Employee Management and Training
In accordance with Lakewood University policies, standards, and guidelines, reference checking and background reviews are conducted for all new hires. During employee orientation, each new employee in departments that handle Protected Information are required to participate in several training sessions on the importance of confidentiality of Protected Information. They are also trained in the proper use of computer information and passwords. Departments responsible for maintaining Protected Information will also provide staff with updated training to minimize risk and safeguard data and maintain information security.
Physical Security
Lakewood University maintains physical security of Protected Information by limiting access to authorized employees who have signed an acknowledgement of their obligation to keep Protected Information private. Established procedures for the prompt reporting of the loss or theft of Protected Information must be followed. Offices and storage facilities that maintain Protected Information limit customer access and are appropriately secured. Paper documents that contain Protected Information are shredded at the time of disposal.
Information Systems
Information systems is an integration of hardware and software that forms a network used to collect, store, process, analyze and distribute data. Lakewood University has policies, standards, and guidelines governing the use of electronic resources and firewall and wireless policies. It takes reasonable and appropriate steps consistent with current technology to make sure that all Protected Information is secure during storage and encrypted during transmission.
Management of System Failures
Lakewood University maintains effective systems to prevent, detect, and respond to attacks, intrusions and other system failures. Such measures include:
- Maintaining up-to-date anti-virus software
- Regularly obtaining and installing patches to correct software vulnerabilities
- Maintaining filtering or firewall technologies
- Alerting those with access to sensitive data of threats to security
- Imaging documents and shredding paper copies
- Backing up data regularly and storing it off site
- Observing other reasonable measures to protect our information systems.
Selection of Appropriate Service Providers
Due to their specialized technology expertise, vendors may provide resources that Lakewood University can not provide on its own. A service provider that will maintain or access Protected Information must demonstrate the ability to safeguard Protected Information when being evaluated. Contracts with service providers may include the following requirements:
- The Protected Information will be held in strict confidence and accessed only for the explicit business purpose of the contract
- The service provider has documented appropriate safeguards and controls (example, SOC2) to protect the sensitive information it receives, and that it must promptly report any security incidents that may affect our protected information
- A requirement (when appropriate) that the service provider maintain certain types of insurance to cover potential liability in the event of a security incident
- A requirement (when appropriate) that the service provider submit to audits of its information security and privacy policies, procedures, and controls.
Continuing Evaluation and Adjustment
Due to constantly changing technology and evolving risks, this Information Security Plan will be subject to periodic review and adjustment. The coordinators, in consultation with the Office of General Counsel, will review the standards set forth in this policy and recommend updates and revisions as necessary. It may be necessary to adjust the plan to reflect changes in technology, the sensitivity of student and customer data, and internal or external threats to information security.
