Protected Data at CSUN

Know Your Data. Protect Our Community.

Protected data is university information that must be handled with care because of privacy, security, legal, regulatory, contractual, or operational requirements. Before storing, sharing, sending, printing, or disposing of CSUN information, identify the CSU data classification level and use the appropriate safeguards.

If information includes more than one type of data, protect the entire file, record, report, or system at the highest classification level present.

Not sure which level applies? Open a support ticket or email support@csun.edu for assistance.

What Type of Data Are You Working With?

Level 1 — Confidential

Highest level of protection

Level 1 information requires the strongest protection. Unauthorized access, disclosure, modification, or loss could cause serious harm to an individual or the university.

  • Social Security numbers when associated with an individual
  • Credit or debit card information
  • Bank account information and access credentials
  • Medical and health insurance information
  • Passwords, PINs, and security credentials
  • Government-issued identification information
  • Certain biometric records
  • Certain law enforcement, public safety, emergency response, and incident records

What Should I Do?

Only access Level 1 information when you have an authorized university business need.

Store and transmit Level 1 information only through CSUN systems specifically approved for confidential data.

Do not store Level 1 information in personal email, personal cloud storage, unapproved applications, or other locations that have not been approved for confidential university data.

Need to Store Level 1 Files?

Use CSUN Confidential Box.

CSUN Confidential Box provides approved storage for university Level 1 confidential data.

Learn about CSUN Confidential Box

Level 2 — Internal

Protected university information

Level 2 information is intended for university use and should not normally be made publicly available. Unauthorized access or disclosure could affect an individual's privacy or university operations.

Common Examples

  • Grades
  • Courses taken
  • Class schedules
  • Test scores
  • Advising records
  • Educational services received
  • Disciplinary information
  • Student identification photos
  • Other non-directory educational records
  • Home address
  • Personal phone number
  • Personal email address
  • Employee evaluations
  • Background investigation information
  • Certain demographic and personnel information
  • Research activities and intellectual property
  • Security and vulnerability information
  • Locations of protected university assets
  • Attorney-client communications
  • Licensed software and other restricted university resources

What Should I Do?

Access Level 2 information only when needed for your university responsibilities.

Use CSUN-approved systems to store and share the information, and limit access to people who have an appropriate university business or educational need.

When working with student information, additional requirements such as FERPA may apply.

Level 3 — General / Public

Information approved for public access

Level 3 information is intended for public use or has been approved for public distribution.

  • Public CSUN webpages
  • Published university announcements
  • Approved marketing materials
  • Public reports
  • Information designated for public directories
  • Other university information approved for public release

What Should I Do?

Level 3 information generally does not require the security controls used for Level 1 or Level 2 data.

University requirements related to publication, records management, accessibility, and appropriate use may still apply.

Common Situations at CSUN

 

Grades are protected student information.

Use an approved CSUN system and share the information only with individuals who have an appropriate educational or university business need.

Do not send protected student information to personal email accounts or share it using unapproved services.

Student class schedules and other non-directory educational records are Level 2 protected university information.

Store the file in an approved CSUN location and restrict access to individuals who have an appropriate educational or university business need.

Social Security numbers associated with individuals are Level 1 confidential information.

Before collecting Social Security numbers, confirm that CSUN has a legitimate business need for the information and that an approved Level 1 system will be used to collect, store, and process it.

Level 1 confidential files must be stored using a CSUN-approved solution designed for confidential data.

CSUN Confidential Box provides approved storage for Level 1 confidential university data.

Learn about CSUN Confidential Box

Research data may be classified as Level 1, Level 2, or Level 3 depending on the information being collected, stored, or shared.

Personally identifiable, medical, financial, or other sensitive research information may require additional security controls and approvals.

Determine the appropriate data classification and consult the applicable CSUN research requirements before collecting or storing sensitive research information.

For information security assistance, open a support ticket or email support@csun.edu.

Whether university information can be shared outside CSUN depends on its classification and any applicable university requirements.

Level 1 — Confidential: Do not share unless specifically authorized and an approved secure method is used.

Level 2 — Internal: Share only when there is an appropriate university purpose and the recipient is authorized to receive the information.

Level 3 — General / Public: Information may generally be shared publicly once any applicable university review or approval requirements have been met.

Before You Store or Share University Data

Ask yourself:

  1. What information does this contain?
  2. What data classification applies?
  3. Does everyone receiving the information need access to it?
  4. Am I using a CSUN-approved application or storage location?
  5. Do additional requirements such as FERPA, HIPAA, PCI DSS, research requirements, or records-retention requirements apply?

If you are unsure, ask before storing, transmitting, or sharing the information.

Need Help?

Information Security and IT Support

Need help identifying a data classification, determining how information should be protected, selecting an appropriate CSUN service, or resolving a technology issue?

Open a ticket: CSUN TOPdesk

Email: support@csun.edu