Description

Level 1 Confidential Data is information maintained by the University that is exempt from disclosure under the provisions of the California Public Records Act or other applicable state or federal laws.  Its unauthorized use, access, disclosure, acquisition, modification, loss, or deletion could result in severe damage to the CSU, its students, employees or customers.  Financial loss, damage to the CSU’s reputation and legal action could occur if data is lost, stolen, unlawfully shared or otherwise compromised.

Level 1 data is intended solely for use within the CSU and limited to those with a “business need-to-know.”  Statutes, regulations, other legal obligations or mandates protect much of this information.  Disclosure of Level 1 data to persons outside of the University is governed by specific standards and controls designed to protect the information.

Confidential information must be interpreted in combination with all information contained on the computer or electronic storage device to determine whether a violation has occurred.

Level 1 access will be granted on a strict “need-to-know” basis only and will be restricted to authorized staff and other participants who have executed an approved Non-Disclosure Agreement (NDA).  This information includes organization contact lists, internal processing procedures, employee schedules and other information required to function within the organization but too sensitive to release to the public.

Examples (note: list provides examples and is not all-inclusive)

• Passwords or credentials
• PINs (Personal Identification Numbers)
• Birth date combined with the last four digits of SSN and name
• Credit card numbers with cardholder name or expiration date and/or card verification code
• Tax ID with name
• Driver’s license number, state identification card and other forms of national or international identification (such as passports, visas, etc.) in combination with name
• Social Security number and name
• Health insurance information with name
• Medical records related to an individual
• Psychological counseling records related to an individual
• Bank account or debit card information in combination with any required security code, access code, or password that would permit access to an individual’s financial account
• Electronic or digitized signatures
• Private key (digital certificate)
• Vulnerability/security information related to a campus or system
• Attorney/client communications
• Legal investigations conducted by the University
• Third-party propriety information per contractual agreement
• Sealed bids
• Employee name with personally identifiable employee information
  • Biometric information
  • Electronic or digitized signatures
  • Personal characteristics

Description

Internal use data is information that must be protected due to proprietary, ethical or privacy considerations.  Although not specifically protected by statute, regulations or other legal obligations or mandates, unauthorized use, access, disclosure, acquisition, modification, loss or deletion of information at this level could cause financial loss, damage to cause financial loss, damage to the CSU’s reputation, violate an individual’s privacy rights or make legal action necessary.

Non-directory educational information may not be released except under certain prescribed conditions.

Level 2 access will be granted on a strict “need-to-know” basis only and will be restricted to authorized staff and other participants who have executed an approved Non-Disclosure Agreement (NDA).  This information includes organization contact lists, internal processing procedures, employee schedules and other information required to function within the organization but too sensitive to release to the public.

Examples (note: list provides examples and is not all-inclusive)

• Identity Validation Keys (name with)
  • Birth date (full: mm-dd-yy)
  • Birth date (partial: mm-dd only)

• Student name with personally identifiable education records
  • Grades
  • Courses taken
  • Schedule
  • Test scores
  • Advising records
  • Educational services received
  • Disciplinary actions

• Employee Information
  • Employee net salary
  • Employment history
  • Home address
  • Personal telephone numbers (including emergency contacts)
  • Personal e-mail address
  • Payment History
  • Employee evaluations
  • Disciplinary actions
  • Background investigations
  • Mother’s maiden name
  • Race and ethnicity
  • Parents and other family members names
  • Birthplace (city, state, country)
  • Gender
  • Marital Status
  • Physical description
  • Photograph (voluntary for public display)

• Other
  • Donor name, address, phone, email and giving amount
  • Library circulation information
  • Trade secrets or intellectual property such as research activities
  • Location of critical or protected assets
  • Licensed software

Description

This is information that is generally regarded as publicly available.  Information at this level is either explicitly defined as public information or intended to be available to individuals both on and off campus or not specifically classified elsewhere as Level 1 or Level 2.

Knowledge of this information does not expose the CSU to financial loss or jeopardize the security of the CSU’s information assets. 

Publicly available data may still be subject to appropriate campus review or disclosure procedures to mitigate potential risks of inappropriate disclosure.

 1 Cal State LA may disclose “Directory Information” without prior written consent of the student.  However, at any time the student may exercise the option to consider this information confidential by completing the Releasing Student “Directory Information” to Outside Agencies form and submitting it to the Records Office, ADM 409.  All requests to obtain student directory information must be directed to the Records Office, ADM 409.

Examples (note: list provides examples and is not all-inclusive)

• Campus Identification Keys
  • Campus identification number
  • User ID (do not list in a public or a large aggregate list where it is not the same as the student email address)
  • Email
• Student Information 1

  Educational directory information    (FERPA) includes:

• Name
• Address
• Telephone number
• Email address
• Photograph
• Major field of study
• Participation in officially recognized activities and sports
• Height and weight of members of athletic teams
• Dates of attendance
• Grade level
• Enrollment status
• Degrees, honors and awards received
• Most recent previous educational agency or institution attended by the student

      Bargaining unit student employee directory information

• Name of the department employing the student
• The student employee’s telephone number within the department
• The student employee’s email address within the department
• The student employee’s job classification

• Employee Information (including student employees)
  • Employee title
  • Status as student employee (such as TA, GA, ISA)
  • Employee campus email address
  • Employee work location and telephone number
  • Employing department
  • Employee classification
  • Employee gross salary
  • Name (first, middle, last) (except when associated with protected data)
  • Signature (non-electronic)
• Donor Information
  • ​Constituent code
  • Class, degree, academic organization, major
  • Employment information defined above
  • Job title

• ICSUAM 7100.0 Identity Access Management (public)
• ICSUAM 8000 Information Security (public) (intranet)
• ICSUAM 8000.0 Introduction and Scope (intranet)
• ICSUAM 8005.0 Policy Management (intranet)
• ICSUAM 8010.0 Establishing an Information Security Program (intranet)
• ICSUAM 8015.0 Organizing Information Security (intranet)
• ICSUAM 8020.0 Information Security Risk Management (intranet)
• ICSUAM 8025.0 Privacy of Personal Information (intranet)
• ICSUAM 8030.0 Personnel Information Security (intranet)
• ICSUAM 8035.0 Information Security Awareness and Training (intranet)
• ICSUAM 8040.0 Managing Third Parties (intranet)
• ICSUAM 8045.0 Information Technology Security (intranet)
• ICSUAM 8050.0 Configuration Management (intranet)
• ICSUAM 8055.0 Change Control (intranet)
• ICSUAM 8060.0 Access Control (intranet)
• ICSUAM 8065.0 Information Asset Management (intranet)
• ICSUAM 8070.0 Information Systems Acquisition, Development and Maintenance (intranet)
• ICSUAM 8075.0 Information Security Incident Management (intranet)
• ICSUAM 8080.0 Physical Security (intranet)
• ICSUAM 8085.0 Business Continuity and Disaster Recovery (intranet)
• ICSUAM 8090.0 Compliance (intranet)
• ICSUAM 8095.0 Policy Enforcement (intranet)
• ICSUAM 8100.0 Electronic and Digital Signatures (intranet)
• ICSUAM 8105.0 Responsible Use Policy (intranet)
• ICSUAM Policy Glossary (intranet)