Information Security & Data Protection Policy
Document
Information Security & Data Protection Policy
Owner
Information Security Officer
Effective Date
October 18, 2026
Last Reviewed
October 18, 2026
Next Review
October 2027
1. Purpose
This policy establishes the framework by which Neponset University protects the confidentiality, integrity, and availability of personal information and institutional data. It is designed to comply with the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00) and other applicable federal and state law.
2. Scope
This policy applies to all personal information of Massachusetts residents in Neponset’s custody, all institutional data, and all systems on which such data resides, including third-party services contracted by Neponset.
3. Roles & Responsibilities
The President designates an Information Security Officer responsible for the program.
The Information Security Officer maintains the written information security program (WISP) required by 201 CMR 17.03.
All faculty, staff, and contractors are responsible for compliance and complete annual security training.
4. Administrative Safeguards
Annual risk assessment of internal and external threats.
Role-based access to personal information; access reviewed at least annually.
Background checks for personnel with access to sensitive systems.
Written contracts with third-party service providers requiring equivalent protections.
Documented procedures for onboarding and offboarding personnel.
Annual security awareness training for all personnel.
5. Technical Safeguards
Encryption of personal information transmitted across public networks and on portable devices.
Multi-factor authentication for staff access to administrative systems.
Reasonably up-to-date firewall and operating system security patches.
Reasonably up-to-date malware protection.
Monitoring of systems for unauthorized use of or access to personal information.
6. Physical Safeguards
Although Neponset operates without physical facilities, any printed records or removable media containing personal information are stored in locked, access-controlled locations and securely disposed of when retention requirements are met.
7. Incident Response
Suspected information security incidents must be reported immediately to the Information Security Officer. Neponset maintains a written Incident Response Plan covering containment, investigation, regulatory and individual notification (consistent with M.G.L. c. 93H), remediation, and post-incident review.
8. Data Retention & Destruction
See the Document Retention & Destruction Policy. Personal information is retained no longer than reasonably needed for the purposes for which it was collected.