Data Storage
Mobile devices such as laptops, USB (thumb/jump) drives, smartphones, music players, etc. offer a convenient and portable way to electronically store information. However, the convenience and portability of mobile devices often results in theft or loss of the devices. In order to protect university information the following requirements are being implemented at the university:
- Data will be protected while in storage based on its classification. (See the introduction of the initiatives for an explanation of the classifications.)
- Restricted data, as defined by the data classification, should not be stored on mobile devices or any non-network drive. (See the Encryption Initiative for the exception to this requirement.)
- University data may only be stored on university owned data storage media or devices.
How will this change affect me?
Storage of restricted data
Restricted data should only be stored on a network drive. Advantages to storing data on a network drive instead of on your local desktop or mobile device include allowing multiple users to access the information, protecting your access to the data should something happen to your computer or mobile device and allowing the data to be regularly backed up.
Storage of internal and public data
Any internal or public data may be stored on a network drive or on a university owned computer. Public data may be stored on a mobile device; however, additional controls will be necessary to permit storage of internal data on a mobile device.
Use of personally owned devices
University data should be stored only on university owned devices and as such non-university owned devices should not be connected to the faculty/staff network. When data is stored on university owned devices the university can maintain a better inventory of university data and systems and can better ensure that appropriate security controls are implemented.
This change will not prevent faculty, staff or students from connecting personal devices to computers in the labs, library or classrooms as such computers do not have access to restricted or internal data.
When will this change happen?
These requirements took effect for all Commonwealth of Virginia agencies on July 1, 2008.
The university is currently working to classify the sensitivity of all university data as part of the Data Classification and Risk Assessment Initiative and that classification will help determine where data may be stored in the future.
Who can I contact with questions or concerns?
Contact information for the Information Security Office is listed to the right.
Last updated:
October 13, 2009