Information Classification Policy

This policy establishes a standardized framework for classifying and protecting information assets at Bethune-Cookman University. By implementing consistent classification practices, the University ensures the confidentiality, integrity, and availability of its data while meeting regulatory compliance obligations and supporting informed decision-making across all academic and administrative functions.

This policy applies to:

• All faculty, staff, students, contractors, volunteers, and other individuals with access to University-owned data

• All information assets created, collected, processed, stored, or transmitted by or on behalf of the University

• All systems, applications, and devices used to access, store, or process University information

• All physical and electronic formats of information, including paper documents, electronic files, databases, and verbal communications

This policy does not apply to personal data that individuals maintain exclusively for personal use and that is not related to University business or operations.

• Availability: The property that information and systems are accessible and usable upon demand by authorized users.

• Classification: The process of categorizing information based on its sensitivity, value, and the potential impact of unauthorized disclosure, modification, or destruction.

• Confidentiality: The property that information is not disclosed to unauthorized individuals, entities, or processes.

• Controlled Unclassified Information (CUI): Information that requires safeguarding or controls for dissemination but is not classified as government-classified information under Executive Order 13526 or the Atomic Energy Act.

• Data Owner: The individual or department with primary responsibility for the creation, collection, and management of a specific data set. Data owners determine the appropriate classification level and authorize access to the data.

• Data Steward: An individual designated by a data owner to manage day-to-day data handling, including implementing access controls, monitoring usage, and ensuring data quality within their functional area.

• FERPA (Family Educational Rights and Privacy Act): Federal law that protects the privacy of student education records and gives parents and eligible students certain rights regarding those records.

• GLBA (Gramm-Leach-Bliley Act): Federal law that requires financial institutions to explain their information-sharing practices and to safeguard sensitive customer data.

• HIPAA (Health Insurance Portability and Accountability Act): Federal law that establishes national standards for protecting sensitive patient health information from disclosure without patient consent or knowledge.

• Information Assets: Any data or information that has value to the University, regardless of format or medium, including electronic data, paper documents, intellectual property, and verbal communications.

• Integrity: The property that information has not been altered or destroyed in an unauthorized manner.

• Non-Disclosure Agreement (NDA): A legally binding contract establishing a confidential relationship between parties regarding information shared between them.

• Personally Identifiable Information (PII): As defined by the United States Government Accountability Office, any information about an individual that can be used to distinguish or trace an individual's identity (such as name, Social Security Number, date and place of birth, mother's maiden name, or biometric records) or any other information that is linked or linkable to an individual (such as medical, educational, financial, and employment information).

• Protected Health Information (PHI): As defined by the U.S. Department of Health and Human Services, all individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral.

• Third-Party Data: Information belonging to or pertaining to another organization that has been entrusted to the University under contract, non-disclosure agreement, or other legal arrangement.

Associate Vice President for Information Technology and Chief Information Officer The CIO is responsible for this policy and serves as the executive sponsor for information classification initiatives. The CIO approves classification standards and ensures alignment with the University's strategic priorities and regulatory requirements.

IT Security Team IT Security develops and maintains classification guidelines, provides training and awareness programs, conducts periodic audits of classification practices, evaluates access requests for restricted data, and investigates potential policy violations.

Data Owners Data owners are responsible for determining the appropriate classification level for information under their purview, authorizing access to classified data, periodically reviewing access permissions, and ensuring that data-handling practices comply with this policy.

Data Stewards Data stewards implement data-handling procedures as directed by data owners, maintain accurate records of data access and use, report potential security incidents or policy violations, and provide guidance to users on proper data handling within their functional areas.

All University Constituents All individuals with access to University data must handle information in accordance with its assigned classification level, complete required training on data classification and handling, report suspected security incidents or policy violations, and request clarification when classification requirements are unclear.

Classification Categories

Information Technology personnel will work with data owners to ensure all University information assets are identified as belonging to one of the following five classification categories. Each category carries specific handling, storage, transmission, and disposal requirements.

Public

• Information that has been declared public knowledge by someone with the authority to do so can be freely given to anyone without any possible damage to the University or to any individual. Disclosure of public information should be expected to have no adverse effect on University operations, assets, or individuals. Examples: Press releases, course catalogs, publicly posted event information, published research with no restrictions, and general University contact information.

Internal

• Information intended primarily for employees of the University, including personnel information, descriptions of work processes, information technology policies and standards, and similar operational content. Internal information shall be limited to internal distribution. The unauthorized disclosure of internal information could be expected to have a limited adverse effect on University operations, assets, or individuals. Examples: Internal memos, departmental procedures, meeting minutes, organizational charts, non-sensitive operational reports.

