University Security Mandates | Information Security & Privacy

Harvard University Information Security

University Mandates Approved by Harvard Risk Management Committee

1. Training

Each School must identify and provide training for staff members who are involved in the use or processing of Confidential and High Risk Confidential Information. Harvard policy and Massachusetts law require training for those who are involved in the use or processing of High Risk Confidential Information. Each School must work with its Institutional Review Board to provide appropriate training for faculty members who are engaged in research involving Confidential or High Risk Confidential Information.

2. Comprehensive Communication

Each School must ensure that information on security requirements and expectations are communicated to faculty.

3. Laptop Encryption

Each School must ensure that all University owned laptops are encrypted.

4. Finding HRCI

Each School must ensure that all University owned user computers and servers are annually scanned to locate High Risk Confidential Information (HRCI).

5. Vulnerability Testing

Each School must annually perform vulnerability testing of servers containing HRCI.

6. Network Requirements

Each School must ensure that all systems with HRCI are on private address space and locally firewalled.

7. Remote Access

Each School must adopt a written policy specifying under what conditions, and by whom, HRCI may be accessed from outside of Harvard premises. Schools must ensure that permission for remote access to HRCI is strictly limited to those specific employees who have a strong business need for the access. Schools must ensure that any equipment used to remotely access HRCI and the configurations of that equipment can adequately safeguard the information.

8. Standard File Transfer

Each School must ensure that a secure file transfer method is available to, and used by, all users needing to transfer confidential information.

9. Non-Administrative System Certification

All Schools must ensure that all faculty, research, or student-managed systems with confidential information annually certify their compliance.

10. Managing Security and Practices

Each School must have a comprehensive Risk and Security Team, empowered to make and implement decisions regarding all aspects of School security, including building access, paper, technology, facilities, etc.

Below is the Microsoft Word version of the above information.

Enterprise Security Mandates.doc