Information 技术 Standard 05.2.0

数据泄露 Notification Standard

日期 of Current Revision or Creation: 2021年10月1日

的目的 Information 技术 Standard is to specify requirements for compliance with 最靠谱的网赌软件 Information 技术 policies, 其他大学政策, as well as applicable laws and regulations. 标准 may include business principles, 最佳实践, 技术标准, migration and implementation strategies, 指导设计, deployment and management of information technology.

目的

The purpose of this standard is to specify the data breach notification requirements for 最靠谱的网赌软件 by identifying the triggering factors and necessary responses to unauthorized release of unencrypted sensitive information.

定义

数据泄露 is an incident in which sensitive, protected or confidential data has potentially been viewed, stolen and/or used by an individual unauthorized to do so.

个人信息 is any piece of data that can potentially be used to identify a single person. 一般来说,名字 and one or more personal information data elements are necessary to place identity at serious risk.

标准声明

ODU will identify all University systems, 流程, and logical and physical data storage locations, 包括 those held by third parties, 包含第1类的,2, and 3 regulated data as described in the ITS Standard 02.3.0 Data 政府 and Classification.

ODU will include provisions in third-party contracts that involve Class 1,2、3调节数据, requiring that the third party and third-party subcontractors:

1. Provide timely notification to the agency of suspected breaches
2. Allow the agency both to participate in the investigation of incidents and exercise control over decisions regarding external reportings.

ODU will provide appropriate notice to affected individuals upon the unauthorized release of any unencrypted Class 1,2, and 3 regulated data by any mechanism, 包括, 但不限于:

1. Theft or loss of digital media 包括 laptops, 台式电脑, 闪存, 智能手机, 平板电脑, 光盘的, DVD的, 磁带, 等.
2. Theft or loss of physical hardcopy
3. Security compromise of any system containing Class 1,2, and 3 regulated data
4. Encrypted data in which the encryption key is also compromised

ODU will provide this notice without undue delay as soon as verification of the unauthorized release is confirmed, 除了下面描述的情况.

ODU will provide notification that consists of:

1. A general description of what occurred and when
2. The type of personal information was involved
3. Whether actions have been taken to protect the individual's personal information from further unauthorized disclosure
4. 什么, 如果有什么区别的话, ODU will do to assist affected individuals, 包括 contact information for more information and assistance
5. 什么 actions ODU recommends that the individual take

ODU will provide this notification by one or more of the following methods, listed in order of preference:

1. Standard mailing to any affected individuals whose mailing addresses are available
2. Electronic mail to any affected individuals whose email address has been provided to the agency as a contact mechanism
3. In the case of large-scale breaches or data breaches where neither form of communication listed above is available or feasible, public communications channels, 包括:
   1. Conspicuous notification on the agency website
   2. Notification by statewide public media, 包括 newspaper, radio and television

ODU will not provide notification immediately following verification of unauthorized data disclosure only if requested by:

1. Law Enforcement entities where it would interfere with an ongoing investigation
2. 首席信息官, ISO or designee where it would interfere with a determination of the scope of the data breach or investigation of root cause

程序,指导方针 & 其他相关资料

• 联邦和州法律
• Data and System Breach Response Framework
• 大学政策3505 - Information 技术 Security Policy
• IT标准02.3.0 -数据管理 & 分类标准

历史