SECURITY, DIGITAL ACCESS POLICY
Unauthorized access to sensitive resources is a high level concern in the realm of information
security. Most unauthorized access is attributed to people within the University. Damage that is
caused may be intentional or accidental. Methods of managing digital access to sensitive resources
are necessary means to help ensure that access to resources is only by authorized personnel.
University information shall be stored in locations, as approved by the Chief Information Officer
(CIO) designated by the appropriate administrative office that is custodian of the data. Access to
that information shall be authorized or denied by the “data owner”. The approved data custodian
may use a limited number of administrative accounts for purposes of managing or troubleshooting
the data store. The users of those accounts will be registered to the data owner’s security contact
and the CIO.
Data owners must use due care when authorizing access to data. Access should be authorized on
an individual basis. Requests for accounts should go through procedures appropriate to the
business process associated with the data.
Data Owner – Administrative Office primarily responsible for the use and management of the
data. A data owner may also be an individual responsible for the information stored on the
machine to which they are responsible for.
Data Custodian –Person approved by the CIO or their designee to be responsible for the
maintenance of the storage unit and facility.