Harvard Law School Enterprise Security Policy

Introduction
Harvard and HLS have developed this Enterprise Information Security Policy to ensure that Harvard's technical resources are properly protected, that the integrity and privacy of confidential information is maintained, that information resources are available when they are needed and that users of these resources understand their responsibilities.
The following policies are provided with detailed information, including a discussion on the policy, approved solutions and FAQ.

Scope
These policies apply to everyone at Harvard Law School who works with Harvard or HLS confidential information, vendors that have access to HLS confidential information and to the physical and computer environments that support their work.

Policies
1.  High Risk Confidential Information (HRCI)

• 1.1 - Storing High-Risk Confidential Information
• 1.2 - Human Subject Information
• 1.3 - Personally Identifiable Medical Information

2.  Confidential Information

• 2.1 - Obtaining Harvard Confidential Information
• 2.2 - Protecting Confidential Information on Networks
• 2.3 - Making Information Available through Directories
• 2.4 - Identifying Users with Access to Confidential Information
• 2.5 - Inhibit Password Guessing
• 2.6 - Limit Application Availability Time
• 2.7 - Limit User Access to Confidential Information
• 2.8 - Confidential Information on Harvard Computing Devices
• 2.9 - Internet Access to Confidential Information
• 2.10 - Confidentiality Agreements
• 2.11 - Harvard University ID Numbers

3.  Student Information

• 3.1 - FERPA Directory Information
• 3.2 - FERPA Blocks

4.  Credit Card Information

• 4.1 - Accepting Credit Card Payments

5.  Physical Environment and Recording the Activities of Individuals

• 5.1 - Physical Environment
• 5.2 -Recording Information About the Activities of Individuals

6.  Working with Vendors / Contracts

7.  Computers & Servers

• 7.1 - Computer Operation
• 7.2 - Computer Setup
• 7.3 - Target Systems and Controllers
• 7.4 - Network Take-down and Vulnerability Scanning

8.  Other IT Policies

• 8.1 - IT Service Resumption

9.  Federal & Regulatory

• 9.1 - Physical High Risk Data Disposal
• 9.2 - Reporting Security Breaches
• 9.3 - Interacting with Legal Authorities

10. Web Based Surveys

Back to Top