Information Security Policy
Initially Approved: June 24, 2013
Revised and approved: April 25, 2016
Policy Topic: Information Security
Administering Office: Office of CIO
I. POLICY STATEMENT
Information security is the ongoing process of exercising due care and due diligence
to protect information, and information systems, from unauthorized access, use, disclosure,
destruction, modification, disruption or distribution regardless of the form the data
may take (electronic, paper, etc...).
Institutional information is both a valuable asset and a potential liability to the
University. As such, the stewardship and security of institutional information are
important responsibilities for every member of Western Carolina University (hereinafter
“University” or “WCU”) that has access to it. As an academic institution we must encourage
the free flow of most information, while protecting critical institutional information.
The purpose of this policy is to:
- Define information security, its overall objectives and scope and the importance of
security as an enabling mechanism for institutional information sharing;
- State the commitment of University leadership to support the goals and principles
of information security;
- Provide a framework for referencing supporting security policies; and
- Define who is responsible for ensuring that institutional information is handled in
an appropriate manner and the procedures for reporting information security incidents.
II. SCOPE AND APPLICATION OF THE POLICY
- This policy applies to all University workforce members and any other person utilizing
any form of University information technology, or having responsibility for institutional
information stored in an alternate format, such as paper.
- The Policy is an overarching information security policy that refers to a group of
more specific related Information Security policies.
- Information Security – preservation of confidentiality, integrity and availability
of information; in addition, other properties, such as authenticity, accountability,
non-repudiation, and reliability can also be involved.
- Institutional Information – Information generated, collected, maintained and/or owned
by the University regardless of format.
- ISO 27002 -an information security standard published by the International Organization
for Standardization (ISO) and by the International Electrotechnical Commission (IEC),
entitled Information technology - Security techniques - Code of practice for information security
- Information Owner – The individual or department that makes decisions regarding how
to define, process and handle institutional information.
- Workforce Member – includes, but is not limited to, faculty, staff, employees, guests,
consultants, vendors, volunteers, interns, student workers or temporary workers associated
with the University.
IV. UNIVERSITY COMMITMENT
The following is an excerpt from the WCU Board of Trustees resolution adopted December
WHEREAS, The University of North Carolina Information Technology Security Council
recommended, and the University of North Carolina Chief Information Officers Council
has approved, the adoption of ISO/IEC 27002 Information Technology – Security Techniques – Code of practice for information security
management (the “ISO Standards”)as the common security framework to be used by the University
and other University of North Carolina constituent institutions in the development
of information technology security policies; and
WHEREAS, the ISO Standards provide a comprehensive and systematic approach to ensure
that appropriate information technology security controls are in place as well as
flexibility to meet the specific needs of the constituent institutions; and
BE IT RESOLVED, that this Board of Trustees hereby approves the adoption of the ISO
Standards as the security framework for the University.
V. SECURITY POLICY FRAMEWORK
The University of North Carolina and WCU have adopted the ISO 27002 security standard
as the framework for university information security policy. As the University’s IT
Division and Data Security and Stewardship Committee policies existed prior to adopting
this standard there are various policy numbering and naming schemes in use. This policy
is the umbrella University information security policy that will refer to existing
and future policies and standards that support it. Existing university policies will
reference security category numbers from the ISO 27002 framework. Other existing IT
security policies and future IT security policies will utilize the ISO 27002 policy
- The Chancellor, Provost, Vice Chancellors, General Counsel, the CIO, the Chief of
Staff and the Director of Athletics are responsible for ensuring the appropriate handling
of the institutional information produced and managed by their division/unit. These
positions are the institutional Data Stewards.
- The Information Technology Division is responsible for ensuring that the appropriate
technologies and system policies and permissions are in place to ensure appropriate
access to electronic data.
- The Chancellor has established a Data Security and Stewardship Committee, which reports
to the Chancellor. The charge of this Committee is to oversee the implementation of
this policy, ensure procedures are up to date, coordinate all relevant security policy
reviews, and assist offices with risk assessments, etc.
- Department managers are responsible for all general and regulatory information security
training of workforce members, and for enforcing computer and data security policies.
- All workforce members are responsible for reporting computer security incidents and
assisting the Computer Security Incident Response Team in investigating and mitigating
computer security incidents.
All workforce members are:
- Responsible for protecting any institutional information and systems that they access,
process or handle;
- Responsible for the consequences of their decisions and actions associated with institutional
information access and processing; and
- Responsible for discussing and reporting any suspicious or harmful behavior and activity
to the IT Division and the owner of the institutional information, if known.
International Standards Organization (ISO/IEC 27002, 5.1.1)
University Policy 97, “Data Security and Stewardship"
University Policy 106, “Identity Theft Prevention Program”