3.2.18 Security logging must be monitored 24x7. Recommended Recommended Recommended Optional 3.2.19 Storage media and systems must be clearly labeled with Restricted Data Stickers. Required N/A N/A N/A 3.3. Minimum Standards for Network Controls standards define network access that connect systems. Standard Data Protection Level Restricted High Moderate Low 3.3.1 System must be on a firewall protected network shared only with systems in the same security domain. Required Recommended Recommended Optional 3.3.2 All network transit of Protected Data across the network must be encrypted. Required Required Required N/A 3.3.3 No cleartext transmission of passwords shall be permitted. Required Required Required Required 3.3.4 Network access be restricted to the minimum necessary to perform required functions. (example: Firewalls) Required Required Required Optional 3.4. Minimum Standards for Physical Controls Best practices for physical securing of equipment. Standard Data Protection Restricted High Moderate Low 3.4.1 Systems must be located in a locked room with limited access. Required Recommended Recommended N/A 3.4.2 Systems must be located in a locked rack or cage. Required Optional Optional Optional 3.4.3 Backup media must be physically secured from unauthorized access. Required Required Required Recommended 3.4.4 Backup media must be stored in a physically diverse location. Required Recommended Recommended Recommended 3.4.5 Systems must be provided with power protection (conditioning, uninterruptable power supply [UPS], and backup generator). Required Recommended Recommended Optional 3.4.6 Systems must be located in a room with appropriate environmental (e.g., heat and humidity) controls. Required Recommended Recommended Recommended
3.4.7 Systems storage media must be securely erased or disposed of when system function/role changes including equipment disposal. Required Required Required Recommended 3.4.8 Storage media must be physically destroyed when system function/role changes to a lower classification or at equipment disposal. Required Recommended Recommended N/A 3.5. Minimum Standards for Training and Compliance These are the steps necessary to ensure security policy and standard awareness. Standard Data Protection Level Restricted High Moderate Low 3.5.1 All system users must be notified of what protected data exists on a system and its protection requirements. Required Recommended Recommended N/A 3.5.2 At least annually all system users must sign the Protected Data Confidentiality Agreement. [link pending] Required Recommended Recommended N/A 3.6. Minimum Standards for Change Management Standards related to approved changes to systems. Standard Data Protection Level Restricted High Moderate Low 3.6.1 System administrators must establish, document and use an approved change control process for system configuration. Required Recommended Recommended Recommended 3.6.2 System changes and patches must be evaluated and tested prior to installation in a production environment. Recommended Recommended Recommended Recommended 3.7. Minimum Standards for Business Continuity This ensures the availability of university data and information processing systems. Standard Data Protection Level Restricted High Moderate Low 3.7.1 System administrators must establish, document, and follow a regular backup schedule. Required Recommended Recommended Recommended