Information Security Plan

College for Creative Studies (CCS) recognizes that in certain instances it must collect, store and use sensitive information relating to its students, employees and individuals associated with the College. The College is dedicated to collecting, handling, storing and using sensitive information properly and securely.

In addition to this policy, all faculty, staff, and students are required to adhere to the College’s Acceptable Use of Academic Technologies and Information Technologies Resources Policy.

Reason for Policy

This policy establishes an Information Security Plan to create administrative, technical and physical safeguards for the protection of sensitive information throughout the College. The purpose of this Plan is to comply with applicable laws and to:

  • Provide a framework for comprehensive stewardship of sensitive information;
  • Increase awareness of the confidential nature of sensitive information;
  • Eliminate unnecessary collection and use of sensitive information;
  • Protect against anticipated threats or hazards to the security or integrity of sensitive information; and
  • Protect against unauthorized access to or use of sensitive information in a manner that creates a substantial risk of identity theft, fraud or other misuses of the data.

College Roles Affected by Policy

Any member of the CCS community, including all faculty, staff and students, who has access to College records that contain sensitive information must comply with this policy.

Roles and Responsibilities

Every member of the College community should strive to minimize the collection, handling, storage and use of sensitive data. Only those who have a legitimate business need to access sensitive information should do so, and for as limited as time as possible. College Employees may request, collect, store or use sensitive information only as permitted by this policy, the Data Protection Requirements and practices required by his or her department.

Information Security Program Coordinator and Committee Roles

Director of Information Technology Services (Program Coordinator)

The College’s Director of Information Technology Services is designated as the Information Security Program Coordinator. The Program Coordinator, with the assistance of the Privacy and Security Committee (the “Committee”), is charged with the administration of this policy, including developing procedures concerning the review, oversight and governance of this policy, including any necessary training.

The Program Coordinator shall, in consultation with the Privacy and Security Committee, maintain a list of categories of information that will be included within the definition of sensitive information and prescribe appropriate levels of protection in a series of procedures collectively known as the Data Protection Standards. The Program Coordinator may consult with the Committee and charge the Committee with responsibilities concerning the administration and review of this policy.

The Program Coordinator shall provide a mechanism for reporting any suspected breach of security and shall respond to any reported breach of security as outlined below.

Privacy and Security Committee

The Program Coordinator shall convene a Privacy and Security Committee to assist with the administration of this policy and to help ensure compliance. In addition, the Committee will assist with the annual risk assessment and employee data security training. The Committee members are as follows:

  • Director of Information Technology Service
  • Vice President for Administration and Finance
  • Vice President for Enrollment and Student Services
  • Dean of Students
  • Associate Provost
  • Registrar
  • Director of Human Resources
  • Director of Business Services
  • Director of Financial Aid
  • Director of Graduate Admissions
  • Director of Undergraduate Admissions

Data Protection Standards

The Program Coordinator, in consultation with the Committee, shall identify categories of sensitive information and the appropriate safeguards required to protect each category. The Data Protection Standards shall specify administrative, technical and physical safeguards for the protection of sensitive information. The Committee may review and the Program Coordinator shall approve the Data Protection Standards.

Training

The Program Coordinator, along with the Privacy and Security Committee, will evaluate the effectiveness of the College’s procedures and practices relating to access to and use of student records, including financial aid information. This evaluation will include assessing the effectiveness of the College’s current policies and procedures in this area, including all handbooks (staff, faculty, and student), the CCS Policy Database and other student record policies).

Vendors and Service Providers

The Program Coordinator shall coordinate with those responsible for the third-party service procurement activities among the Information Technology Services and other affected departments to raise awareness of, and to institute methods for, selecting and retaining only those service providers that are capable of maintaining appropriate safeguards for nonpublic financial information of students and other third parties to which they will have access. In addition, the Program Coordinator will work with the Vice President of Administration and Finance and/or the Vice President for Enrollment and Student Services to develop and incorporate standard, contractual protections applicable to third-party service providers, which will require such providers to implement and maintain appropriate safeguards.

Program Review

At least annually the Program Coordinator, together with the Committee, shall review the Information Security Program and the Data Protection Standards. During the course of the review, the Program Coordinator and the Committee shall review any breach of security that is reported to outside authorities, including the results of any investigation and the College’s response to any breach. In addition, the Committee assesses compliance with the FTC Safeguard Rules.

Security Breach Response

The Program Coordinator shall review any suspected breach of security of sensitive information as specified in the Information Technology Incident Response and Testing Plan.

