Data_Classification_Standard_Approved

	A	B	C	D	E
1	Approved 06-2018	Effective Date: January 1, 2019 / January 1, 2020 (New / Existing)	R=required, P=preferred
2	Control	Description	Low	Moderate	High

3	Patching	Patches will be deployed at regular intervals following standard industry practices, but at least every month. Depending upon patch severity and the current threat, patches should be deployed more frequently or out of the published schedule.	R	R	R
4	Malware Protection	Antivirus software must be installed, running and automatically updated.	R	R	R
5	Administrative Access	Users of the device do not login and do their daily work with an account that has administrative access.	R	R	R
6	Host-based Firewalls	A host firewall, such as Windows Firewall or IPTables, must be turned on and configured to prevent unsolicted and unauthorized connections.	R	R	R
7	Regulated Data Security Controls	Implement appropriate controls as mandated by relevant compliance standards or contractural obligations (e.g. PCI DSS, HIPAA, FISMA, Export Control, NIST).	R	R	R
8	Supported Hardware/Software	Hardware and software must be within a supported lifecycle by the associated vendor and eligible to receive security patches and updates.	R	R	R
9	Equipment Disposal	Devices are wiped prior to being discarded or given to someone else for reuse. If being discarded, it is given to Surplus or the Campus' approved e-waste vendor.	R	R	R
10	Passwords	Passphrases (16+ characters & complexity) are required for all accounts.	R	R	R
11	Credentials	A unique username and password is issued and centrally managed (e.g. NetID) and used to login to the device.	P	R	R
12	Remote Access	Disabled, or limited to known users and IP addresses (e.g. RDP Gateway, Campus VPN).	P	R	R
13	Assigned IT Partner	The device is reviewed and supported by Central IT or an departmental IT Partner.	P	R	R
14	Security Review	Request a security review prior to implementation.	P	R	R
15	Inventory / Registration	Central IT or your IT partner is informed that a particular device exists with a brief description as to how it will be used.	P	R	R
16	Configuration Management	The device is centrally configured using a tool that allows security settings to be applied (e.g. KACE, Munki).	P	R	R
17	Vulnerability Checking	The device is scanned for vulnerabilities and missing patches on a monthly basis. Found vulnerabilities are verified and resolved, or mitigated within 30 days.	P	R	R
18	Mobile Device Management	Tablets, smartphones and other mobile devices are registered with the campus mobile device management solution.	P	P	R
19	Managed Malware Protection	Managed antivirus software must be installed.	P	P	R
20	Hardening	Center for Internet Security (CIS) benchmarks will be reviewed and approriate recommendations accepted and implemented.	P	P	R
21	Joined to Domain	Windows computers are joined to the campus domain.	P	P	R
22	Two-step Login	Logging in requires a second factor, such as an app installed on your phone (DUO Security).	P	P	P
23	Whole Disk Encryption	Devices are encrypted using built-in encryption technology, such as bitlocker or filevault.	P	P	P
24	Centralized Logging	Logs are sent to a central location for safe keeping.	P	P	P
25	Application Whitelisting	Allowed applications are explicitly defined and enforced. Other applications can not run without the device being reconfigured.	P	P	P
26	Dedicated Admin Workstation	Access administrative accounts only through hardened and dedicated management computers.	P	P	P
27
28
29
30
31		An endpoint is defined as any laptop, desktop, or mobile device.
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100