Electronic Data and System Risk Classification Policy

Statement of Policy

New York University is committed to safeguarding the privacy of its students, alumni, faculty, and staff, as well as protecting the confidentiality, integrity, and availability of information and systems that are important to the University’s mission. This policy is the authoritative source of information on data and systems risk classification at NYU.

Purpose of this Policy

This policy provides a framework for safeguarding NYU’s information assets, i.e., its information technology systems and the data in its possession. NYU has classified its information assets into risk-based categories for the purpose of determining who is allowed to access and use those assets and what security measures must be taken to safeguard those assets against unauthorized access or breach of confidentiality, integrity, or availability. This policy should be read in conjunction with the Data and System Security Policy, which sets forth the specific security measures that apply to each data and system classification.

This policy establishes the following risk classifications for NYU data: Low Risk, Moderate Risk, and High Risk; and the following criticality classifications for NYU systems: Low Criticality, Moderate Criticality, and High Criticality. The classifications help to identify the level of safeguarding required for any specific type of data or system. While all data and systems must be safeguarded, more stringent measures are required as the level of risk or criticality increases.

Scope of this Policy

The data and systems referred to in this policy must be properly safeguarded regardless of the location of the specific data and the systems on which they can be found. This risk classification, therefore, is applicable to a wide variety of IT resources which are connected to NYU-NET or are used for any NYU business purpose, including personally owned devices. A “system” is defined as any IT resource to which security safeguards may be applied.

Examples of systems include, but are not limited to:

1. Desktop, laptop, or server computers running general purpose operating systems such as Windows, Mac OS, Unix/Linux, and mobile applications
2. Network server applications, such as an SFTP-server application
3. Applications and web applications, such as student information systems, HR systems, learning management systems, websites, CMS, and wikis among others
4. Databases, Data Warehouse, APIs, and other data exchange systems (such as Box, Dropbox, Drive, OneDrive)
5. Mobile devices, such as tablets, smartphones, and IoT devices where data can be stored
6. Authentication and authorization systems such as SSO, Active Directory, and LDAP, among others

All of the above systems may perform their own authentication and authorization, logging and auditing, and have their own configurations which must be managed, and each of them is considered a compliance object to be safeguarded.

A system may be classified at a higher criticality than is required by the classification below. If so, the system must meet the security measures for that higher criticality level.

To Whom this Policy Applies

Those responsible for classifying data and system risk may be individual system owners, system administrators, project managers, or data stewards/trustees. The entire NYU community (faculty, staff, students, contractors/consultants, alumni, vendors, and guests) who access University data and systems must consider how they are protecting University data and systems. Therefore, all must be aware of the sensitivity of the data they access and the adverse consequences  if that data is not properly protected.

Procedures for Implementation

Data Risk Classification

Three levels of data risk classification are outlined below which are based on the impact of an unauthorized access, disclosure or alteration of the data in question to individual community members and/or to NYU as an institution.

Risk classification of data takes into account the:

• inherent attributes of the data,
• source of the data,
• regulation or policy governing the data, and
• relationship of the data to previously disclosed data.

The classification of specific data is subject to change as the attributes of that data change (e.g., its elements, content, uses, importance, method of transmission, or regulatory context).

The data classifications are listed below with examples provided in the following section. The following rules should be applied when classifying data:

• When a data element falls into more than one category, it should be classified in the highest applicable risk category. For example, if a data element meets the definition for both Moderate Risk and High Risk data, it should be classified as High Risk.
• When a data set includes more than one data element, the data set should be classified based on the highest applicable risk category. For example, if a database contains both Low Risk and Moderate Risk data, the database should be classified as Moderate Risk.
• Data may be classified at a higher risk than is required by the classifications below; if that is the case, the data element must meet the security measures for the higher classification level.

An “adverse impact” means (i) with respect to an individual, that the security or privacy of the data has been compromised with a probable increase in risk, and (ii) with respect to NYU, that the financial, legal, operational, and/or reputational risk is increased up to and including severe repercussions.

Data Risk Examples

The following examples are intended to assist with determining which risk classification is appropriate for a particular type of data and are not meant to be an exclusive list of data that falls into each classification.

Note regarding Research Data: (1) Protected Data Related to Research - Research data which is guided by federal regulation or sponsor requirements:  Depending on the subject matter and the data accessed, generated, and/or shared, there may be more stringent requirements, from the sponsor, the U.S. federal government, foreign governments, e.g., EU GDPR. Therefore, the data owner is advised to check with the OSP or the IRB (for human subject research). (2) Except for regulated data such as Protected Health Information (PHI), Social Security Numbers (SSNs), Controlled Unclassified Information (CUI), financial account numbers, and other protected data related to research and systems serving as repositories for these data types, research data predominately falls into the Low Risk classification. Review the classification definitions and examples below to determine the appropriate risk level to apply.

System Criticality Classification

System Criticality is determined according to the following classifications. The following rules are taken into account when classifying systems:

• When a system falls into more than one category, it should be classified in the highest applicable criticality category.  For example, if an application meets the definition for both Moderate Criticality and High Criticality, it should be classified as High Criticality.
• When a system includes more than one resource, the system should be classified based on the highest applicable criticality category. For example, if a system includes both Low Criticality and Moderate Criticality applications, it should be classified as a Moderate Criticality system.

System Criticality Examples

The following examples are intended to assist with determining which classification is appropriate for a particular type of system and are not meant to be an exclusive list of systems falling into each classification.