Data Owner

A Data Owner is an individual or group of people who have been officially designated as accountable for specific data that is transmitted, used, and stored on a system or systems within a department or an administrative unit of the College. CCS Data Owners are as follows:

DataOwner
Applicant, Inquiry, and Prospect DataDirectors of Undergraduate and Graduate Admissions
Donor Data, Alumni Employment DataVice President for Institutional Advancement
Human Resource DataDirector of Human Resources
Payroll, All Student Accounts, and Financial DataDirector of Business Services
Student Financial Aid DataDirector of Financial Aid
Student Housing, Judicial, Student Disabilities Records, and Wellness DataDean of Students
Student Immigration DataDirector of International Student Services
All Student RecordsRegistrar

The role of the data owners is to provide direct authority and control over the management and use of specific information. Responsibilities of a Data Owner include the following:

Data Users

All users have a critical role in the effort to protect and maintain College information systems and data. For the purpose of information security, a Data User is any employee, contractor or third-party provider of the College who is authorized to access College Information Systems and/or information assets. Responsibilities of data users include the following:

  • Adhere to policies, guidelines and procedures pertaining to the protection of information assets.
  • Report actual or suspected security and/or policy violations or breaches to the Director of Information Technology Services.

Data Classifications

College Data is information generated by or for, owned by, or otherwise in the possession of CCS that is related to the College’s activities. College Data may exist in any format (i.e. electronic, paper) and includes, but is not limited to, all academic, administrative, and research data, as well as the computing infrastructure and program code that supports the business of CCS.

In order to effectively secure College Data, we must have a vocabulary that we can use to describe the data and quantify the amount of protection required. This policy defines four categories into which all College Data can be divided:

Public

Public data is information that may be disclosed to any person regardless of their affiliation with the College. The Public classification is not limited to data that is of public interest or intended to be distributed to the public; the classification applies to data that do not require any level of protection from disclosure. While it may be necessary to protect original (source) documents from unauthorized modification, Public data may be shared with a broad audience both within and outside the College community and no steps need be taken to prevent its distribution.

Examples of Public Data
  • Press releases
  • Directory information as defined by the Family Educational Rights and Privacy Act (FERPA)
  • Course catalogs
  • Information a department would choose to post on its website
  • Other general information that is openly shared

Internal

Internal data is information that is potentially sensitive and is not intended to be shared with the public. Internal data generally should not be disclosed outside of the College without the permission of the person or group that created the data. It is the responsibility of the data owner to designate information as Internal where appropriate. If you have questions about whether information is internal or how to treat internal data, you should talk to your supervisor.

Examples of Internal Data
  • Some memos, correspondence, and meeting minutes
  • Contact lists that contain information that is not publicly available
  • Procedural documentation that should remain private

Confidential

Confidential data is information that, if made available to unauthorized parties, may adversely affect individuals or the business of CCS. This classification also includes data that the College is required to keep confidential, either by law (e.g., FERPA, GLBA, GDPR) or under a confidentiality agreement with a third party, such as a vendor. This information should be protected against unauthorized disclosure or modification.

Confidential data should be used only when necessary for business purposes and should be protected both when it is in use and when it is being stored or transported.

Any unauthorized disclosure or loss of confidential data must be immediately reported to the ITS Helpdesk (https://helpdesk.collegeforcreativestudies.edu, 313-664-7818) as well as the immediate supervisor or another available person in the chain of authority.

Examples of Confidential Data
  • Information covered by the Family Educational Rights and Privacy Act (FERPA), which requires protection of records for current and former students. This includes pictures of students kept for official purposes.
  • Personally identifiable information entrusted to our care that is not otherwise categorized as Restricted Use data, such as information regarding applicants, alumni, donors, potential donors, or parents of current or former students, and information covered by the European Union’s General Data Protection Regulation (GDPR).
  • The CCS ID Number, when stored with other identifiable information such as name or e-mail address.
  • Information covered by the Gramm-Leach-Bliley Act (GLBA), which requires protection of certain financial records.
  • Individual employment information, including salary, benefits and performance appraisals for current, former, and prospective employees.
  • Legally privileged information.
  • Information that is the subject of a confidentiality agreement.

Restricted

Restricted Use data includes any information that CCS has a contractual, legal, or regulatory obligation to safeguard in the most stringent manner. In some cases, unauthorized disclosure or loss of this data would require the College to notify the affected individual and state or federal authorities.

The College’s obligations will depend on the particular data and the relevant contract or laws. The End User Device Minimum Security Standards sets a baseline for all Restricted Use data.

Any unauthorized disclosure or loss of confidential data must be immediately reported to the ITS Helpdesk (https://helpdesk.collegeforcreativestudies.edu, 313-664-7818) as well as the immediate supervisor or another available person in the chain of authority.

Examples of Restricted Data
  • Personally identifiable health information that is not subject to HIPAA but used in research, such as Human Research Subjects.
  • Personally Identifiable Information (PII), including an individual’s name plus the individual’s Social Security Number, driver’s license number, or a financial account number.
  • Unencrypted data used to authenticate or authorize individuals to use electronic resources, such as passwords, keys, and other electronic tokens.
  • “Criminal Background Data” that might be collected as part of an application form or a background check.

