PLNU is committed to protecting the privacy of its students, alumni, faculty, and staff and the confidentiality, integrity, and availability of information important to the University's mission.
Classifications help determine how data should be handled based on sensitivity and risk level.
PLNU uses a three-tier data risk classification model: Low Risk, Medium Risk, and High Risk. To clarify handling expectations, these risk levels are further described using the terms Public, Internal / Protected, and Restricted. These descriptive terms do not replace the risk levels but are intended to reinforce appropriate handling and protection requirements.
Low Risk (Public)
Data and systems are classified as Low Risk if they are not considered to be Medium or High Risk, and:
- The data is intended for public disclosure, or
- The loss of confidentiality, integrity, or availability of the data or system would have no adverse impact on our mission, safety, finances, or reputation.
Medium Risk (Internal / Protected)
Data and systems are classified as Medium Risk if they are not considered to be High Risk, and:
- The data is not generally available to the public, or
- The loss of confidentiality, integrity, or availability of the data or system could have a mildly adverse impact on our mission, safety, finances, or reputation.
Research data may be classified as Medium Risk or High Risk depending on contractual obligations, regulatory requirements, ethical considerations, or sponsor-imposed restrictions.
High Risk (Restricted)
Data and systems are classified as High Risk if:
- Protection of the data is required by law/regulation,
- PLNU is required to self-report to the government and/or provide notice to the individual if the data is inappropriately accessed, or
- The loss of confidentiality, integrity, or availability of the data or system could have a significant adverse impact on our mission, safety, finances, or reputation.
Data Risk Classification Examples
Use the examples below to determine which risk classification is appropriate for a particular type of data. When mixed data falls into multiple risk categories, the data must be handled according to the highest applicable risk classification.
Low Risk (Public)
- Information authorized to be available on or through PLNU's website without authentication
- Policy and procedure manuals designated by the owner as public
- Job postings
- Information in the public domain
- Publicly available campus maps
Medium Risk (Internal / Protected)
- Student records and admission applications
- Faculty/staff employment applications, personnel files, benefits, salary, birth date, personal contact info
- Non-public PLNU policies and policy manuals
- Non-public contracts
- Internal memos, email, non-public reports, budgets, plans, financial info
- University and employee ID numbers
- Research data not subject to export controls, IRB requirements, or contractual confidentiality
Research data may be classified as Medium Risk or High Risk depending on contractual obligations, regulatory requirements, ethical considerations, or sponsor-imposed restrictions.
High Risk (Restricted)
- Health Information, including Protected Health Information (PHI)
- Health Insurance policy ID numbers
- Social Security Numbers
- Credit card numbers
- Financial account numbers
- Export controlled information
- Driver's license numbers
- Passport and visa numbers
- Research data subject to export control regulations, IRB/human subjects requirements, or contractual/sponsor-imposed confidentiality
- Security and authentication artifacts, including:
- Passwords (hashed or plaintext)
- Multi-factor authentication secrets
- API keys
- Encryption keys
- Access tokens
- Private certificates
Approved Services
Use the following approved services to store and handle classified data securely:
| Service Name |
Low Risk |
Medium Risk |
High Risk |
High Risk (PHI) |
| AdobeSign |
✔ |
✔ |
✔ |
✔ |
| Calendar (Google Calendar) |
✔ |
✔ |
|
|
| Canvas |
✔ |
✔ |
|
|
Cloud Infrastructure: Amazon Web Services
IMPORTANT: Only approved for High-Risk & PHI data with the provision set up by, configured, and managed by ITS. Only HIPAA-approved services allowed for PHI-containing cloud accounts. |
|
|
|
✔ |
| Coursedog |
✔ |
✔ |
|
|
| CrashPlan |
✔ |
✔ |
✔ |
✔ |
| Dialpad |
✔ |
✔ |
✔ |
|
| Email (Gmail) |
✔ |
✔ |
✔ |
|
| Endpoints (PLNU Managed Computers) |
✔ |
✔ |
✔ |
✔ |
| Files.com |
✔ |
✔ |
✔ |
✔ |
| Google Drive |
✔ |
✔ |
✔ |
✔ |
| ITS & Facilities Ticketing (TeamDynamix) |
✔ |
✔ |
✔ |
|
| Messaging (Dialpad Messaging) |
✔ |
✔ |
|
|
| Messaging (Google Chat) |
✔ |
✔ |
|
|
| myPLNU |
✔ |
✔ |
✔ |
|
| Office 365 |
✔ |
✔ |
✔ |
|
| OneLogin |
✔ |
✔ |
✔ |
|
| OneTrust |
✔ |
✔ |
|
|
| Point N Click |
✔ |
✔ |
✔ |
✔ |
| Printers (Printing and Scanning) |
✔ |
✔ |
✔ |
|
| Qualtrics |
✔ |
✔ |
|
|
| Slack (ITS) |
✔ |
✔ |
|
|
| Virtual Desktops |
✔ |
✔ |
✔ |
✔ |
| Workday |
✔ |
✔ |
✔ |
✔ |
| Zoom |
✔ |
✔ |
✔ |
✔ |