Sensitive

• Sensitive information includes, but is not limited to, Personally Identifiable Information (PII), Family Educational Rights and Privacy Act (FERPA) protected information, and other personal information that could undermine individual integrity. This category also includes Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). The unauthorized disclosure of sensitive information could be expected to have a serious adverse effect on University operations, assets, or individuals. Examples: Student records, employee personnel files, financial aid information, medical records, Social Security Numbers, grades, and academic performance data.

Confidential

• Confidential information includes information that must be protected to ensure the security of University constituents and resources. Confidential information may include data pertaining to University operations, infrastructure (utilities and services), records of legal proceedings, and data protected as evidence. The unauthorized disclosure of confidential information could be expected to have a severe or catastrophic adverse effect on University operations, assets, or individuals. Examples: Security system configurations, network architecture details, legal case files, investigation records, strategic financial planning documents, system passwords, and access credentials. Information belonging to or pertaining to another organization that has been entrusted to the University under a non-disclosure agreement or contract may be categorized as "Third-Party Sensitive" or "Third-Party Confidential" as appropriate.

Controlled Unclassified Information (CUI)

• Controlled Unclassified Information is information that requires safeguarding or controls for dissemination but is not deemed as classified government information (reference: Executive Order 13526 and the Atomic Energy Act). Bethune-Cookman University constituents are often engaged in research projects that involve U.S. Government agencies or contractors working with U.S. Government systems and data. As a result, CUI may be present within certain information systems.

  • CUI Marking Requirements:

    • Per the document "Marking Controlled Unclassified Information," Version 1.1, CUI data must have appropriate markings:

      • The primary marking for all CUI is the CUI Banner Marking, which appears at the top of each page of any document that contains CUI. This marking is mandatory.

      • The content of the CUI Banner Marking must be inclusive of all CUI within the document and must be the same on each page.

      • The Banner Marking should appear as bold, capitalized, black text and be centered when feasible.

      • The CUI Banner Marking may include up to three elements: the CUI Control Marking (mandatory, consisting of either "CONTROLLED" or "CUI"), CUI Category or Subcategory Markings (mandatory for CUI Specified, separated from the Control Marking by a double forward slash), and Limited Dissemination Control Markings (preceded by a double forward slash).

  • CUI System Requirements:

    • Dedicated systems must be used to store, process, and interact with data at this classification level. The use of shared systems (systems used to store, process, and interact with data at other classification levels) is not permitted. Any such work must be conducted on-campus within an area that provides adequate physical security. If off-campus access is required, researchers must submit a request to Information Technology for evaluation by the IT Security team, which will assess the risk and, if possible, provide access via a remote access VPN with multi-factor authentication.

Classification Modification

Additional information classification categories may be defined and used at the University's discretion; however, the aforementioned categories shall not be modified nor used in a manner that reduces the required protections defined by this policy.

Step 1: Identify Information Assets

Data owners identify all information assets within their area of responsibility, including electronic files, databases, paper documents, and any other forms of information.

Step 2: Assess Sensitivity and Impact

For each information asset, data owners assess the potential impact of unauthorized disclosure, modification, or destruction using the criteria defined in Section 5.1.

Step 3: Assign Classification Level

Based on the impact assessment, data owners assign the appropriate classification level. When information could fall into multiple categories, the highest applicable classification level applies.

Step 4: Document Classification

Data owners document the classification of each information asset and record this in the departmental data inventory. Documentation should include the data type, classification level, data owner, authorized users, and review date.

Step 5: Implement Controls

Data owners work with IT Security and data stewards to implement appropriate technical and administrative controls based on the classification level.

Step 6: Communicate Classification

Data owners ensure that all authorized users understand the classification of the data they access and their responsibilities for protecting it.

Step 7: Periodic Review

Data owners review classifications at least annually or when significant changes occur to ensure they remain appropriate. Reviews should consider regulatory changes, business needs, and any incidents that may affect classification.

Enforcement

Users who violate this policy may be denied access to University computing resources and may be subject to disciplinary actions and/or criminal and civil penalties. Violations will normally be handled through the University's disciplinary procedures applicable to the user and may include referring suspected violations of applicable law to appropriate law enforcement agencies.

Immediate Action Authority

The University may immediately suspend or block access to an account, prior to the initiation or completion of disciplinary procedures, when it appears necessary to protect the confidentiality, integrity, availability, or functionality of University or other computing resources.

Sanctions

Violations of this policy may result in disciplinary action up to and including termination for employees, expulsion for students, and termination of contracts for vendors and contractors. Criminal violations may be referred to law enforcement authorities.