Ohio Administrative Code › Title 3349 - Northeast Ohio Medical University › Chapter 3349-9 - Acceptable Use of Computer Equipment › Section 3349-9-15 - Information security

Current through all regulations passed and filed through July 1, 2024
(A)
								Purpose
Northeast Ohio medical university
				("NEOMED") has instituted the following information security rule to establish
				the overarching, university-wide approach to information security and as a
				measure to protect the confidentiality, integrity and availability of
				university data and systems.
(B)
								Scope
This rule applies to university data
				and systems; university students, faculty, staff, and alumni; and authorized
				external users for legitimate university purposes (e.g., volunteers, tenants,
				vendors, contractors, consultants, guests and/or visitors).
(C)
								Definitions
(1)
									 "Access control" refers to the process of regulating
			 specific requests to obtain and use university data and
			 systems.
(2)
									"Authorization" refers to the granting of permission to
			 an identified individual to use university data or system(s) and to explicitly
			 accept the risk to university operations, individuals, and assets based on
			 extending such permission. Acceptance of authorization to use university data
			 and systems establishes an obligation on the part of the individual to use
			 those resources responsibly.
(3)
									"Availability"
			 refers to the ensuring of timely and reliable access to and use of data or
			 systems. Additionally, it describes the importance of access when the data or
			 system is needed, and the impact on the organization if it is not available. A
			 loss of availability is the disruption of access to or use of data or systems
			 (e.g., hard drive failure, destruction of a system, system unresponsiveness,
			 denial of service attack).
(4)
									"Confidentiality"
			 refers to the preservation of authorized restrictions on data access and
			 disclosure, including means for protecting personal privacy and proprietary
			 data. A loss of confidentiality is the unauthorized disclosure of data (e.g.,
			 compromised by hackers; released or published publicly without
			 authorization).
(5)
									"Data" refers to any instance of information,
			 regardless of form or storage medium, that is categorized by an organization or
			 by a specific law or regulation.
(6)
									"Information
			 security" refers to the protection of university data and systems from
			 unauthorized access, use, disclosure, disruption, modification and destruction
			 with the intent to provide confidentiality, integrity and availability to such
			 data and systems.
(7)
									"Integrity" refers to the guarding against improper
			 data or system modification or destruction and ensuring authenticity and
			 non-repudiation in the use of data or systems. A loss of integrity is the
			 unauthorized modification or destruction of data or systems where such
			 resources can no longer be trusted for use, are not complete, or
			 incorrect.
(8)
									"Risk," with respect to the university, refers to the
			 effect of uncertainty, either negative or positive, on the university's
			 strategy and its strategic objectives.
(9)
									"Security
			 incident" refers to an adverse event that results in a suspected or known
			 unauthorized disclosure, misuse, alteration, destruction, or other compromise
			 of university data or systems. A security incident is caused by the failure of
			 a security mechanism or an attempted or threatened breach of these mechanisms
			 through nonelectronic means (e.g., a violation of applicable university rules,
			 mishandled documents, the theft or loss of a system, verbal or visual
			 disclosure of personal information) and electronic means (e.g. hacking,
			 malware, ransomware, phishing).
(10)
									"System" refers
			 to an information technology resource that can be classified, may have security
			 controls applied, and are organized for the collection, processing,
			 maintenance, use, sharing, dissemination, or disposition of university data.
			 Example of systems are, but not limited to: desktop, laptop, or server
			 computers; mobile devices (e.g., iphones; ipads; android; blackberry) to the
			 extent that they interact with university data and systems, such as university
			 email; university network(s); software; applications; and
			 databases.
(11)
									"University data" refers to data that is created,
			 collected, stored and/or managed in association with fulfilling the
			 university's mission or its required business functions. University data may or
			 may not constitute a public record (as defined within section
			 149.43 of the Revised Code
			 ).
(12)
									"University account" refers to a user's username and
			 password combination for a university system (e.g., university
			 email).
(13)
									"University email", also known as "NEOMED email",
			 refers to the university's approved microsoft-based email system used to
			 transmit and receive electronic messages.
(14)
									"User" refers to
			 any individual or entity that has received authorization, if applicable, to
			 access university data or systems.