1. Proposed Information Security Policy Changes
CIO Council | June 27, 2016 | Smith Campus Center

2. Purpose and Intended Outcome
To review with the CIO Council the proposed changes to the Information Security Policy
Intended Outcome:
Agreement to proceed with the proposed changes, effective 9/1/2016, or an understanding of the concerns that would prevent such agreement

3. Agenda
We will review:
The (first) annual Information Security Policy review process and stakeholders
Proposed changes to the Information Security Policy as a result of that process
The communication, education and training plans in support of the changes
Any concerns you have

4. Information Security Policy review process
Background:
While we debuted a new Information Security Policy in 2013, we have never had a formal process to review and update this or the previous policy
Annual Policy Review Process:
Anyone may suggest a change to an Information Security Council (ISC) member [by March, COMPLETED]
ISC member reviews and suggests to Information Security Steering Group (ISSG) as appropriate [by March, COMPLETED]
ISSG reviews all suggested changes and recommends updates to Information Security Council (ISC) [April, COMPLETED]
ISC approves changes to How-To’s and agrees to recommend changes to Requirements to CIO Council [April-May, COMPLETED]
CIO Council approves changes to Requirements [June,2016 – IN PROGRESS]
Changes are effective September 1, 2016

5. Summary of Proposed Information Security Policy Changes - 2016
Topic
From To
Encrypt mobile devices
Roundabout implication that mobile devices should be encrypted (“protected against access if the device is lost or stolen”)
Clearly stated requirement that mobile devices that store or access Harvard information must be encrypted
Level 4 data on user devices
Clarify that Level 4 data may be stored on approved encrypted portable media
Password complexity
All passwords must meet complexity requirements
Passwords of more than 20 characters in length have no other requirements
Use of HarvardKey
Servers or applications with Level 3 or higher data must use HarvardKey
Password management
Unclear security requirements for systems that manage passwords
No special requirements for Active Directory
Clarify that systems that manage passwords must meet Level 4 requirements
Includes new standards for Active Directory
Social Security Numbers
Implicit that systems with SSNs must meet Level 4 requirements
Four new specific requirements:
Reiterate that systems with SSNs must meet all Level 4 requirements
Keep SSNs only when required by law
Dispose of or archive records with SSNs when not required by law
Report location and volumes of SSNs annually
Effective as of 9/1/2016 – see full text in attached Microsoft Word document

6. Policy Communication, Education, and Training
Message/Objective
Audience
Delivery Method
Timing
Announcement of policy updates and community responsibility to uphold
Entire university
from Provost Alan Garber
Beginning of September
Local/School support of policy updates
School Security Officers
Communicator toolkit, e.g. website content, PPT slides
How-to explanations for new requirements, e.g. activate encryption on a laptop
Security website content
Quick Reference Card for classifying, handling, disposing of data
Printable job aid posted on Security website
Fall 2016
Overview of policy and how to apply it in common use cases
Staff and faculty who handle confidential data
Online training (Harvard Training Portal)

7. Questions and Concerns