Information Security Program
Information Security Policy
Effective Date: September 2, 2026
Board Approval: September 2, 2026
Annual Review:
Purpose
1.1. This policy establishes an Information Security Program at Tooele Technical College that ensures the protection of College Information Assets, Information Systems, and IT Resources. This policy aims to ensure compliance with USHE Policy R345 and applicable laws, protect the confidentiality, integrity, and availability of data, and manage cybersecurity risks by implementing the Center for Internet Security (CIS) Critical Security Controls.
Definitions
2.1. CIS Critical Security Controls (CIS Controls): A prioritized set of actions that form a defense-in-depth set of best practices that mitigate the most common cyberattacks. https://www.cisecurity.org/controls
2.2. USHE Policy R345 (Information Technology Resource Security): Policy that mandates minimum security standards for protecting sensitive data and information technology assets across the Utah System of Higher Education.
2.3. Information Asset: Any data, information, or knowledge used by the College in the course of its operations, regardless of the media on which it is stored.
2.4. IT Director: Senior-level Information Systems administrator.
2.5. IT Resource: Hardware, software, and network infrastructure (including servers, workstations, mobile devices, and cloud services) owned, operated, or used by the College.
2.6. Personally Identifiable Information (PII): Any information about an individual that can be used to distinguish or trace their identity.
2.7. Sensitive Data: Data whose unauthorized disclosure could have a significant adverse impact on the College’s mission, safety, finances, or reputation. This includes PII, FERPA-protected records, and financial data.
2.8. Information Technology Governance Committee (ITGC): Chaired jointly by IT Leadership and the VP of Finance and Operations. They shall meet regularly to review technology initiatives, cybersecurity risks, and strategic priorities.
3. References
3.1. USHE Policy R345: Information Technology Resource Security
3.2. USHE Policy R1010: Data Breaches
3.3. USHE Policy R1011: Contractual Standards for Use of Personally Identifiable Student Data by Third-Party Contractors
3.4. USHE Policy R1013: Scope of the Data Breach Requirements in Utah
3.5. Utah Code § 13-44: Protection of Personal Information Act
3.6. CIS Controls v8: Implementation Group 1 (IG1)
3.7. FERPA: Family Educational Rights and Privacy Act.
Roles and Responsibilities
4.1. College President: Accountable for the institution’s compliance with this policy and the effectiveness of its Information Security Plan. The President shall ensure that cybersecurity risks are integrated into the institution’s enterprise risk management process and are reported to the Board of Trustees annually.
4.2. Board of Trustees: Responsible for institutional oversight and approval of information security strategy.
4.3. IT Director: Responsible for the implementation of the Information Security Program and reporting compliance to the College Board.
4.4. Information Security Officer (ISO): Responsible for monitoring security controls, performing risk assessments, and leading incident response.
4.5. Chief Administrator Officer (CAO): College President
4.6. Appointed Records Officer (ARO): Persons assigned responsibility for Data Management and records retention.
4.7. Data Stewards (e.g., Department leaders designated as Data Stewards): Responsible for the data within their departments and authorizing access.
4.8. System and Network Administrators: Responsible for the technical maintenance, patching, and hardening of IT Resources.
4.9. Users (Faculty, Staff, Students): Responsible for adhering to this policy, protecting credentials, and reporting loss of data or suspicious activity.
4.10.Note: Roles may be combined or assigned to a single individual based on institutional resources.
Policy
5.1. Delegation of Authority
5.1.1. The Board of Trustees delegates authority to the President, Records Officers, and the IT Director to
establish, modify, and enforce supporting security procedures and sub-policies. Supporting
information security sub-policies may include, but are not limited to:
5.1.1.1. Acceptable Use Policy (AUP)
5.1.1.2. Data Classification & Protection Policy
5.1.1.3. Identity & Access Management Policy
5.1.1.4. Security Awareness & Training Policy
5.1.1.5. Vendor / Third Party Security Policy
5.1.1.6. Incident Response & Breach Notification Policy
5.2. Supporting Standards and Procedures: This policy establishes the College's information security framework. The Information Technology Department may develop and maintain standards, procedures, guidelines, and technical controls to implement this policy's requirements.
5.3. CIS Critical Security Controls: The College formally adopts CIS Critical Security Controls Implementation Group 1 (IG1) as its minimum institutional security baseline standard. Supporting procedures will align with IG1 safeguards to optimize resource allocation and mitigate core cybersecurity risks.
5.4. IT Security Risk Management: The College shall conduct annual security assessments in accordance with the CIS Critical Security Controls. The annual security assessment could be a self-assessment, an internal auditor, or a third-party consultant.
