Data Classification

All SUNY Cortland’s data must be classified into one of the three categories and protected using appropriate security measures consistent with the minimum standards for the classification level as described in related information security standards, procedures, and guidelines.

Purpose of Data Classification

The purpose of this policy is to establish a framework for classifying institutional data based on its level of sensitivity, value and criticality to the college. Classification of data will aid in determining baseline security controls for the protection of data in how we access, save, send and store data.

Who does this apply to?

This Policy applies to all faculty, staff and third-party Agents of the College as well as any other College affiliate who is authorized to access Institutional Data, this does include student works and contractors. In particular, this policy applies to those who are responsible for classifying, utilizing, reporting and protecting Institutional Data, as defined by the Data Classification Policy.