Significant updates have been made to UVA information policies, standards, and procedures. The results should not only improve the security of our information technology environment, but also provide improved guidance for our community as we all strive toward compliance. Unless otherwise noted below, all changes are effective immediately. These policies address the management of IT resources and University information and provide a framework for minimizing risks.
We encourage you to review and familiarize yourself with these changes and encourage you to seek assistance from technology experts (i.e. Local Support Partners) in your areas. You may learn more about these updated policies, standards, and procedures on our Information Technology Policies, Standards, & Procedures webpage. For questions or concerns please speak with your Local Support Partner (LSP) or email University Information Security at [email protected].
Top 10 Changes (+1 bonus):
- Streamlined the number of information technology policies from 26 to 4, and the number of standards and procedures from 71 to 31.
- Defined a new policy area: Privacy and Confidentiality of University Information (IRM-012)
- New data classification level: Internal Use
- New Policy, Standard, and Procedures Exception process
- Defined approval process for new business processes involving Highly Sensitive Data or Sensitive Data
- Approvers have been clearly defined, and the process to request approval has been clarified.
- Security awareness training for all non-student users is now required annually, effective March 1st, 2018.
- The Information Security-Risk Management (IS-RM) assessment program uses an online tool, and assessment completion is now required annually, effective March 1st, 2018.
- Reporting of information security incidents is now required within one (1) hour of becoming aware of the incident.
- Access to electronic records of the deceased has been updated based upon recent changes to state law.
Let's take these changes up to an eleven!
11. Established the requirements for obtaining third and fourth level subdomain names on Virginia.edu