部分CN.1

BUSINESS AND SUPPORT SERVICES
INFORMATION SECURITY

过程

总结

The Chief Information Officer establishes and acts as the College Information Security Officer. Various IT Department policies shall be maintained to ensure the security and integrity of IT resources. Users must comply with all applicable state and federal laws and may be subject to criminal prosecution for violation thereof under state and federal laws.

Navarro currently meets the State of Texas TAC202 Cyber Security requirements with Monthly reporting.

使用监控

Use of IT resources may be monitored by the IT Department to ensure proper and efficient usage, identify problems or check for security violations.

密码

All users of IT resources are required to take appropriate steps, as outlined below, to select and secure their passwords.

Passwords must be at least 8 characters and contain uppercase and lowercase letters, at least one number, and at least one special character.
密码必须复杂且难以猜测。
密码不能重复使用。

所有密码应被视为机密数据，因此必须加以保护。 Personal account passwords in production environments may not be shared with any individual to whom the account does not belong. System passwords in any environment and personal account passwords in test environments passwords may not be shared with any individual whose use of the password is not appropriate for completing their authorized duty.

锁屏策略

All employees must log out of devices and/or applications which are not in active use. Computer workstations may not be left unattended without being locked, logged out, or shut down.

物理访问控制

All employees must be aware of the financial investment and data security considerations of IT facilities, including IT offices, data centers, and network closets.

以下定义的区域被视为IT限制区域

第1层：服务器室

A “服务器机房” is any area or locked container that houses one or more servers which houses internal, confidential, and/or secret data.

这些区域由首席信息官确定和指定。

All entrances to an area with this designation must be secured with a lock which can be unlocked by no more than four individuals designed by the Chief Information Officer.

All entrances to these areas must be marked with prominent signage with the following messages:

All entries into the room must be logged with the times and names of the individual entering the area.

一级资讯科技禁区
服务器机房
只供授权人员使用
超出此点需要IT护送
所有条目都必须被记录

Anyone not designated as a keyholder by the Chief Information Officer must be escorted by a keyholder when inside a 服务器机房. 护送人员必须在场。 The purpose for entry must be legitimate and approved by the keyholder. A record of all escorts must be kept with the following information: entry time, name of escort, name of visitor, purpose of visit, company or organization of individual.

第2级：技术工作区域

A “技术工作范围” is any area where technical work is commonly done, or where IT employees are stationed. These areas may contain technical equipment which may be in various repair states or sensitive data.

这些区域由首席信息官确定和指定。

Entrance into these areas by any individual who is not an IT employee must be approved by an IT employee and such entrance must be relevant and appropriate to college business. Individuals who are not IT employees must be always escorted by an IT employee when inside of these areas.

All entrances to these areas must be kept closed and locked, except for individual employee offices, which must be kept closed when unoccupied.

All entrances to these areas must be keyed with keys available only to IT employees and Campus Police.

All entrances to these areas must be marked with prominent signage with the following messages:

二级资讯科技禁区
技术工作范围
只供授权人员使用
超出此点需要IT护送
门永远锁着

信息和设备处置

Employees must delete any files on their issued devices once it is clearly no longer needed.

Employees must return any storage media, such as hard drives, solid state drives, removable storage devices, compact discs, or other storage media to the IT department for proper disposal and destruction.

所有存储在纸上的数据必须由批准的粉碎公司粉碎。

设备加密

新发布的计算机必须配置为关机时加密。 The IT department will maintain a database of the decryption keys necessary to recover data from each device issued.

Publicly accessible computers such as kiosk computers and lab computers are exempt from the encryption requirement.

Approved: 2015
Updated: 2021, 2024
Reviewed:

工具和资源

c节：商业和支助服务