Depending on the Classification Levels determined for Data and Systems, procedures for securing systems are outlined in:

• Data and System Security Policy

Related Policies:

• Policy on Responsible Use of NYU Computers and Data
• Administrative Data Management Policy
• Personally Identifiable Information Policy (NOT YET FINALIZED)
• Payment Card Industry Data Security Standard

Notes:

1. Dates of official enactment and amendments:
   • Data Classification Table: Issued 06/19/07
   • Data Classification Table: Officially Enacted 02/10/12
   • Data Classification Table reviewed and updated. The Table and the Reference for Data and System Classification were integrated and expanded into the Electronic Data and System Risk Classification Policy: 11/06/18
   • Removed outdated policy designations: 6/1/20
2. History:
   • The original Data Classification Table was created by NYU ITS Technology Security and adopted by the Data Protection Risk Analysis Project Team.
3. For questions or comments, including from global locations, regarding the contents of this policy, please contact security@nyu.edu

Appendix A: Special Data Types

• Credit Card numbers and other cardholder information are subject to specific industry standards and additional controls and, thus, must be handled appropriately. See NYU’s Payment Card Industry Data Security Standard.
  
• Other data covered by Export Controls are subject to additional rules on distribution, in particular sharing with non-U.S. persons. See NYU’s Export Control Regulation information.
• FERPA refers to the Family Educational Rights and Privacy Act of 1974 enacted, among other purposes, to protect the privacy of students' education records. The “education records” are defined as those records, files, documents, and other materials that contain information directly related to a student and that are maintained by the University or by a third party acting for the university. The form in which the information is maintained by the University does not matter.  For example, computerized or electronic files, audio or video tape, photographic images, film, with such information are "education records". This includes communications and documents distributed or received by email, or other similar University systems, which are retained in these systems, either by the sending or receiving party. See NYU’s FERPA guidelines.
• GDPR refers to The EU General Data Protection Regulation (Regulation (EU) 2016/679). See NYU’s GDPR website.
  • Personal Data (GDPR) – This includes any information relating to an identified or identifiable natural (i.e., living) person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number (e.g., tax ID, NYU NetID and University/N number), location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of such natural person.
  • Sensitive Personal Data (GDPR) – This means the following categories of Personal Data that are subject to heightened protection under GDPR: (a) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; (b) relating to the inherited or acquired genetic characteristics of a natural person which gives unique information about the physiology or health of such person and which results, in particular, from an analysis of a biological sample from the person in question ("Genetic Data"); (c) resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allows or confirms the unique identification of such person, such as facial images or fingerprint data ("Biometric Data"); (d) relating to the physical or mental health of a natural person (including the provision of health care services) which reveals information about such person's health status; (e) concerning a natural person's sex life or sexual orientation; (f) consisting of or revealing identification numbers or other information specially protected by Applicable Data Protection Requirements (e.g., national identification numbers); and (g) relating to criminal convictions and offences.
• GLBA refers to the Gramm-Leach-Bliley Act, short form for the Financial Modernization Act of 1999, an act of Congress. Its main purpose is to promote financial integration and develop a regulatory framework for financial institutions which deal with non-public financial information, such as financial aid, Bursar activities, faculty housing finances, and donations to the university. This financial information can be provided by the consumer, initiated by NYU, or received from another financial institution. See NYU’s GLBA Information Security Program.
• HIPAA refers to the Health Insurance Portability and Accountability Act, complex legislation and various Rules signed into law in 1996 and updated over the years requiring safeguarding individual identifiable healthcare information, especially for privacy and security. EPHI is Electronic Protected Health Information that NYU creates, receives, maintains, and/or transmits electronically. It can exist outside a computer, such as on clinical equipment, storage media, tapes, DVDs, and many other peripheral devices. See NYU’s HIPAA Security Policies.

Appendix B: Acronyms Defined

AD: refers to Active Directory, originally developed for Windows domain networks that manage permissions and access to a network directory of services.

API: refers to Application Programming Interface, a data exchange system that receives requests and sends back responses.

CMS: refers to a content management system, such as WordPress.

HR: refers to NYU’s Human Resources systems.

IoT: refers to the Internet of Things, an expanding system of interrelated physical mechanical and digital computing devices, with unique identifiers (i.e., an IP address for internet connectivity) and able to communicate and transfer data over a network between these objects and other Internet-enabled devices and systems without requiring human-to-human or human-to-computer interaction.

IP: means Internet Protocol, a unique address assigned to all computing devices on a network for interface and location identification in order for them to communicate with other computing devices on that network.

IRB: stands for Institutional Review Board, any of the administrative bodies established to protect the rights and welfare of human research subjects recruited as participants in research activities conducted under the auspices of NYU. For example, the NYU School of Medicine has several IRBs and the University Committee on Activities Involving Human Subjects (UCAIHS) serves as NYU's IRB for the Washington Square units of the University.

LDAP: stands for Lightweight Directory Access Protocol, a software procedure for enabling location of organizations, individuals, and other resources such as files and devices whether a public Internet or organizational intranet, and can communicate with Active Directory.

Linux: general purpose free and open source operating system used across a large number of hardware platforms and devices.

Mac OS: refers to the Macintosh general purpose operating system developed, marketed, and sold by Apple Inc. for personal computers.

OSP: refers to the NYU Office of Sponsored Programs which provides information, assistance, and support concerning the research and sponsored programs enterprise at NYU.

SFTP: stands for Secure File Transfer Protocol server application and is a secure version of File Transfer Protocol (FTP), which facilitates data access and data transfer over a Secure Shell (SSH) data stream.

SSO: stands for Single Sign-on solution, a property of access control to ensure that only authorized users get access to sensitive data.

Unix: general purpose proprietary, licensed operating system with research, academic, and even commercial uses and a powerful model of modular software design.

Windows: refers to a group of several graphical general purpose operating systems for personal computers, developed, marketed, and sold by Microsoft.