UIS.401.3 Data Handling Guidelines

In support of UIS 401 Data Protection and Security Policy

Data Classification

Data classification, in the context of information security, is the classification of data based on its level of sensitivity and the impact to the University should that data be disclosed, altered or destroyed without authorization. The classification of data helps determine what baseline security controls are appropriate for safeguarding that data. All University data are classified into one of three sensitivity levels, or classifications, low, moderate or high. Please refer to the table below to learn more about each category’s operational impact, examples of such data, and GU-approved methods of handling the data.

[printable data handling pdf (new window)

Risk Classification	Low The loss of its confidentiality, integrity, or availability would cause no harm to Georgetown’s mission, security, finances, or reputation.	Moderate The loss of its confidentiality, integrity, or availability could cause measurable harm to Georgetown’s mission, security, finances, or reputation.		High The loss of its confidentiality, integrity, or availability would cause significant harm to Georgetown’s mission, security, finances, or reputation.
Data Type	Public Information intended to be shared with the public. Information Georgetown has made available to the public.	Internal Information intended for Georgetown faculty, students, staff. Information Georgetown has designated as private.	Confidential Sensitive information intended for authorized individuals with explicit permission. Information Georgetown is obligated to make available only on a ‘need to know’ basis.	Restricted Sensitive information protected by strict security controls. Information Georgetown is obligated to make available only on a ‘need to know’ basis.	Regulated Information protected by specific controls dictated by law or external governance. Information Georgetown is obligated to keep protected from all unauthorized internal or external access.
Examples Ask UIS if you’re not sure. These are examples, not exhaustive lists.	Information in the public domain Publicly available campus data Faculty and staff appointments University marketing materials University directory information designated for public view	University and employee GUID numbers Non-public meeting notes Processes, procedures, systems instructions	Non-public contracts Georgetown University internal memos and email, non-public reports, budgets, plans, financial info, board documents Financial account numbers Donor agreements and agreements in progress	Unpublished research data Social Security Numbers Personally Identifiable Information; birth date, personal contact information; IDs/Passports/Driver Licenses Audit logs or records; infrastructure data Cyber Security Investigations	Protected Health Information (PHI) Controlled Unclassified Information (CUI) Student records; Student admission data Payment Card Information (PCI) No PCI data is to be transmitted through, processed or stored on GU networks
Printing	No data handling restriction	Do not leave unattended on copiers/printers			Send to printer using stored/locked job. Enter authorization code at printer
Network Storage	No data handling restriction	GU Google Drive GU Box GU GCP GU AWS		GU Box GU GCP GU AWS	GU Box GU GCP GU AWS Authorized external storage CUI and PHI require UIS authorization
Computer Storage	No data handling restriction	Device must meet UIS cyber security requirements for processing moderate-risk data. Data cannot be stored long-term on GU work or personal computer. GU external hard drives, managed by UIS are permitted with authorization		Device must meet UIS cyber security requirements for processing high-risk data. Data cannot be stored on GU work or personal computer. Data is to remain in managed and authorized storage system of record GU external hard drives, managed by UIS are permitted with authorization
Sharing/Collaboration	No data handling restriction	GU Email GU Box GU Google Workspace Apps GU Slack		GU Box
Transmitting	No data handling restriction	GU Email GU Box GU Google Workspace Apps		GU Box restricted link	GU Box restricted link Method authorized by UIS/data controller/owner
Online Meeting	No data handling restriction	GU Zoom GU Google Meet GU Teams		GU Zoom (with authorization)	Method authorized by UIS/data controller/owner
Survey/Polling	No data handling restriction	GU Qualtrics Survey Monkey Doodle		GU Qualtrics	Method authorized by UIS/data controller/owner
E-Signing	No data handling restriction	GU Docusign			GU Docusign Method authorized by UIS/data controller/owner
Deleting and Destroying	When assets are no longer in use for University business, are being repurposed, or can be disposed of in accordance with the University Data Retention Rules, low-risk data must be cleared from technology assets or 3rd-party systems.	When data is no longer in use for University business and can be disposed of in accordance with the University Data Retention Rules, moderate-risk data must be cleared: Cleared: A method of sanitization that applies programmatic, software-based techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques; typically applied through the standard read and write commands to the storage device, such as by rewriting with a new value or using a menu option to reset the device to the factory state. GU devices cannot be donated or disposed of without UIS data sanitization activities prior to disposal. 3rd-party access to moderate-risk data must include provisions to dispose of data upon service termination.		When data is no longer in use for University business and can be disposed of in accordance with the University Data Retention Rules, high-risk data must be purged or destroyed: Purge: A method of sanitization that applies physical or logical techniques that render high risk data recovery infeasible using state-of-the-art techniques. Destruction: A method of sanitization that renders high risk data recovery infeasible using state-of-the-art techniques and results in the subsequent inability to use the media or drive for storage of data. GU devices cannot be donated or disposed of without UIS data sanitization activities prior to disposal. 3rd-party access to high-risk data must include provisions to dispose of data upon service termination