Dear GW Colleagues,

Information security breaches at corporations, government agencies, and universities are often in the headlines due to the fact that these compromises can result in the loss of individual personal information and the theft of customers’ and employees’ identities.

Examples of confidential information are:

• Medical records
• Student records and other non-public student data
• Social Security numbers
• Credit card and other financial information
• Personnel and/or payroll records
• Any data identified by government regulation to be treated as confidential, or sealed by order of a court of competent jurisdiction

GW takes the issue of protecting confidential information very seriously, and we have made significant progress in this regard.

• As a result of the GWid project, unique alphanumeric identifiers replaced the use of Social Security numbers for the majority of University services.
• GW’s Data Classification Policy sets the standard and definitions for the confidentiality, integrity, and availability of University data.
• Information Systems and Services (ISS) desktop support and the Local Support Partner (LSP) program helps departments greatly increase the security of GW-owned workstations on the GW network.
• ISS is conducting a test of commercially available encryption tools and will provide the GW community with information over the next few weeks.

Many faculty and staff responsibilities require access to confidential information. Therefore, vigilance regarding the protection of our community’s confidential information is everyone’s responsibility. The responsibility to protect confidential information passes to the faculty or staff member when it is downloaded from a secure system such as Banner or the Enterprise Accounting System (EAS). Please remember that confidential information also resides in other various locations that may be overlooked, like in salary plans, SRNs, or performance evaluations.

It is important for managers and employees to be aware of and adhere to the following:

• If you are required to download one or more person’s confidential information from a core system such as EAS or Banner, the information MUST be saved to your Novell home directory and not kept on the computer’s hard drive (C drive).

• If you have confidential information on the computer’s hard drive, immediately move those files to your individual Novell home directory or delete the files. To delete files, open the file folder, select the files to delete and move them to the Recycle Bin or right click on the files and select “Delete” (Do not use “Cut”). After deleting all the files, then right click on the Recycle Bin and select “Empty Recycle Bin”.

• It is critically important that confidential information is not stored on the hard drives of workstations or laptops. If there is a business requirement for faculty or staff to transport confidential information and it cannot be accessed from a Novell home directory, a secure device such as a password-protected USB key is recommended.

• If your office has a business need for transporting confidential data, please contact the ISS Information Security Office immediately at infosec@gwu.edu for assistance.