More stringent requirements exist for some types of Restricted Use data. Individuals working with the following types of data must follow the College policies governing those types of data and consult with the Director of Information Technology Services to ensure they meet all of the requirements of their data type:

  • Protected Health Information (PHI) subject to the Health Insurance Portability and Accountability Act (HIPAA).
  • Financial account numbers covered by the Payment Card Industry Data Security Standard (PCI-DSS), which controls how credit card information is accepted, used, and stored.
  • Controlled Unclassified Information required to be compliant with NIST 800.171
  • Data controlled by U.S. Export Control Law such as the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR). ITAR and EAR have additional requirements.
  • U.S. Government Classified Data

Resolving Conflicts between this Guideline and Other Regulations

Some data may be subject to specific protection requirements under a contract or grant, or according to a law or regulation not described here. In those circumstances, the most restrictive protection requirements should apply. If you have questions, please contact a member of the Committee.

Data Classification and Protection Requirements

This Guideline provides the requirements for handling and protecting information at each stage of its lifecycle from creation to destruction and the minimum-security standards required for any electronic device that may be used to access or store sensitive information owned or used by CCS. The data handling protections outlined here apply to all sensitive information, both physical and electronic, throughout all of CCS.

Sensitive information is College data that is classified as Internal, Confidential, or Restricted Use. See the Data Classifications section for definitions and examples of each of these classifications.

Public (non-sensitive) information does not require any level of protection from disclosure but appropriate precautions should be taken to protect original (source) documents from unauthorized modification.

Information Lifecycle

The information lifecycle is the progression of stages or states in which a piece of information may exist between its original creation and final destruction. These phases are: collecting, accessing, sharing, sending, storing, auditing, incident reporting and destroying.

It is important to understand that Storing refers to a broad spectrum of activities including putting a file in a filing cabinet or on to a file server or entering information into a database or spreadsheet. The requirements for storing information apply equally to the source and to any copies made. For example, when a file is downloaded or copied from a file server to a laptop computer for use offline, it is stored in that new location and all of the storing requirements must be followed.

Requirements for Protection

Each classification of data has different requirements for protection throughout the lifecycle of use. The requirements for each Internal Data, Confidential Data, & Restricted Use Data are detailed below.

Internal Data

CollectingNo restrictions.
AccessingAccess should be provided as required for business devices used to access sensitive (non-Public) information. Such access must meet End User Device Minimum Standards.
SharingShare with employees as needed. Share with vendors/third-parties as approved by department head.
SendingPaperSend in a manner that protects the information from incidental or casual reading.
ElectronicUse a method that requires recipient to authenticate prior to receipt, such as email, a web site that requires Web Login, or a file server that requires a password. Use secure email service for more private data.
StoringPaperKeep in non-public areas when not in use.
ElectronicDevices used to store sensitive (non-Public) information must meet End User Device Minimum Standards.
Electronic Media (CD, DVD, USB, etc.)Store media in a non-public location when not in use.
AuditingALLConduct a periodic review of where this data is located, who has access to it, the access control mechanisms, encryption protocols, and data destruction protocols.
Incident ReportingALLReport the loss of any Internal Data to your supervisor who will determine the requirements, if any, for further reporting.
DestroyingALLReview Record Retention Policy before disposing of records.
Paper & Disposable Electronic Media (CDs, DVDs)For Internal documents with sensitive content, shred materials before disposing of them.
Electronic Files (Data) Reusable Electronic Storage Devices (USB keys, disk drives)Use standard operating system utilities to delete files.
All Electronic Storage Media at End of Life, including Disk DrivesContact Information Technology Service for secure destruction of all physical electronic media. Do not dispose of in the trash, recycle, etc.

