Information Security Policy
Initially Approved: June 24, 2013
Revised and approved: April 25, 2016
Revised and approved: March 24, 2020
Policy Topic: Information Security
Administering Office: Office of CIO
I. POLICY STATEMENT
Information security is the ongoing process of exercising due care and due diligence
to protect the confidentiality, integrity and availability of information and information
technology resources. Institutional information is both a valuable asset and a potential
liability to the University. As such, the stewardship and security of institutional
information are important responsibilities for every member of Western Carolina University
(hereinafter “University” or “WCU”) that has access to it. As an academic institution
we must encourage the free flow of most information, while protecting critical institutional
The purpose of this policy is to:
- Define information security, its overall objectives and scope and the importance of
security as an enabling mechanism for institutional information sharing;
- State the commitment of University leadership to support the goals and principles
of information security;
- Provide a framework for referencing supporting security policies and standards; and
- Define who is responsible for ensuring that institutional information is handled in
an appropriate manner and the procedures for reporting information security incidents.
II. SCOPE AND APPLICATION OF THE POLICY
- This policy applies to any person having responsibility for institutional information
and any person making use of the University’s information technology resources, whether
located on or off-campus, whether University-owned or contracted for use by the University.
- The Policy is an overarching information security policy that refers to a group of
more specific related University policies and information security standards.
- The term “Information Security” shall mean thepreservation of confidentiality, integrity and availability of information;
in addition, other properties, such as authenticity, accountability, non-repudiation,
and reliability can also be involved.
- The term “Standards” shall mean mandatory actions or rules that give this policy support and reinforcement
- The term “Information Technology Resource” shall mean any system, media or software used to transmit, store or process information
- The term “Institutional Information”shall meaninformation generated, collected, maintained and/or owned by the University
regardless of format.
- The term “ISO 27002” shall meanan information security standard published by the International Organization
for Standardization (ISO) and by the International Electrotechnical Commission (IEC),
entitled Information technology - Security techniques - Code of practice for information security
- The term “Information Owner”shall mean the individual or department that makes decisions regarding how to define,
process and handle institutional information.
- The term “Workforce Member” includes, but is not limited to, faculty, staff, employees, guests, consultants,
vendors, volunteers, interns, student workers or temporary workers associated with
IV. UNIVERSITY COMMITMENT
The following is an excerpt from the WCU Board of Trustees resolution adopted December
WHEREAS, The University of North Carolina Information Technology Security Council
recommended, and the University of North Carolina Chief Information Officers Council
has approved, the adoption of ISO/IEC 27002 Information Technology – Security Techniques
– Code of practice for information security management (the “ISO Standards”)as the
common security framework to be used by the University and other University of North
Carolina constituent institutions in the development of information technology security
WHEREAS, the ISO Standards provide a comprehensive and systematic approach to ensure
that appropriate information technology security controls are in place as well as
flexibility to meet the specific needs of the constituent institutions; and
BE IT RESOLVED, that this Board of Trustees hereby approves the adoption of the ISO
Standards as the security framework for the University.
V. SECURITY POLICY FRAMEWORK
The University of North Carolina and WCU have adopted ISO 27002 as the framework
for university information security policy. This policy is the umbrella University
information security policy that will refer to existing and future policies and standards
that support it. Related university policies will reference security control numbers
from the ISO 27002 framework. Information security standards related to this policy
will also utilize the ISO 27002 control numbering scheme.
- The Chancellor, Provost, Vice Chancellors, General Counsel, the CIO, the Chief of
Staff and the Director of Athletics are responsible for ensuring the appropriate handling
of the institutional information produced and managed by their division/unit. These
positions are the institutional Data Stewards.
- The Information Technology Division is responsible for ensuring that the appropriate
technologies and system policies and permissions are in place to ensure appropriate
access to electronic data.
- The Chancellor has established a Data Security and Stewardship Committee, which reports
to the Chancellor. The charge of this Committee is to oversee the implementation of
this policy, ensure procedures are up to date, coordinate all relevant security policy
and standards reviews, and assist offices with risk assessments, etc.
- Department managers are responsible for all general and regulatory information security
training of workforce members, and for enforcing information security policies and
- All workforce members are responsible for reporting information security incidents
and assisting the Information Security Incident Response Team in investigating and
mitigating computer security incidents.
All workforce members are:
Responsible for protecting any institutional information and systems that they access,
process or handle;
Responsible for the consequences of their decisions and actions associated with institutional
information access and processing; and
Responsible for discussing and reporting any suspicious or harmful behavior and activity
to the IT Division and the owner of the institutional information, if known.
International Standards Organization (ISO/IEC 27002, 5.1.1)
University Policy 52, “Responsible Use of Information Technology Resources”
University Policy 97, “Data Security and Stewardship"
University Policy 106, “Protecting the Privacy and Security of PII”
Information Security Standards