Ohio Administrative Code › Title 3349 - Northeast Ohio Medical University › Chapter 3349-9 - Acceptable Use of Computer Equipment › Section 3349-9-18 - Classification of university data systems

Current through all regulations passed and filed through July 1, 2024
(A)
								Purpose
To establish a classification framework
				based upon the sensitivity and regulatory requirements for safeguarding
				university data and systems.
(B)
								Scope
This rule applies to all university
				data and systems and to those responsible for classifying or using university
				data and systems.
(C)
								Definitions
(1)
									"Authorization" refers to the granting of permission to
			 an identified individual to use university data or system(s) and to explicitly
			 accept the risk to university operations, individuals, and assets based on
			 extending such permission. Acceptance of authorization to use university data
			 and systems establishes an obligation on the part of the individual to use
			 those resources responsibly.
(2)
									"Availability"
			 refers to the ensuring of timely and reliable access to and use of data or
			 systems. Additionally, it describes the importance of access when the data or
			 system is needed, and the impact on the organization if it is not available. A
			 loss of availability is the disruption of access to or use of data or systems
			 (e.g., hard drive failure, destruction of a system, system unresponsiveness,
			 denial of service attack).
(3)
									"Confidentiality"
			 refers to the preservation of authorized restrictions on data access and
			 disclosure, including means for protecting personal privacy and proprietary
			 data. A loss of confidentiality is the unauthorized disclosure of data (e.g.,
			 compromised by hackers; released or published publicly without
			 authorization).
(4)
									"Data" refers to any instance of information,
			 regardless of form or storage medium, that is categorized by an organization or
			 by a specific law or regulation.
(5)
									"Integrity"
			 refers to the guarding against improper data or system modification or
			 destruction and ensuring authenticity and non-repudiation in the use of data or
			 systems. A loss of integrity is the unauthorized modification or destruction of
			 data or systems where such resources can no longer be trusted for use, are not
			 complete, or incorrect.
(6)
									"Internal university data" as defined within paragraph
			 (D)(2)(a)(ii) of this rule.
(7)
									"Private
			 university data" as defined within paragraph (D)(2)(a)(iii) of this
			 rule.
(8)
									"Public university data" as defined within paragraph
			 (D)(2)(a)(i) of this rule.
(9)
									"Record" refers
			 to any document, device, or item, regardless of physical form or characteristic
			 that is created, received by, or comes under the jurisdiction of an
			 organization which serves to document the organization, its functions, rules,
			 decisions, procedures, operations or other activities. University data may
			 reside in university records, be used to produce university records, or may of
			 itself be a university record.
(10)
									"Restricted
			 university data" as defined within paragraph (D)(2)(a)(iv) of this
			 rule.
(11)
									"Risk," with respect to the university, refers to the
			 effect of uncertainty, either negative or positive, on the university's
			 strategy and its strategic objectives.
(12)
									"System" refers
			 to an information technology resource that can be classified, may have security
			 controls applied, and are organized for the collection, processing,
			 maintenance, use, sharing, dissemination, or disposition of university data.
			 Example of systems are, but not limited to: desktop, laptop, or server
			 computers; mobile devices (e.g., iphones; ipads; android; blackberry) to the
			 extent that they interact with university data and systems, such as university
			 email; university network(s); software; applications; and
			 databases.
(13)
									"University data" refers to data that is created,
			 collected, stored and/or managed in association with fulfilling the
			 university's mission or its required business functions. University data may or
			 may not constitute a public record (as defined within section
			 149.43 of the Revised
			 Code).
(14)
									"User" refers to any individual or entity that has
			 received authorization, if applicable, to access university data or
			 systems.