Electronic Information Security Policy

Category:  Administrative

Approval:  Senate

Responsibility:  Associate Vice-Principal IT / Chief Information Officer

Date:  May 27, 2014

Purpose/Reason for This Policy:

The purpose of the Queen's Electronic Information Security Policy is to establish responsibility for preserving:

1. The confidentiality, integrity and availability of electronically maintained Queen's University information or data; and
2. the privacy of electronically maintained personal information in the custody or control of the University or members of the Queen's Community, whether stored on premises or external to the University.

Scope of this Policy Framework:

This Policy applies to all members of the Queen's University who, in the course of their employment or academic activities, will gather, manage, distribute or use Sensitive Information. This includes departments, research groups, faculty, staff, students, and volunteers, and extends to external vendors, suppliers, contractors or collaborators engaged in the gathering, management and use of Sensitive Information.

Policy Statement:

Members of the Queen's Community who have care and control of or use Sensitive Information, are responsible for accessing and using only that information required for their academic or administrative role(s), for protecting the information from disclosure or unauthorized use by others, and for safeguarding the privacy of personal information about or belonging to others.

Responsibilities:

Responsibility for preserving the security and privacy of information rests with each member of the Queen's community involved in the collection, management, and use of information. While it may be possible to delegate responsibility to others, one cannot delegate their accountability for preserving the security and privacy of information. Responsibilities vary according to each person's role in relation to the Sensitive Information, and in some circumstances a person may have multiple roles. Any person who has care and control of Sensitive Information is a Custodian for that information while it is in their care and control. Where Sensitive Information is stored on a personal computer or mobile device, the owner or holder of that IT Resource is a Custodian for that information. The following establishes the responsibilities of each of the primary roles associated with electronic information.

As an Information Steward, you are responsible for ensuring:

1. that Sensitive Information for which you are primarily responsible is appropriately classified according to the Queen's University Data Classification Standard;
2. that all Custodians and Users provide appropriate protection for Sensitive Information in their care;
3. that all Custodians and Users involved in gathering, managing or using the Sensitive Information, understand and accept their responsibilities under this Policy;
4. that a review of who has access to the Sensitive Information is conducted regularly to ensure that only those still requiring access continue to have it;
5. that a security assessment for the Sensitive Information be conducted on a regular basis;
6. that in a situation when the security of Sensitive Information has or may have been compromised:
   1. that immediate corrective measures are taken to eliminate the risk or exposure
   2. that the situation is reported in accordance with Procedures for Reporting IT or Information Security Incidents or Risks;
   3. that all affected individuals are notified when it is determined that the privacy of their personal information has been compromised; and
   4. that a security assessment be conducted immediately.

As an Information Custodian, you are responsible for ensuring:

1. that access to the Sensitive Information is provided only to Users who require such access for legitimate University purposes, as established by the Steward, and that each user's access is approved by the associated Unit Head or designate;
2. that a User's access to the Sensitive Information is limited to only those data subsets or elements that the User requires;
3. that access to the Sensitive Information is revoked as soon as a User no longer requires access;
4. that those responsible for installing and maintaining the hardware and software that is used to collect, house, manage or provide access to the Sensitive Information, do so in accordance with the Network and Systems Security Policy;
5. that any new system or application that will house or provide access to the Sensitive Information undergo a system security assessment prior to being used;
6. that subsequent system security assessments are conducted on a regular basis; and
7. that the Steward is immediately notified if it is determined that the security of the Sensitive Information may have been compromised.

As a Unit Head, you are responsible for ensuring:

1. that members of your unit are aware of and maintain compliance with these policies where applicable, fulfill their responsibilities as Steward, Custodian or User, and have signed confidentiality agreements where required by the Steward;
2. that you have approved appropriate access only for those members of the Unit who require such access to fulfill their role in the Unit;
3. that when an individual (staff, faculty, contractors, etc.) leaves the Unit, or her or his role changes, this is communicated to Information Custodians where appropriate and without delay;
4. that all desktop, laptop or server computers which are used to collect, store or access the Sensitive Information are installed and maintained in accordance with the Network and Systems Security Policy and with the Sensitive Information Protection Standard.
5. that any new system or application which will be used to collect, manage or provide access to the Sensitive Information has undergone a system security assessment prior to being used;
6. that any visitors, suppliers, contractors, or collaborators who will require or have access to the Sensitive Information are made aware of this Policy and that they are subject to it; and
7. that a secure means of information erasure or destruction is used prior to disposing of or donating any IT Resource in the Unit which contains or which at one time did contain Sensitive Information.

As an Information User, you are responsible for ensuring:

1. that you access only the Sensitive Information you are authorized to use, and only for the academic or administrative purpose for which that Sensitive Information is intended;
2. that you not disclose any portion of the Sensitive Information to another person not authorized to receive it;
3. that you not disclose your user account and password (or similar authentication credentials) which you use to access Sensitive Information;
4. that you notify your Unit Head immediately if the security or privacy of some or all of the Sensitive Information you use, or that is in your care or control, may have been compromised;
5. that you maintain the personal computer or device which you use to store or access the Sensitive Information in accordance with Queen's University's Information Security Guidelines and Standards;
6. that any Sensitive Information being transported on a portable computer or device, or sent to others electronically, be encrypted in accordance with the Sensitive Information Protection Standard and with the Electronic Information Security Guidelines.

Contact Officer: Information Systems Security Manager - ITServices

Related Policies, Procedures and Guidelines:  Acceptable Use of Information Technology Resources Policy, Network and Systems Security Policy, Associated Standards, Procedures and Guidelines