Confidential Data

CollectingReduce or eliminate collection where not required for business function. Collection of some types of Confidential data about individuals may require the approval of the appropriate Data Owner(s).
AccessingAccess to some Confidential data requires approval of a Data Owner on a per-individual basis. See the list of the Data Owners above. Devices used to access sensitive (non-Public) information must meet EndUser Device Minimum Standards. Ensure protocols are in place to immediately remove access upon change in employment status of any individual with access.
SharingIf you are uncertain if a piece of Confidential information should be shared, escalate the request to an appropriate supervisor or Data Owner. For types of data that are governed by a Data Owner, this information may be shared only for business purposes and only as approved by the appropriate Data Owner except where the information is being given to approved custodians of that type of data. Information concerning a small number of individuals may be shared internally without Owner review if the recipient of the data has a need-to-know and is entrusted with the same type of information for their job function. Note: Non-disclosure language or a confidentiality agreement may be appropriate. For example:
* Grades need to be communicated to the Academic Advising and Registration Office
* Faculty may consult with other faculty about a student’s performance, as appropriate.
* Sharing information with vendors and third-parties requires Data Owner approval
For types of data that are not governed by a Data Owner, the information may be shared internally on a need-to-know basis. Information may be shared with the subject of the record or with another party with the subject’s approval, as appropriate.
Printing, Copying, and ScanningPrinting, Copying, and ScanningPrinters often store the printed document on a local hard drive, potentially allowing unauthorized access to the information. Avoid printing Confidential data unnecessarily.
SendingPaperAddress to the specific intended party and send in sealed security envelopes. Mark with “For intended recipient only”. Outside the College, paper should be sent via certified mail or with an authorized courier.
ElectronicParticularly sensitive data or large volumes of confidential data should be encrypted during transmission. Do not email confidential data – provide a secure link instead. If confidential information is to be stored on removable media (CD/DVD/USB/External HD) or in the cloud, see the section below regarding the proper storage.
FaxFax machines often store the faxed messages in memory, potentially allowing unauthorized access. Consider alternatives to faxing Confidential data where possible. If a fax must be used, consider taking reasonable steps to protect the data, including the use of a cover sheet stating that the fax is Confidential and to be read only by the named recipient. Also consider coordinating with the intended recipient so he or she is on hand to directly receive the fax before you begin to send.
Smart Phones and tablet devices (such as iPads)The use of smart phones to access Confidential data, such as through email, puts that data at higher risk of unintended disclosure Individuals accessing Confidential Data via such a device must comply with the standards set forth in End User Device Minimum Standards
StoringPaperShould be stored in physically secure areas that are accessible only by authorized individuals. The number of copies should be kept to a minimum.
ElectronicEncryption of stored data is recommended. Devices used to store Confidential Information must meet EndUser Device Minimum Standards. Cloud services may be used if they have been approved for this purpose by Information Technology Services.
Electronic Media (CD, DVD, USB, etc.)Encryption of stored data is recommended. Store media in a secure location when not in use. Media should be erased or destroyed as soon as it is no longer needed.
AuditingALLEach unit or department should conduct periodic reviews of where Confidential data is located, who has access to it, the access control mechanisms, encryption protocols, and data destruction protocols. Verify that procedures for removing access are documented and accurate.
Incident ReportingALLAny unauthorized disclosure or loss of Confidential data must be immediately reported to the ITS Helpdesk (https://helpdesk.collegeforcreativestudies.edu, 313-664-7818) as well as the immediate supervisor or other available person in chain of authority.
DestroyingALLReview Record Retention Policy and the information in this destruction section before disposing of records. Do not destroy records that are the subject of a litigation hold or that must be retained pursuant to the College record retention policy.
Paper & Disposable Electronic Media (CDs, DVDs)Dispose of paper media via College approved shred boxes. Contact Information Technology Service for secure destruction of all physical electronic media. Do not dispose of in the trash, recycle, etc.
Electronic Files (Data) Reusable Electronic Storage Devices (USB keys, disk drives)
All Electronic Storage Media at End of Life, including Disk Drives
Device End of Lease or End of Life (Printers, Copiers, Multi-function office machines)Devices such as these often contain hard drives which must be properly erased, or “wiped”, prior to leaving CCS control (returned to the vendor, sent to surplus, donated, disposed of, etc.). For information on how to properly wipe the drive, contact Information Technology Services.

Restricted Use Data

CollectingEliminate collection whenever possible. Collection of Restricted Use data about individuals must be approved by and provided to the appropriate Data Owner. See the list of the Data Owners above.
AccessingAccess to Restricted Use data requires approval of a Data Owner. Avoid accessing or using Restricted Use data whenever possible, and do so from as few different devices as possible. Devices used to access Restricted Use information must meet end user device minimum standards for Restricted Use information. The custodian of the system or information must immediately remove access from any person that no longer requires that access as part of their job function.
SharingIf you are uncertain if a piece of Restricted Use information should be shared, escalate the request to an appropriate supervisor or Data Owner. This information may be shared only for need-to-know business purposes and only as approved by the appropriate Data Owner, except where the information is being given to approved custodians of that type of data. Information concerning a small number of individuals may be shared internally without Owner review if the recipient of the data has a need-to-know and is entrusted with the same type of information for their job function. Note: Non-disclosure and other types of agreements (business associate agreements) may be necessary. Such agreements or agreement forms must be approved by the Vice President for Administration and Finance or the Vice President for Enrollment and Student Services. Sharing information with vendors and third-parties requires approval by the Vice President for Administration and Finance or the Vice President for Enrollment and Student Services and/or the Director of Information Technology Services.

