Proposed Information Security Policy Changes CIO Council | June 27, 2016 | Smith Campus Center

Purpose and Intended Outcome To review with the CIO Council the proposed changes to the Information Security Policy Intended Outcome: Agreement to proceed with the proposed changes, effective 9/1/2016, or an understanding of the concerns that would prevent such agreement

Agenda We will review: The (first) annual Information Security Policy review process and stakeholders Proposed changes to the Information Security Policy as a result of that process The communication, education and training plans in support of the changes Any concerns you have

Information Security Policy review process Background: While we debuted a new Information Security Policy in 2013, we have never had a formal process to review and update this or the previous policy Annual Policy Review Process: Anyone may suggest a change to an Information Security Council (ISC) member [by March, 2016 - COMPLETED] ISC member reviews and suggests to Information Security Steering Group (ISSG) as appropriate [by March, 2016 - COMPLETED] ISSG reviews all suggested changes and recommends updates to Information Security Council (ISC) [April, 2016- COMPLETED] ISC approves changes to How-To’s and agrees to recommend changes to Requirements to CIO Council [April-May, 2016- COMPLETED] CIO Council approves changes to Requirements [June,2016 – IN PROGRESS] Changes are effective September 1, 2016

Summary of Proposed Information Security Policy Changes - 2016 Topic From To Encrypt mobile devices Roundabout implication that mobile devices should be encrypted (“protected against access if the device is lost or stolen”) Clearly stated requirement that mobile devices that store or access Harvard information must be encrypted Level 4 data on user devices Clarify that Level 4 data may be stored on approved encrypted portable media Password complexity All passwords must meet complexity requirements Passwords of more than 20 characters in length have no other requirements Use of HarvardKey Servers or applications with Level 3 or higher data must use HarvardKey Password management Unclear security requirements for systems that manage passwords No special requirements for Active Directory Clarify that systems that manage passwords must meet Level 4 requirements Includes new standards for Active Directory Social Security Numbers Implicit that systems with SSNs must meet Level 4 requirements Four new specific requirements: Reiterate that systems with SSNs must meet all Level 4 requirements Keep SSNs only when required by law Dispose of or archive records with SSNs when not required by law Report location and volumes of SSNs annually Effective as of 9/1/2016 – see full text in attached Microsoft Word document

Policy Communication, Education, and Training Message/Objective Audience Delivery Method Timing Announcement of policy updates and community responsibility to uphold Entire university Email from Provost Alan Garber Beginning of September Local/School support of policy updates School Security Officers Communicator toolkit, e.g. website content, PPT slides How-to explanations for new requirements, e.g. activate encryption on a laptop Security website content Quick Reference Card for classifying, handling, disposing of data Printable job aid posted on Security website Fall 2016 Overview of policy and how to apply it in common use cases Staff and faculty who handle confidential data Online training (Harvard Training Portal)

Questions and Concerns