  • Impending retirement of a legacy system.
  • Inability to implement the standard due to some limitation

 

Exceptions are granted for a specific period of time, not to exceed two years and are reviewed on a case-by-case basis and their approval is not automatic.

The Exception Request should include:

  • Description of the non-compliance
  • Anticipated length of non-compliance
  • Proposed assessment of risk associated with non-compliance
  • Proposed plan for managing the risk associated with non-compliance
  • Proposed metrics for evaluating the success of risk management (if risk is significant)
  • Proposed review date to evaluate progress toward compliance
  • Endorsement of the request by the appropriate Information Trustee (VP, Dean, or CIO).

 

If the non-compliance is due to a superior solution, an exception will normally be granted until the published standard or procedure can be revised to include the new solution. An exception request should still be submitted.

 

Submit the Exception Request Form to the Information Security Office, infosec@rit.edu, ROS 10-A200.

Plain English Guide to the Information Security Policy

Plain English Guide to the Information Security Policy 

RIT has issued an Information Security Policy. The Policy provides the strategic direction needed to implement appropriate information safeguards for RIT information and the Institute network. This Plain English Guide provides explanation and illustration of the Policy and is provided as an aid to help you understand and implement the requirements of the Policy. The Policy itself is authoritative. The policy is effective immediately.

Why did RIT issue the policy?

The Policy authorizes RIT to take reasonable measures to protect RIT information and computing assets in an age that is both reliant on electronic media and characterized by increasing Internet-borne threats. These measures apply to RIT information and the technology infrastructure.

In recent years, state and federal legislation have mandated specific protections for different types of information, including educational records (FERPA), financial customer information (Gramm-Leach-Bliley Act), health information (HIPAA), and private information (NYS Information Security Breach and Notification Act).

Why is the information lifecycle important?

The information lifecycle concept and its associated stages (creation, storage, transfer, and destruction) provide a useful framework for information handling. For example, during the creation stage, the creator of the information determines who should have access to the information and how that access is to be granted. During the destruction stage, "out-of-date" information or information used only occasionally may be without appropriate protection and be at greater risk.

What are the roles of Safeguards and Controls?

Most of the legislation above requires affected organizations to explain how they know people don’t have unauthorized access to information. Controls provide the best way of ensuring information protection. Controls can be process based (administrative controls), or technology based (technical controls). Controls focus on one or more of the following: problem prevention, problem detection, or problem correction.

How has RIT implemented this policy?

RIT has implemented the Information Security Policy by conducting risk assessments, issuing and enforcing standards, raising awareness of threats, recognizing best practices, and maintaining relationships with a number of security-focused external entities for benchmarking and sharing of resources.

More specifically,

  • RIT has designated specific individuals, including the RIT Information Security Officer, to identify and assess the risks to non-public or business-critical information within the Institute and establish an Institute-wide information security plan
  • The RIT Information Security Office creates and maintains standards to protect RIT information systems and its supporting infrastructure, ensure workforce information security, and guide RIT business associates and outsource partners. The creation of these standards is mandated by policy and is in response to the risks that the Institute faces. They are Institute-wide standards, created with representation from across RIT. See our Policies and Standards page for the list of current standards and information about how standards are developed.
  • The RIT Information Security Office provides awareness and training workshops, including its Digital Self Defense classes to help RIT users in the responsible use of information, applications, information systems, networks, and computing devices.
  • The RIT Information Security Office encourages the exchange of information security knowledge through ongoing engagements with security-focused groups, such as Educause, the New York State Cyber-Security Critical Infrastructure Coordination group, InfraGard, and others.
  • RIT periodically evaluates the effectiveness of information security controls in technology and process through risk assessments.

 

To whom does the policy apply?

The policy applies to the entire RIT community, including RIT employees, student employees, volunteers, and external business associates. Standards articulate how you follow the policy. Each standard has a different scope and may apply to different parts of or activities engaged in by the RIT population.

What do I have to do?

You need to follow all Information Security Policy requirements as articulated in the standards. See our Policies and Standards page for a current list of standards.

Where do I go for more information?

Read the policy and its associated standards. Contact the RIT Information Security at infosec@rit.edu if you have more questions.

 

About Us

About Us

Since 2001 the RIT Information Security Office, in partnership with other community stakeholders, has been a leader in managing information security risk and building community resiliency through:

  • Confidentiality: ensuring only those with sufficient privileges may access certain information
  • Integrity: ensuring information is whole, complete, and uncorrupted
  • Availability:  ensuring access to information without interference or obstruction

Our Mission

Provide leadership to the RIT community in safeguarding the confidentiality, integrity and availability of RIT’s information resources.

What We Do

  • Awareness
  • Alerts/Advisories
  • Vulnerabilty Management
  • Private Information Management
  • Forensics/Investigations
  • Security Policies & Standards

Contact Us

Contact Us

RIT Information Security Office

Location Information Security Office Ross Building 10-A201
Mailing Address 151 Lomb Memorial Drive Ross 10-A201 Rochester Institute of Technology Rochester, NY 14623-5608
Email:infosec@rit.edu Phone: (585) 475-4122, (585) 475-4123 Fax: (585) 475-7920

Staff Directory

Employee

 

Email

Office

Contact

Jonathan Maurer
Information Security Officer

jdmrmss@rit.edu

Eastman 01-4000

(585) 475-6379
Fax: (585) 475-7950

Jim Moore
Senior Information Security Forensic Investigator

jhmvnd@rit.edu

Ross 10-A202

(585)-475-5406
Fax: (585) 475-7920

Ben Woelk
Policy and Awareness Analyst

fbwis@rit.edu

Ross 10-A204

(585) 475-4122
Fax: (585) 475-7920

Paul Lepkowski
Information Security Engineering Manager

paul.lepkowski@rit.edu

Ross 10-A200

(585) 475-6972
(585) 475-7920

General Inquiries infosec@rit.edu Ross 10-A201 (585) 475-4123

Support Contacts at RIT

The following organizations support the general community at RIT. Some colleges and departments have their own support organizations. In those cases, you should contact your local support organization first. Depending on the issue, your systems administrator may direct you to a different organization.
 

Organization

Contact

ITS Service Desk (everyone)

Gannett Building (7B), Room 7B-1113 Voice: (585) 475-HELP TTY: (585) 475-2810 Submit an online help request to servicedesk@rit.edu for more information visit http://www.rit.edu/its/

Resnet (on-campus residents only)

Nathaniel Rochester Hall (43), Room 1034 Voice: (585) 475-2600 TTY: (585) 475-4927 resnet@rit.edu for more information visit http://resnet.rit.edu/

Information Security Council Contacts

Click here for the complete list of individuals in the Information Security Council 

Media Disposal Recommendations

Media Disposal Recommendations

Media

Disposal Method

Paper

Use a shredder. Crosscut is preferred over a strip shredder.

CD, DVD, diskette, etc.

Use the media shredder (located at the ITS HelpDesk, 7B-1113).

Hard Drives

If the hard drive is to be reused, contact your support organization for recommendations for secure erasure.

If the hard drive is damaged or will not be reused, render the hard drive unreadable by using the degausser (located at the ITS HelpDesk, 7B-1113).

Tapes

Use the degausser (located at the ITS HelpDesk, 7B-1113).

Other

Use an industry standard means of secure disposal.

 

 

Pages

Subscribe to RSS - Office