| Policy Number: |
ISO-1400
|
|---|---|
| Effective Date: |
May 7, 2019
|
| Last Revised Date: |
December 1, 2021
|
| Last Reviewed Date: |
October 9, 2026
|
| Applies To: |
Classified Staff, Appointed Personnel, University Staff, Students
|
| Responsible Unit(s): | |
| Responsible Unit Email(s): | |
| Status: |
Active
|
Purpose and Summary
This Policy defines University of Arizona (University) information security requirements for physical security measures to safeguard against unauthorized physical intrusion to secure facilities.
Scope
This Policy applies to all University-Related Persons, as well as all Information Systems and Information Resources owned or operated by or on behalf of the University.
Definitions
Information Owner means the individual(s) or Unit with operational authority for specified University Information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. Such individual(s) or Unit is responsible for making risk tolerance decisions related to University Information on behalf of the University and is organizationally responsible for any loss associated with a realized information security risk scenario.
Information Resource Owner means the Information Owners and Information System Owners.
Information Resources means University Information and related resources, such as equipment, devices, software, and other information technology.
Information Security Incident means an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an Information System or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.
Information System means a major application or general support system for storing, processing, or transmitting University Information. An Information System may contain multiple subsystems. Subsystems typically fall under the same management authority as the parent Information System. Additionally, an Information System and its constituent subsystems generally have the same function or mission objective, essentially the same operating characteristics, the same security needs, and reside in the same general operating environment.
Information System Owner means the individual(s) or Unit responsible for the overall procurement, development, integration, modification, and operation and maintenance of an Information System. Such individual(s) or Unit is responsible for making risk tolerance decisions related to Information Systems on behalf of the University and is organizationally responsible for the loss, limited by the bounds of the Information System, associated with a realized information security risk scenario.
Secure Facility means any University-owned facility (e.g., building, equipment, designated space within a building, infrastructure) that is not open to the public and has restricted access procedures established for purposes of maintaining the security or confidentiality of the information or other resources contained within it.
Unit means any University college, school, department, program, or other operating Unit.
University Information: means any communication or representation of knowledge, such as facts, data, or opinions, recorded in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual, owned or controlled by or on behalf of the University.
University-Related Persons means any University students and applicants for admission, University employees and applicants for employment, Designated Campus Colleagues (DCCs), alumni, retirees, temporary employees of agencies who are assigned to work for the University, and third-party contractors engaged by the University and their agents and employees.
User means any individual or group that interacts with a system or benefits from a system during its utilization.
Policy
All Classifications of University Information
- Information Resource Owners must ensure the protection of Secure Facilities containing University Information Resources in a manner proportional to the information security risk.
- Information Resource Owners must develop or adopt physical access procedures for Secure Facilities covered by the preceding paragraph. These procedures must meet the following minimum requirements:
- Procedures must be documented and must provide the ISO with the ability to monitor compliance.
- Physical access to Secure Facilities must be limited to authorized individuals who require access for the fulfillment of their job responsibilities and visitors who are always escorted by an authorized University-Related Person.
- Physical access and monitoring logs, where utilized, must be retained, stored, and disposed of in compliance with University retention requirements and applicable laws and regulations.
- Physical access authorizations must be:
- reviewed during provisioning;
- have documented approval;
- utilize change management;
- undergo an annual review; and
- be revoked in a timely manner when access is no longer required.
- Physical access devices (e.g., keys, key cards, etc.) must be appropriately protected and only enable access to areas the device User is authorized to enter.
- When an issuer cannot revoke authorization for a physical device (e.g., keys, etc.), the device must be returned to the issuer when it is no longer needed. Lost, stolen, or unreturned devices must be reported to the ISO immediately.
- Physical access breaches are Information Security Incidents and must be reported as such to the ISO.
Tracking, Measuring, and Reporting
- The Information Security Office must develop, test, review, maintain, and communicate a representation of the University’s information security practices to University leadership.
- The Information Security Office is authorized to track compliance of this Policy and produce reports of compliance measures to support University decision making.
- Academic and administrative Unit leaders are responsible for implementing and ensuring compliance with this Policy within their respective areas.
- Upon request, academic and administrative Unit leaders are responsible for providing the Information Security Office with information necessary to assess and report on compliance.
- Specific responsibilities may be delegated to designees; however, overall accountability for University Information Resources, information security risk, and compliance remains with academic and administrative Unit leaders.
Recourse for Noncompliance
- The Information Security Office is authorized to limit network access for individuals or Units not in compliance with all University information security policies and related procedures.
- In cases where University resources are actively threatened, the Chief Information Security Officer must act in the best interest of the University by securing the resources in a manner consistent with the Information Security Incident Response Plan.
- In an urgent situation requiring immediate action, the Chief Information Security Officer is authorized to disconnect affected individuals or Units from the network.
- In cases where University-Related Persons violate this Policy, the University may apply appropriate employee sanctions or administrative actions, in accordance with relevant administrative, academic, and employment policies.
Exceptions
- Any requests for exceptions to any information security policies must be submitted to the Chief Information Security Officer for review and approval pursuant to the Information Security Office Policy Exception Request Procedure.
Frequency of Policy Review
- The Chief Information Security Officer must review information security policies and procedures at least annually. This Policy may be revised based on these reviews.