Information may be shared with the subject of the record or with another party with the subject’s approval, as appropriate.
Printing, Copying, and ScanningPrinting, Copying, and ScanningPrinters often store the printed document on a local hard drive, potentially allowing unauthorized access to the information. Avoid printing Restricted Use data unnecessarily.
SendingPaperAddress to the specific intended party and send in sealed security envelopes. Mark with “For intended recipient only”. Outside the College, paper must be sent via certified mail or with an authorized courier.
ElectronicData is required to be encrypted during transmission. If Restricted Use data must be placed on removable media (CD/DVD/USB/External HD) or in the cloud, it must be properly protected. See the section below regarding proper storage. If Restricted Use data must not be sent via email – use a secure link instead. Compensating controls must be formally documented and an exception approved by Information Security where this is not technically possible.
FaxFax machines often store the faxed messages in memory, potentially allowing unauthorized access. Avoid faxing Restricted Use data where possible. If a fax must be used, include a cover sheet stating that the fax is Restricted Use and to be read only by the named recipient. Also, coordinate with the intended recipient so he or she is on hand to directly receive the fax before you begin to send.
Smart Phones and tablet devices (such as iPads)The use of smart phones to access Restricted Use data is strongly discouraged. For example, do not check your secure email from your smart phone. Individuals that must use such a device to access Restricted Use data must comply with the standards set forth in End User Device Minimum Standards.
StoringPaperKeep in locked filing cabinets in physically secure areas that are accessible only by authorized individuals. Keep the number of copies of the data to a minimum.
ElectronicEncryption of stored data is required. Devices used to store sensitive (non-Public) information must meet End User Device Minimum Standards. Cloud services may not be used to process or store Restricted Use data unless they have been approved for such use by Director of Information Technology Services and the appropriate Data Owner.
Electronic Media (CD, DVD, USB, etc.)Encryption of stored data is required. Store media in a secure location when not in use. Media should be inventoried upon creation and destroyed as soon as it is no longer needed.
AuditingALLEach unit or department must conduct periodic reviews of where Restricted Use data is located, who has access to it, the access control mechanisms, encryption protocols, and data destruction protocols. Verify that procedures for removing access are documented and accurate.
Incident ReportingALLAny unauthorized disclosure or loss of Restricted data must be immediately reported to the ITS Helpdesk (https://helpdesk.collegeforcreativestudies.edu, 313-664-7818) as well as the immediate supervisor or other available person in chain of authority.
DestroyingALLReview Record Retention Policy and the information in this destruction section before disposing of records. Do not destroy records that are the subject of a litigation hold or that must be retained pursuant to the College record retention policy.
Paper & Disposable Electronic Media (CDs, DVDs)Dispose of paper media via College approved shred boxes. Contact Information Technology Service for secure destruction of all physical electronic media. Do not dispose of in the trash, recycle, etc.
Electronic Files (Data) Reusable Electronic Storage Devices (USB keys, disk drives)Contact Information Technology Service for secure destruction of all physical electronic media. Do not dispose of in the trash, recycle, etc.
All Electronic Storage Media at End of Life, including Disk Drives
Device End of Lease or End of Life (Printers, Copiers, Multi-function office machines)Devices such as these often contain hard drives which must be properly erased, or “wiped”, prior to leaving CCS control (returned to the vendor, sent to surplus, donated, disposed of, etc.). For information on how to properly wipe the drive, contact Information Technology Services.

Exceptions

CCS ITS is authorized to grant exceptions to the requirements set forth in this document. Any exception granted will require a thorough review of the situation and will be based on the implementation of appropriate compensating controls.

Employee Information Security Training

The Director of Information Technology Services and the Privacy and Security Committee will conduct and/or coordinate proactive education and training outreach programs designed to help increase the CCS community’s awareness of information security issues, including the requirements of the Data Protection Standards.

This training is general in nature, providing an overview of information security and the legal and regulatory context in which we operate. It is not intended to replace regulation-specific training that may be required of people conducting specific duties and needing specific information about those duties. For example, FERPA training is and remains the responsibility of the Academic Advising and Registration Office.

The Director of Information Technology will, on an annual basis, send a reminder by email to the faculty and staff of CCS providing a summary of the provisions of the Data Protection Standards, including the monitoring provisions of this document, and including a link which can be reviewed for more details.

Information Technology Incident Response and Security Monitoring

An Information technology (IT) incident is an event(s) which threatens the integrity, confidentiality, and/or availability of College systems, networks, and/or data. It includes, but is not limited to:

  • Loss, suspected loss, or disclosure of data through technical or behavioral means (hacking, malware, phishing, inadvertent unauthorized disclosure over the phone, email, or in person, etc.);
  • Technological attacks against College networks or systems including unauthorized scanning, snooping, etc.;
  • Any suspected virus or malware infection;
  • Theft or misplacement of any College-owned computing device and/or personal device used to access or store College data;
  • Misuse of College-owned systems or networks in violation of other policies, including the Acceptable Use of Academic Technologies and Information Technologies Resources policy;
  • Events that threaten the performance and/or availability of College resources.

Response

In the event of an IT incident, priorities will be as follows:

  • Protect human safety
  • Protect College resources
  • Contain damage/prevent further loss
  • Preserve evidence
  • Rectify damage
  • Restore services

For CCS Community members, upon detection of (or suspicion of) an IT incident, do the following:

  • Immediately contact the ITS Helpdesk (https://helpdesk.collegeforcreativestudies.edu, 313-664-7818) as well as the immediate supervisor or other available person in chain of authority.
  • Communicate as clearly as possible details including name, contact information, what you suspect is happening, type of device, location, IP Address, and any information or data you suspect was lost/compromised.
  • Do not turn off or unplug any device unless human safety dictates otherwise or you’re instructed to do so by response personnel.
  • If you reasonably suspect loss of data is ongoing, you may unplug the device’s network connection if applicable, but be sure to communicate this when notifying response personnel.
  • Do not communicate with anyone about the incident other than response personnel, your supervisor as appropriate, or members of the College’s Privacy and Security Committee without authorization.
  • Communication with the media is restricted to the College’s Marketing and Public Relations staff, executive leadership, and legal counsel. Refer any/all media inquiries to: Marcus Popiolek, Director of Marketing and Communications at 313-664-7665.

