CSU Information Security Policy and Standards

Support Page Content

CSU Information Security Policy and Standards

��㴫ý is committed to protecting the confidentiality, integrity, and availability of information assets owned, leased, or entrusted to the University. Therefore, we hereby adopt both the California State University Information Security Policies and Standards and the ��㴫ý Supplemental Information Security Policies.

Policies vs. Standards vs. Procedures

Policies are formal statements created by the university that reflect our mission, which in this case is the protection of ��㴫ý's information and assets.
Standards are rules or actions that must be done to ensure our policies are being followed. They indicate expected behavior and must be enforced.
Procedures are detailed step by step instructions on how to implement or adhere to the standards.
Guidelines are recommended practices that are based on industry-standard practices.

CSU Information Security Policy and Standards

Policies and standards are organized in the following, clickable index:

Policy Section	Supplemental Policies	Procedures, Guidelines, Others

		��㴫ý Data Classification and Protection Standard ��㴫ý Vulnerability Management Standard ��㴫ý Vulnerability Management Supplemental Standard for Workstations ��㴫ý Vulnerability Exception Procedure ��㴫ý Vulnerability Exception Request Form ��㴫ý Quarantine Procedures
		��㴫ý Data Classification and Protection Standard
	FERPA(Student Records) Privacy	��㴫ý Data Classification and Protection Standard ��㴫ý Data Privacy Policy and Standards ��㴫ý Campus Privacy Notice ��㴫ý Data Security & Records Retention ��㴫ý Data Reporting Governance
		��㴫ý Access Control Standard – Identify Verification ��㴫ý Access Control Standard – Authentication ��㴫ý Level 1 Systems Access Review Template



		��㴫ý Campus Device Standards ��㴫ý Workstation Security Standards ��㴫ý Common Workstation Standards ��㴫ý High Risk Workstation Standards ��㴫ý Student Device Standards Mobile Device Security ��㴫ý Technology Procurement Request
		Mobile Device Security
		��㴫ý Vulnerability Management Standard ��㴫ý Vulnerability Management Supplemental Standard for Workstations ��㴫ý Vulnerability Exception Procedure ��㴫ý Vulnerability Exception Request Form ��㴫ý Quarantine Procedures ��㴫ý Campus Web & Mobile Development Security Guideline
		Information Security Requirements - Supplemental Provisions
		��㴫ý Data Classification and Protection Standard
		��㴫ý Business Continuity and Disaster Recovery Plan
	Debit/Credit Card Payment Policy 6340.00	��㴫ý Data Privacy Policy and Standards A01-��㴫ý Annual PCI Assessment Procedure A02-��㴫ý Annual Credit Card Acceptance Acknowledgement A03-��㴫ý User Access Inventory - Template A04-��㴫ý Device Inventory - Template A05 - ��㴫ý Credit Card Business Process Inventory 02-��㴫ý Credit Card Acceptance Procedures 03-��㴫ý Credit Card Channel Request