Information Security Policy

Executive Summary

An information security program (ISP) is designed to protect information resources from a wide range of threats, ensure business continuity, and minimize business risk to Lindenwood University and members of the Lindenwood community. Information resource security is achieved by implementing applicable policies, processes, procedures, controls, standards, guidelines, organizational structures, and supporting technology. The information security program (ISP) governs the confidentiality, integrity, and availability of Lindenwood University data, especially highly sensitive or critical data, and defines the responsibilities of departments and individuals for such data.

Scope

This information security program applies to any person granted access to Lindenwood University information resources, including but not limited to students, faculty, staff, alumni, temporary employees, contractors, volunteers, friends of Lindenwood University, and guests who have access to Lindenwood University information resources. Such technology resources include but are not limited to data, images, text, recordings, and software which are stored on hardware or other digital storage media both on-campus and at outsourced locations.

Policy and Procedures

The following foundational elements are designed to create a framework for the information security program (ISP), help Lindenwood University adopt a control catalog, and comply with best practices in Information Security.

Inventory and Accountability of Information Assets: Lindenwood University collects, stores, and uses various data as part of normal operations. This information is stored in various systems that are inventoried and managed by the Lindenwood IT Enterprise team.
Sensitive Data Classification: Data classification is required to determine the relative sensitivity of information resources, which is the basis for protection and access control.
Data Risk Management: Lindenwood University's risk management cycle includes assessment, review, mitigation, and reporting based upon the university’s risk tolerance.
Identity and Access Management: Ensures accurate identification of authorized users and provides access controls to the use of information resources.
Control Activity: Defined controls provide a system of checks and balances intended to identify irregularities, prevent abuse from occurring, and assist in resolving discrepancies that are introduced into the operation of the business.
IT Security Awareness: The goal of the information security awareness program is to strengthen the information security culture of Lindenwood University through education, active learning, communication, and collaboration.
Physical Security: Physical security controls and secure areas are used to minimize unauthorized access, damage, and interference to information resources. This includes providing environmental safeguards and controlling physical access to equipment and Lindenwood University data.
IT Contingency Planning: The Lindenwood IT contingency Plan is designed to minimize the impact of a disaster or disruptive incident on an organization's IT systems and operations, and to ensure that mission-critical functions can be quickly restored in the event of an outage or other disruption.
Security Incident Response: Effectively and efficiently handle and manage any security incidents that may occur within Lindenwood University’s IT infrastructure.

Responsibilities and Enforcement

Vice President/Chief Information Officer (CIO): Lindenwood University’s Chief Information Security Officer is responsible for overseeing the organization’s technology infrastructure and ensuring that it aligns with the business goals and objectives. The CIO will periodically present an update on the status of the ISP to the executive officers and the Board of Trustees.

Assistant Vice President for Information Technology (AVPIT): The AVPIT of Lindenwood University is responsible for managing the day-to-day operations of the university’s IT systems. This includes ensuring that the ISP is properly implemented and maintained.

IT Governance Committee: Works in conjunction with the CIO and AVPIT to review and recommend university policies regarding information security.

Definitions

Access Controls: The process of controlling access to systems, networks and information based on business and security requirements of the user’s role within Lindenwood University.

Risk Tolerance: Lindenwood University’s willingness to accept risk by either accepting, transferring, or mitigating risk exposures.

Information Security Incident: An event that impacts or has the potential to impact the confidentiality, availability, or integrity of Lindenwood University's information resources.