Definitions

Public Record, as defined in two UVA policies, is:  Any writing or recording — regardless of whether it is a paper record, an electronic file, an audio or video recording or any other format — that is prepared or owned by, or in the possession of a public body or its officers, employees, or agents in the transaction of public business. Commonwealth of Virginia Code § 2.2-3701. All public records are presumed to be open and may be withheld only if a statutory exemption applies.

Publicly accessible means any device or computer that is in a public area and can be used by anyone.

Ransomware is a form of malware in which rogue software code effectively holds a user's computer hostage until a "ransom" fee is paid.  Access to the user's computers files are blocked, often by encrypting them.  Most ransomware attacks are the result of clicking on an infected email attachment or visiting hacked or malicious websites.

Any document, file, computer program, database, image, recording, or other means of expressing information in either electronic or non-electronic form.

Regulated data is defined as data that requires the university to implement specific privacy and security safeguards as mandated by federal, state, and/or local law, or university policy or agreement. Regulations or categories of data most applicable to UVA include, but is not limited to: 
Family Educational Rights and Privacy Act (FERPA) 
Controlled Data 
Health Insurance Portability and Accountability Act (HIPAA) 
Health Information Technology for Economic and Clinical Health Act (HITECH) 
Social Security Numbers (SSNs) 
Gramm Leach Bliley Act (GLBA) 
Payment Card Industry Data Security Standards (PCI-DSS) 
Export Controlled Research - International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR) 
Controlled Unclassified Information (CUI) 
Covered Defense Information (CDI) and Controlled Technical Information (CTI) 
Classified Data  
Restricted Research Data, such as census data.

The Office of the Vice-President for Research provides guidance and assistance for some of these kinds of data.

Any data, document, computer file, computer diskette, or any other written or non-written account or object that reasonably may be expected to provide evidence or information regarding the proposed, conducted, or reported research that constitutes the subject of an allegation of research misconduct. A research record includes, but is not limited to, grant or contract applications, whether funded or unfunded; grant or contract progress and other reports; laboratory notebooks; notes; correspondence; videos; photographs; X-ray film; slides; biological materials; computer files and printouts; manuscripts and publications; equipment use logs; laboratory procurement records; animal facility records; human and animal subject protocols; consent forms; medical charts; and patient research files. A research record is one type of University record.

Risk Management, as defined in the UVA Policy IRM-004: Information Security of University Technology Resources, is: the process to identify, control and manage the impact of potential harmful events, commensurate with the value of the protected assets. Risk management includes impact analysis, risk assessment, and continuity planning.

Sensitive data, as defined in the UVA Policy IRM-003: Data Protection of University Information, are: data, records, and files that:

• may be withheld from release under the Virginia Freedom of Information Act (FOIA),
• are not public records,
• do not enable identity theft,
• are not protected health information (PHI).

Examples include information concerning the prevention of or response to cyber-attacks, or information that describes a security system used to control access to or use of an automated data processing or telecommunications system, or research records that do not contain Highly Sensitive Data, University ID numbers, i.e., those printed on University ID cards, and/or Family Educational Rights and Privacy Act-protected data not covered under the definition of “Highly Sensitive” data.  This category of data also includes any data or record covered by the exemptions listed in the Commonwealth of Virginia Freedom of Information Act).

A Service account is a “non-human” account that is used to run services or applications.  Service accounts are not administrative accounts or other accounts used interactively by administrators or other persons.

smishing: is the sending of a text messages claiming to be from a reputable source to get you to reveal personal information, such as passwords or credit card numbers, or to download malware onto your computer or phone.  It is short for "SMS phishing."