Definitions

The Service Organization Control 2 (SOC 2) was developed by the  American Institute of Certified Public Accountants (AICPA) to report on controls at a service organization relevant to security, availability, processing Integrity, and confidentiality or privacy.  The SOC 2 report provides detailed information and assurance about the controls at a service organization (e.g., cloud vendor) relevant to the security, availability, processing, integrity, and confidentiality (privacy) of customer data. 

The Service Organization Control 2 (SOC 2) Type II report is an attestation of controls at a service organization over a minimum six-month period, where as a SOC 2 Type I report is an attestation of the operating effectiveness of controls at a service organization at a specific point in time.  The SOC 2 Type II reports on the description of controls  relevant to security, availability, processing integrity, and confidentiality or privacy provided by the service organization and attests that the controls are suitably designed,  implemented, and effective. 

Software token (sometimes called an authentication or security token) is a piece of two-factor authentication security.  The token is sent or stored on a device (e.g., smart phone or telephone) that the owner must have to authorize access to a restricted resource. The user's interaction with a login system proves that the user physically possesses a token specific and unique to that user.  Examples include using Duo-Authentication or Google Authenticator.

Supported operating systems and firmware are operating systems (OS) or firmware that are either supported by the vendor with continued patching or an open source that is supported with updates and/or patches by an active user community. ITS provides a list of its supported OSes and software at: https://in.virginia.edu/support

Temporary Elevated Privileges are any case where administrative access of an endpoint is explicitly granted by an endpoint manager for five (5) calendar days or fewer at a time

Two-step, two-factor, or multi-factor authentication is an authentication method in which a person is granted access only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism:

1. knowledge (something the user and only the user knows),
2. possession (something the user and only the user has), and/or
3. inherence (something the user and only the user is).

Any two-step or multi-factor authentication process at the University of Virginia must be:

a. a University-approved two factor authentication  (e.g., Duo-based High Security VPN) or
b. a method that has been reviewed and approved by the University Information Security Office before use.

A good example of two-factor authentication is the withdrawing of money from an ATM. Only the correct combination of a bank card (something the user possesses) and a PIN (something the user knows) allows the transaction to be carried out.

Two-step login process must be either a UVA-approved two-step authentication  (e.g., Duo-based) or another method that has been reviewed and approved by the University Information Security Office before use.

Unauthorized disclosure is the exposure, communication, and/or physical transfer of information to someone not authorized to view and/or receive it.

Recorded information that documents a transaction or activity by or with any appointed board member, officer, or employee of the University. Regardless of physical form or characteristic, the recorded information is a University record if it is produced, collected, received or retained in pursuance of law or in connection with the transaction of university business. The medium upon which such information is recorded has no bearing on the determination of whether the recording is a University record. University records include but are not limited to: personnel records, student records, research records, financial records, patient records, and administrative records. Record formats/media include but are not limited to: email, messaging (texts, instant messaging, etc.), posts (social media or collaboration software), databases, electronic files, paper, audio, video and images (digital and printed).

An independent and separately incorporated legal entity, officially recognized by the University, subject to an executed UAO- Memorandum of Understanding (MOU), and meeting all the following criteria:

• Organized and exists under Virginia law and in good standing with the State Corporation Commission;
• Qualifies as a tax-exempt organization;
• Exists and operates for the benefit of the University or one or more of its units by providing one or more of the following support functions: fundraising, asset management, programs and services; and
• Not an agency, organization, corporation, or unit of the University or the Commonwealth of Virginia.

From the University of Virginia Policy Glossary