Information Security Management and Compliance
Records Management Standard
- References: CSU Records Access Manual
- CSU Subpoena Handbook
- CSU Executive Order 1031, Systemwide Records/Information Retention Schedules
- Government Code Section 6250-6270
- Fair and Accurate Credit Transactions Act of 2003 (FACTA); FCRA, 15 U.S.C. 1681 et seq.
- California Civil Code §1798.81
- Issue Date: September 2008
- Revision Date: April 2009
- Expiration Date: N/A
Attachment A
Information Classification
The CSU classification level identifies the following records and their classifications.
Level 1: Confidential
Information includes but is not limited to:
Personal Information
Passwords or credentials
- Notice-triggering Personal Information
- Biometric Information
- Electronic or digitized signatures
- Private Key (digital certificate)
- Psychological counsel records
- Forms of national or international identification (such as passports, visas, etc.), in combination with name
Cardholder Data
Medical Information
Health Insurance Information
Financial Information
Protected Health Information
Technical Security Information
- Vulnerability/security information related to campus systems or services
Law Enforcement Information
- Law enforcement records related to an individual
Library Patron Information
- Library database for faculty, staff, students and community borrowers which may contain:
- Home Address
- Home Phone
- Social Security Numbers
Legal Information
- Legal investigations conducted by the University
- Attorney/Client communications
Contract Information
- Sealed bids
- Third party proprietary information per contractual agreement
Level 2: Internal Use
Information includes, but is not limited to:
Identity Validation Keys
- Birth date (full: mm-dd-yy)
- Birth date (partial: mm-dd only)
Student/Alumni Information
- Educational records (excludes directory information)
- Grades
- Courses taken
- Schedule
- Test Scores
- Advising records
- Educational services received
- Disciplinary actions
Employee Information
- Net salary
- Employment history
- Home address
- Personal telephone numbers
- Personal email address
- Parents and other family members names
- Payment history
- Performance evaluations
- Background investigations
- Mother’s maiden name
- Biometric information
- Electronic or digitized signatures
- Birthplace (City, State, country)
- Race and Ethnicity
- Gender
- Marital Status
- Physical description
- Photograph
Alumni Information
- Same as Employee Information
Job Applicant Information
- Same as Employee Information
University Donor Information
- Same as Employee Information
University Research
- Trade secrets or intellectual property
Library Patron Information
- Information which links a library patron with a specific subject the patron has accessed or requested
Other
- Location of critical or protected assets
- Licensed software
Level 3: Public
Information includes, but is not limited to:
Campus Identification Keys
- Campus identification number
- User ID (do not list in a public or an aggregate list when it is not the same as the student email address)
Student Information
Educational directory Information (FERPA)
- Name
- Major field of study
- Grade level
- Enrollment status
- Dates of attendance
- Degrees, honors and awards received
- E-mail address
- Home or mailing address
- Personal telephone numbers
Note: The University may disclose the above information without prior written consent, unless the student has requested that certain information not be released (non-disclosure).
Addresses and telephone numbers for currently enrolled students will be released to CSULB personnel and units solely for the purpose of conducting legitimate University business. They may not be shared with individuals or organizations outside the University except in accordance with the provisions immediately below:
Addresses and telephone numbers may be released for non-commercial use by individuals or organizations outside the University provided the request for such information has been reviewed and approved by the appropriate University personnel. Requests from the academic offices of accredited educational institutions shall be reviewed by the Provost and Senior Vice President for Academic Affairs or designee. All other requests shall be reviewed by the Vice President for Student Services or designee.
In addition to the above, the Director of Athletics may provide information concerning participation of students in athletic events including the height and weight of athletes.
Employee Information (including student employees)
- Title
- Status as a student employee (such as TA, GA, ISA)
- Campus e-mail address
- Work location and telephone number
- Employing department
- Position classification
- Gross salary
- Name (first, middle, last)(except when associated with confidential information)
- Signature