Information Access & Protection Standard
1. Scope
This Standard applies to all individuals who access RIT Information Resources, regardless of affiliation or location. This includes, but is not limited to, students, faculty, staff, contractors, consultants, temporary employees, alumni, guests, and volunteers. By accessing RIT Information Resources, all users agree to comply with this Standard.
2. Requirements for All Information
Information Inventory
- All RIT organizational units (departments, divisions, etc.) should identify and maintain an inventory (type, classification, location, accessibility) of all Private, Confidential, and Internal information they handle or maintain.
Training
-
Divisional Vice Presidents and Deans are responsible for ensuring that mandatory information-handling training is provided to all RIT employees (including adjuncts, temporary staff, and contractors), student employees, and volunteers who have access to Confidential or Private information.
-
Training shall be conducted on a periodic basis appropriate to the level of risk and access.
Non-Disclosure Requirements
-
Divisional Vice Presidents and Deans shall ensure compliance with RIT non-disclosure requirements, including execution of non-disclosure agreements when applicable.
-
Administrators of systems, applications, or web pages containing Confidential or Private information (including student employees) shall sign the RIT Systems Support Personnel Non-Disclosure Agreement available in Forms and Checklists.
3. Requirements for Private Information
Identification and Remediation
-
All RIT organizational units shall participate in RIT-sanctioned Private information identification and remediation programs (e.g., Private Information Management @ RIT). Divisional Vice Presidents and Deans are responsible for developing and maintaining inventories of Private information through these programs.
-
Alternatives to the use of Private information must be identified and used whenever possible. The University ID shall replace the Social Security Number as the primary identifier. Unless required by a VP-approved business process, files must not contain Private information.
-
Any Private information present must be permanently removed through approved sanitization methods. Masking alone is insufficient. Approved sanitization practices are available on the Information Handling Resources web page.
Access and Use
-
Private information shall be accessed and disclosed strictly on a need-to-know basis to perform authorized RIT functions. Access must be safeguarded through documented technical and procedural controls, including login warning banners where appropriate.
-
Divisional Vice Presidents and Deans (Information Trustees) are responsible for ensuring Private information is protected from unauthorized access or disclosure. All business processes involving Private information require VP or Dean approval.
-
Disclosure of Private information to third-party agents or vendors is permitted only when the third party is contractually obligated to safeguard the information. The Office of Legal Affairs must be consulted for appropriate contractual language.
-
Access and use of Private information through clearinghouses (e.g., NCAA, National Student Clearinghouse) must comply with the above requirements where feasible.
-
Federally or court-mandated reporting is exempt from these requirements.
Storage
-
Paper records and portable media containing Private information shall be stored in locked areas when not in active use. Unless required by business processes, duplicate copies are prohibited.
-
Electronic Private information must be stored on ISO-approved secure servers or, if authorized elsewhere, in encrypted form. Storage on desktops, laptops, mobile devices, or portable media is prohibited unless encryption or equivalent protection is used.
-
Private information shall not be posted to blogs, wikis, or social platforms that do not use ISO-approved authentication and authorization.
-
Private information shall not be stored on shared cloud or distributed computing platforms unless approved by the Information Security Office.
Transfer/Sharing
-
Private information shall only be transferred when essential and must use ISO-approved secure methods, including:
-
Secure file transfer (e.g., Tiger File Exchanger)
-
Encrypted email or electronic transmission
-
File-based encryption
-
-
Use of Private information as a website authentication factor is prohibited.
-
Portable media used for transfer must be encrypted and comply with the RIT Portable Media Security Standard.
Printing
-
Printing Private information should be avoided unless required for business operations. Printers handling Private information must be located in secure areas.
-
Printing Private information on mailed materials is prohibited unless legally required. When permitted, the information must not be visible without opening the envelope.
-
Printing or encoding Private information on identification cards, tags, or access documents is prohibited.
Disposal
- Records containing Private information shall be destroyed in a manner that renders them unreadable and unrecoverable. Approved methods include cross-cut shredding, locked destruction bins, or approved vendor services. Recommended disposal methods may be found in Media Disposal Recommendations.
4. Requirements for Confidential Information
Transfer and Sharing
- If recipients may not recognize the classification, information must be clearly labeled “Confidential.” FERPA-protected educational records are exempt from marking requirements.
- Document creators should apply recommended marking templates where feasible.
Access and Use
- Confidential information shall be accessed and disclosed on a need-to-know basis with documented access controls.
- Third-party disclosure requires legally binding contractual safeguards.
- Federally or state-mandated reporting is exempt from this requirement.
Storage
- Paper records must be stored in locked areas.
- Electronic records must use secure IT resources with appropriate access controls and compliant passwords.
- Confidential information must not be posted to unauthorized online platforms
Disposal
- Confidential information must be destroyed using approved methods to prevent recovery. Recommended disposal methods may be found in Media Disposal Recommendations.
5. Requirements for Federal Research and Contract Data
Federal Contract Information (FCI)
- FCI shall be handled as RIT Confidential and protected in accordance with FAR 52.204-21. FCI includes non-public information provided by or generated for the U.S Government under contract.
Controlled Unclassified Information (CUI)
- CUI shall be handled as RIT Private and Confidential and safeguarded per NIST SP 800-171.
Minimum Safeguarding Requirements
- Federal safeguarding requirements apply in addition to RIT handling requirements.
Storage and Processing
- FCI/CUI must only be processed on systems verified by the Sponsored Research Services as meeting requirements.
Physical Protection
- Physical documents and media containing FCI/CUI must be stored in locked containers or rooms when not in use.
Marking
- All CUI must be marked in accordance with National Archives and Records Administration (NARA) CUI Marking Guidelines and RIT labeling requirements.
6. Requirements for Internal and Public Information
Internal Information
- Internal information in electronic form should be stored, transferred or shared using secure information technology resources with appropriate access controls. Passwords should comply with the Password and Authentication Provider Standards.
Public Information
- Public information is information that is available to anyone.