Technical staff shall respond with the following priorities and requirements:

  • Document/log all actions taken and decision making process at each step from notification to resolution.
  • Secure physical location of any breach to avoid further loss.
  • Assess the immediate situation. If ongoing loss is not suspected, the priority is to preserve evidence. Do not turn off devices, reboot, remove media, etc. If ongoing loss is suspected, do the minimal possible to stop it (e.g. disconnect network connection vs. turn device off).
  • Notify ITS Director and/or Assistant Director if not already done.
  • Assess need for forensic evidence (logs, packet traces, etc.).
  • Collect and store any forensic evidence needed.
  • Regain control of any compromised system.
  • Analyze the event – how did it happen, what could be lost, what else could be compromised, etc. Estimate time/steps to recovery.
  • Correct any vulnerabilities that may have allowed the incident to happen or progress.
  • Remediate the system(s) as necessary and prepare to return to service.
  • Verify system integrity and restore services if safe to do so.
  • ITS Director and/or Assistant Director will notify the members of the Privacy and Security Committee describing the nature of the incident and response. Notification may also include other executive leadership and legal counsel as the situation warrants.
  • A written incident and response report will be prepared and submitted to the Privacy and Security Committee as soon as possible after the incident but within 10 days of resolution.

Public and/or Individual Notification of Breach

In the event of a data breach, executive management will consult with legal counsel as necessary to determine the type, nature, and scope of public or individual notification. Such notification will be performed via authorized personnel or legal representatives only, and will be in accordance with applicable legal and regulatory standards.

Security Monitoring and Incident Prevention

The College will test for and work to prevent IT incidents by various means including but not limited to:

  • Active scanning of any connected systems;
  • Passive scanning of network traffic;
  • Network monitoring;
  • Analysis of network packets including encrypted packets;
  • Penetration testing;
  • Behavioral/social testing including authorized phishing attempts, use of outside contractors to attempt to gain access to protected information, etc.

All such testing will be performed by the ITS department and/or authorized vendors in accordance with oversight from the Privacy and Security Committee.

Electronic Identity Policy

Purpose

The electronic account policy defines criteria for granting and revoking access (through a login) to various information resources at CCS, which are provided as a means of promoting communications and supporting academic and administrative processes and workflows.

Accounts are granted and removed according to the following criteria:

Students

New degree seeking students receive electronic credentials after they are admitted and retain them during their time at the college. At least once per year, inactive accounts are subject to deletion. An account is considered inactive if any of the following are true:

  • It has been at least one year since graduation.
  • The student has not attended CCS for four consecutive non-summer terms (i.e. meets criteria for re-admittance to the college).
  • An admitted applicant did not enroll at the College.

Continuing education/PCS students will have electronic accounts active during their time of enrollment. Accounts for CE students are subject to deletion if they do not maintain enrollment in consecutive terms.

Faculty

Full-time faculty will receive an electronic account upon hire and will keep it during the term of employment. Adjunct faculty will receive an electronic account upon hire after an assignment to teach a course section has been recorded in the student information system. If adjuncts do not teach in consecutive semesters, their account may be deleted during those periods at the discretion of the Human Resources department. Faculty granted emeritus status will retain their electronic account privileges for life.

Staff

Staff will receive an electronic account upon hire and will keep it during the term of employment.

Standards and Responsibilities

  • Create hard to guess passwords (minimum 8 characters, mixed case, include a number or special character). Do not use easy to guess words or sequences like ‘password’, ‘qwerty’, ‘12345’, etc.
  • Do not share or disclose passwords to anyone. Exception: upon request, you may disclose to ITS staff directly engaged in the performance of their legitimate duties. In this case, change the password upon completion of the matter.
  • Never use someone else’s credentials.
  • Do not reuse the password you use at CCS for other non-related systems.
  • Immediately change your password if you think your account has been compromised. Also contact the CCS helpdesk to report the concern.
  • Use administrative privileges only as necessary for legitimate College purposes. Never use an administrative account to read email, surf the web, etc. Use the least privilege possible for any task.
  • Never leave an unlocked device logged in and unattended. Lock your system/screen when stepping away from your computer.

Individual Department Procedures

Academic Advising and Registration

The Academic Advising and Registration Office(AARO) maintains a variety of student academic records that are in both electronic and paper format. Employees in this office are trained to protect the privacy of students’ records and are well versed in the Family Educational Rights and Privacy Act (FERPA), the federal law that protects the privacy of educational records and defines proper release of that information.

Electronic records are maintained in Colleague, the student information system, and ImageNow, the document imaging system. Changes to those records are made only by authorized personnel. Access to both systems is via a password, and each employee must be trained in the proper use of the system before access to the system is granted.

AARO also maintains a variety of confidential paper records. Student transcripts date back to 1926, the date the institution started offering four-year certificates, and are stored in filing cabinets in a secure room in the lower level of the building. AARO is in an ongoing process of scanning archived student records into Image Now. Work papers and other documents containing private information are shredded following their use. The office is locked during non-business hours.

