1. MATCHING DATA with IT SERVICES Berkeley Data Authorization Process CISPC, April 19, 2012 Lisa Ho, IT Policy Manager, Berkeley Privacy & Policy Office

2. The Questions Berkeley Data Authorization Process

3. The Answers Classify campus data  Definitions and process Secure campus data  Authorize data use  Approve services (on and off campus) for a data class Develop an information bank  Publish approved services  Reduce duplication of work Respond to the Business Finance Bulletin IS-2  Classify, inventory, and define appropriate security controls for institutional data Berkeley Data Authorization Process

4. What is the process? A: General System Inventory B: Protected Data Screen C: Data Privacy Questionnaire D: Privacy Impact Assessment E: Data Classification F: Baseline Risk Questionnaire G: Information Risk Assessment H: Resource Proprietor Approval Berkeley Data Authorization Process B: Protected Data? B: Protected Data? A: General System Inventory H: Resource Proprietor Approval Data Authorization Issued No More Review Yes https://security.berkeley.edu/content/data-authorization-process-draft

5. High-level Rollout Plan Pilot  Off-site hosting  Systems in the spotlight Expand to other systems Eventually align with campus OE initiatives Berkeley Data Authorization Process