5.5. Board Reporting: The IT Director shall provide an annual report to the Board of Trustees regarding the status of the Information Security Program, risk assessments, security events, and recommendations for improvement.
5.6. Acceptable Use: Users shall use College IT Resources for authorized institutional purposes and shall comply with the College Computer Resources Acceptable Use Policy.
5.7. Data Classification and Encryption: All data shall be classified as Public, Private, Controlled, or Exempt. Records containing Personally Identifying Information must be protected and, where possible, encrypted.
5.8. Access Management: Access shall be granted according to the Principle of Least Privilege. Multi-Factor Authentication (MFA) shall be required for employee accounts and systems containing Sensitive Data whenever technically feasible. Access must be revoked promptly upon termination of employment and, where feasible, upon the end of student enrollment. Where MFA is not feasible, a 14-character password is required.
5.9. Change Management: Significant changes to critical Information Systems must be documented, tested, and approved by a VP or the College President before implementation to prevent service disruptions and security vulnerabilities.
5.10. Physical and Facility Security: Critical IT infrastructure shall be protected through appropriate facility access controls, server room and data center controls, infrastructure and environmental controls, and device and component security controls.
5.11. IT Resource Security and Vulnerability Management: Systems shall be configured in accordance with secure baseline standards. Security vulnerabilities shall be evaluated and remediated based on risk to the College.
5.11.1. The College shall implement an automated asset discovery process to inventory and identify hardware, software, operating systems, and cloud environments.
5.11.2. The College should prioritize identified vulnerabilities based on the severity of the weakness relative to the asset's criticality.
5.11.3. The College should use a scanning tool to probe IT assets and identify security weaknesses. Identified weaknesses should be addressed, and the resolution documented as either resolved, patched, mitigated, or accepted as a risk.
5.12. Remote Access: Remote access to College Information Systems shall utilize secure authentication and communication methods approved by the IT Director.
5.13.Network Security: Industry-accepted network security controls, as established by the CIS framework, shall be implemented to protect College Information Assets, Information Systems, and IT Resources from unauthorized access, disruption, or misuse.
5.14. Log Management and Retention: Critical security logs, Authentication, Account Management, Process Tracking, and System Integrity logs shall be generated and retained for a minimum of 180 days, with longer retention where feasible.
5.15. Backup and Recovery:
5.15.1. Appropriate backup, recovery, and restoration processes shall be maintained to support the availability and recovery of critical College systems and data. Backups and recovery should be tested annually.
5.15.2. The IT Director shall design a backup and recovery plan by establishing a combination of strict architectural rules, defined business metrics, and routine testing.
5.16. Information System Media Handling: Sensitive data stored on physical media shall be protected during use, transport, and disposal.
5.17. Business Continuity and Disaster Recovery Planning: The College shall maintain a Business Continuity and Disaster Recovery Plan to support continuity of operations following a significant disruption.
5.18. IT Security Incident Management: The College shall maintain a written Incident Response Plan. Data breaches shall be reported in accordance with applicable law and Utah System of Higher Education policies.
5.19. IT Security Awareness and Training: All employees must complete annual security awareness training. The program shall include education on phishing, social engineering, and data protection best practices. This training can be split into monthly sessions.
5.20. Cyber Liability and Risk Transfer: The College shall maintain appropriate insurance coverage for losses or breaches of Personally Identifiable Information.
5.21. 3rd Party and Cloud Services: College-approved cloud services must meet applicable security, privacy, and contractual requirements. Third-party providers handling College information must comply with applicable laws, regulations, and contractual obligations.
5.22.Artificial Intelligence and Emerging Technologies: The use of artificial intelligence (AI) and emerging technologies shall be governed by College-approved procedures designed to protect Sensitive Data, maintain compliance with legal and regulatory requirements, and support responsible institutional use.
5.22.1. Users shall not enter Sensitive Data, FERPA-protected information, personnel records, financial information, or other non-public College information into unapproved AI systems.
5.22.2. The College may establish additional standards and procedures governing the use of AI technologies as these technologies evolve.
5.23. Exceptions to Policy: Exceptions must be documented, approved, periodically reviewed, and supported by a valid business justification and compensating controls.
5.24.Violations: Failure to comply with this policy may result in suspension of access and disciplinary action, up to and including termination of employment or expulsion. Legal action may be pursued for violations of state or federal law.
Governance and Policy Review
6.1. This policy shall be reviewed annually by the IT Director and the Executive Administration Team to ensure alignment with current threats, technology, and applicable requirements.