For additional information, call AARO at (313) 664-7672.

Academic Affairs

The CCS Office of Academic Affairs adheres to the Family Educational Rights and Privacy Act (FERPA) guidelines established by federal law to protect the privacy of student education records. Disclosure of student information under FERPA is limited to what is termed “directory information,” that is, information contained in education records that would not generally be considered harmful or an invasion of privacy if disclosed, unless the student expressly grants permission in writing. CCS defines directory information as a student’s name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. Academic Affairs may use this information to compile the Dean’s and President’s Lists and to provide companies information related to a sponsored project. Outside of Directory Information, Academic Affairs does not disclose personally identifiable information about students without a completed, signed Student Information Release Authorization on file in the Academic Advising and Registration Office. Academic Affairs always verifies that a completed, signed Authorization form is on file in the Academic Advising and Registration Office prior to disclosing any information about a student beyond directory information.

The Office of Academic Affairs handles confidential items, such as student complaints, in a shared drive that requires login to a secure network accessible to authorized staff in the office. Any concern that arises out of Student Assembly that necessitates an Academic Affairs response is maintained on the shared network site.

Academic Departments/Classroom

CCS ensures the privacy of student information in academic departments and within the classroom through the following measures:

  • Secure login to the classroom management system, Blackboard. Blackboard allows instructors the ability to develop announcements, course content, assessments, and manage classroom grades. Through secure login students have access to this information as well as the ability to have online discussions and chats with only their classmates and instructor. Students do not have access to one another’s information protected under FERPA, such as grades, instructor/student personal communications, attendance records, etc. unless the student elects to disclose it.
  • Faculty submit midterm and final grades, along with attendance, through a password protected information system, WebAdvisor. WebAdvisor is a portal to our student information system, Colleague. A password and training on proper use is part of the onboarding process for department administrators and staff members.
  • Campus email offered through Google requires CCS students, faculty, and staff to login. CCS email is the official communication mechanism at the College.

Admissions Office

The Office of Admissions obtains and collects a variety of different information for prospective College students through a variety of stages and in different formats. The types of data that are collected include, but are not limited to:

Prospect Stage:

  • Purchased information of high school students and graduates, college students intending to transfer, undergraduate students and career professional looking to attend a graduate program

Inquiry Stage:

  • General inquiries from prospective students.

Applicant Stage:

  • Applications from prospective students;
  • advanced placement examination information;
  • portfolio submissions from prospective students;
  • standardized test results for prospective students;
  • letters of recommendation for prospective graduate students;
  • personal statements for prospective graduate students;
  • resume/CV for prospective graduate students;
  • immigration documentation of prospective international students; and
  • high school and/or college transcripts of prospective students.

Admission Stage:

  • Applications from re-admit students; and
  • college transcripts of admitted students.

All student records that are stored within the Office of Admissions are covered under the Family Educational Rights and Privacy Act of 1974 (FERPA) and those guidelines establish release of student information. In addition to FERPA regulations, the Office of Admissions has the following policies and procedures in practice to protect information:

  • Electronic data – All data are received on media or received electronically (downloaded) using industry standard privacy software. Admissions Support Staff and select IT staff members are responsible for transferring data to the TargetX student recruitment system, and the Colleague student information system. Colleague student information system security is maintained by the Office of Information Technology Services (ITS). All electronic data that is received on media that is subject to a disposal requirement is destroyed within the office prior to disposal making the media unreadable; no such media is to be recycled for re-use.
  • Hard copy – A minimum number of hard copy documents are maintained within the office until the student is enrolled at CCS, at which time the records are moved to the Academic Advising and Registration Office. Records of students who do not matriculate are held for two years or until they do matriculate. If the student does not matriculate, the records are destroyed after two years. All hard copy documentation that is considered for disposal is shredded using a third party shredder company. All information that is to be disposed of that contains student information is shredded within the office.All personnel are required to read and abide by office procedures on student record information including FERPA regulations. Training agendas include a component on information security.

For additional information, please contact the Office of Admissions at (313) 664-7425.

Business Office

The Business Services Office maintains financial records for the Cashiers, Accounts Receivable, Accounts Payable, Purchasing, and Payroll functions of the College. These records include both electronic and paper records. The Business Services Office is in a secure, locked environment with video surveillance. Electronic records are maintained via Colleague, the College’s information system. Paper records are maintained in locked filing cabinets.

The College receives credit card information for payment of tuition and fees via secure websites, the credit card number is encrypted. Every CCS employee or volunteer responsible for taking credit card payments has a background check done and is required to complete and sign a CCS Credit Card Security Agreement. The College never keeps a hard copy of credit card information. Email should never be used to transmit credit card or personal information. Credit card or personal payment information is never downloaded onto any portable devices including, but not limited to USB flash drives or laptop computers.

The College uses service providers for collections. We oversee service providers by taking steps to select and retain providers that are capable of maintaining appropriate safeguards for customer information. Additional safeguards in place include:

  • The Business Services Office checks references prior to hiring employees who will have access to customer information and requires a background check;
  • Computers are password protected.
  • Desks must be cleared at end of workday of any paperwork containing personal information; as well as computers must be signed out or locked whenever an employee leaves their desk area.

