Definitions

The term moderately sensitive data has been changed to sensitive data. The definition remains the same.
See the definition for Sensitive Data

Must expire every sets the maximum number of days before a password must expire and require changing.

Network connected devices include all systems, whether personally or University-owned or managed, connecting to the University’s network. This includes, but is not limited to, computers, laptops, desktops, servers (virtual or physical and including shared drives), smart phones, tablets, digital assistants, printers, copiers, routers, switches, firewall hardware, network-aware devices with embedded electronic systems (i.e., “Internet of Things”; IoT), and supervisory control and data acquisition (SCADA) and industrial control systems.

All users except for those whose sole affiliation with the University is student or applicant.

Password history determines the number of unique new passwords that have to be associated with and used by a user before an old password can be reused again. This ensures that old passwords are not reused often or continually.

Persistent elevated privileges are any case where administrative access of an endpoint is explicitly granted by an endpoint manager for longer than five (5) calendar days at a time.

phishing is the sending of emails claiming to be from a reputable source (e.g., a company or friend) in order to get you to reveal personal information, such as personally identifiable information, banking and/or credit card details, or passwords. A phishing email may try to get you to download malware onto your computer or phone by opening or saving the email's attachment.  

Refers to information that is linked to a person’s identity, such as Social Security Number (SSN), driver’s license number, military ID, protected health information (PHI), etc. 

Consult the definition of highly senstive data in the UVA Policy: IRM-003: Data Protection of University Information for additional information about protected information.

Public data, as defined in the UVA Policy IRM-003: Data Protection of University Information, are: data intentionally made public and are therefore classified as not sensitive. Any data that are published and broadly available are, of course, included in this classification. University policy holds that the volume of data classified as not sensitive should be as large as possible because widespread availability of such information will enable others to make creative contributions in pursuit of the University's mission.

IT resources that are available to broad groups of users within the University community. They include, but are not limited to: public-access computer facilities, shared multi-user computing systems, and the network services that Information Technology Services (ITS) and all other University schools and departments manage. The word “public,” in this context, describes a resource that is available broadly to members of the University community. It does not imply that these resources are available to persons from outside the University community.