Information Security Policies V 2.5 www.gradleaders.com 614.791.9000 Updated 4/14/2021 ii Table of Contents TABLE OF CONTENTS EXECUTIVE SUMMARY ........................................................................................................................... 5 Introduction ............................................................................................................................................................................................................... 5 Information Ownership .......................................................................................................................... 6 Data Classification .................................................................................................................................. 8 Overview ..................................................................................................................................................................................................................... 8 Access Control .......................................................................................................................................................................................................... 9 Classification Labels ............................................................................................................................................................................................ 10 Labeling .................................................................................................................................................................................................................... 10 Third-Party Interactions ..................................................................................................................................................................................... 12 Declassification and Downgrading ............................................................................................................................................................... 12 Destruction and Disposal .................................................................................................................................................................................. 13 Special Considerations for Secret Information ........................................................................................................................................ 14 External Party Disclosure ..................................................................................................................... 15 Determining If Disclosure Is Appropriate................................................................................................................................................... 15 Preparing Information for Disclosure .......................................................................................................................................................... 16 Resolving Problems with Disclosure Processes ....................................................................................................................................... 17 Network Security .................................................................................................................................. 17 Introduction ............................................................................................................................................................................................................ 17 Responsibilities ..................................................................................................................................................................................................... 18 Physical Security ................................................................................................................................................................................................... 18 System Access Control ....................................................................................................................................................................................... 19 System Privileges.................................................................................................................................................................................................. 21 Computer Viruses, Worms, And Trojan Horses ....................................................................................................................................... 23 Data and Program Backup ............................................................................................................................................................................... 23 Encryption ............................................................................................................................................................................................................... 24 Logs And Other Systems Security Tools ..................................................................................................................................................... 24 Remote Printing .................................................................................................................................................................................................... 25 Production Data Center ..................................................................................................................................................................................... 25 Physical Security – See Appendix A – Expedient ................................................................................................................................ 26 Privacy ....................................................................................................................................................................................................................... 26 Exceptions ............................................................................................................................................................................................................... 26 Violations ................................................................................................................................................................................................................. 26 Firewall Security .................................................................................................................................................................................................... 27 Updated 4/14/2021 iii Table of Contents Personal Computers.............................................................................................................................. 28 Overview .................................................................................................................................................................................................................. 28 Business Use Only ................................................................................................................................................................................................ 29 Management .......................................................................................................................................................................................................... 29 Configuration Control ........................................................................................................................................................................................ 29 Access Control ....................................................................................................................................................................................................... 30 Physical Security ................................................................................................................................................................................................... 30 Networking ............................................................................................................................................................................................................. 31 Viruses ...................................................................................................................................................................................................................... 32 Backup ...................................................................................................................................................................................................................... 32 Destruction ............................................................................................................................................................................................................. 33 Telecommuting & Mobile Computing ............................................................................................... 33 Management Issues ............................................................................................................................................................................................ 33 Access Control ......................................................................................................................................................................................................