For additional information, please contact the Business Services Office at (313) 664-7435.

Campus Safety – Creation of CCS Student ID Cards

Campus Safety maintains a database containing Student, Staff and Faculty information for the creation of the “SmartCard” ID. This information is manually imported from the colleague system at the beginning of each semester.

Current Information includes a users photo, name, address, telephone, student/employee ID and Blackboard ID.

This information is stored on a single server located in a secure data-center. Login Access to the physical server is limited to Information Technology, and an authorized Contractor.

Client computers containing software to access the badging information system is limited to both Campus Safety offices, Campus Safety Assistant Directors offices, and the office of the Assistant Director of Information Technology.

Access via the client application to the badging system information is limited to the Campus Safety Assistant Directors, Director of Campus Safety, Command Center Officers, Director and Assistant Director of Information Technology, Facilities Coordinator, and authorized Contractors.

Financial Aid Office

Confidential information is any information pertaining to the students’ financial aid eligibility. This includes information submitted on the FAFSA, IRS tax forms, and other financial documents as well as any information pertaining to the students’ financial aid award, grades, and any professional judgment documents that are collected.

Only authorized school officials have access to financial aid information. The information is located on the Colleague Student Financial Aid system. The Director of Financial Aid authorizes access to individuals on an as-needed basis. Said individuals must log on with credentials assigned to them for their sole use. Hard copy information is filed by social security number and is kept in filing cabinets in the back of the office in locked drawers. The office is locked during non-office hours.

The Department of Education requires that safeguard procedures are in place in order for the institution to be eligible for Federal Financial Aid.

For additional information, call the Financial Aid Office at (313) 664-7496.

Human Resource Office

A master personnel record containing administrative staff, student staff, and other pertinent data is maintained in the Human Resources office. The Human Resources office maintains records concerning employment, performance, payroll, benefits, and other miscellaneous items. No information, except verification of employment dates, will be released to outside sources without the employee’s written authorization unless disclosure is required by subpoena or court order or is necessary to meet some legal obligation of CCS. A written authorization from the employee is required for the Human Resources office to release salary information. It is each staff member’s responsibility to inform the Human Resources office of any changes in the following: name, address, telephone, marital status, dependents, beneficiaries, and emergency contacts. Administrative staff have the right to review their Personnel Record in the Human Resources office, with a prior appointment. These Personnel Records are confidential and may only be reviewed by the administrative member, or the appropriate supervisory personnel of the administrative staff member.

Residence Life/Student Affairs Office

The following information about students is maintained in the Department of Housing and Residence Life through the database of our Residence Life Management software Room Choice:

  • Records related to students’ living preferences and individual needs;
  • Records related to room assignment, room registration, room occupancy, and applications to live on campus; and
  • Records related to financial obligations, billing, and payment information for damages to residence hall rooms and facilities.

Records related to Emotional Support Animals and Disabilities Support are maintained in both electronic format and hard copy. Specific storage and security measures are in place as follows:

  • Hard copy records are maintained in locked cabinets within relevant staff member offices (Director of Residence Life and Dean of Students)
  • Electronic records are maintained in personal network drives that require login credentials or in personal email files that require login credentials.

Records related to disciplinary matters that are maintained in hard copy form are stored in the offices of the appropriate Judicial Official and are kept in locked file cabinets. Electronic disciplinary records are maintained through a secure platform that requires login and active credentials through the software platform Maxient. Only institutional employees with judicial process responsibilities have access to these judicial records.

Information disclosed in individual counseling sessions must remain confidential, unless written permission to divulge the information is given by the student. However, all staff members must disclose to appropriate authorities information judged to be of an emergency nature, especially when the safety of the individual or others is involved. Information contained in students’ educational records must not be disclosed to extra-institutional third parties without appropriate consent, unless classified as “Directory” information or when the information is subpoenaed by law.

Counseling records are maintained in hard copy. Active counseling files (students seen within the last 2 years) are kept in locked cabinets in the office of the individual counselor. Inactive counseling files (students not seen within the last 2 years) are kept in locked cabinets within the Student Affairs Office. All counseling files include a copy of the Informed Consent regarding student privacy policies.

Confidentiality – staff ensure that confidentiality is maintained with respect to all privileged communications and to educational and professional records considered confidential. They inform all parties of the nature and/or limits of confidentiality. Staff share information only in accordance with institutional policies and relevant statutes, when given informed consent, or when required to prevent personal harm to themselves or others.

For additional information, please contact the Dean of Students at
(313) 664-7675.

Policy Contact

Administration and Finance Office Contact: Greg Fraser
School A-002 Yamasaki Ford Campus Home Phone: 313-664-7818
Categories: Administration and Finance, Information Technology Services

EFFECTIVE DATE
July 1, 2019

LAST UPDATED DATE
September 13, 2019

APPROVING OFFICE
Administration and Finance