18-RFP2009 - Part H - Exhibit K - ITS Data Classification Policy - Final.pdf

Information Technology Services

Data Classification Policy

Policy Owner City of Alexandria Information Technology Services Department Policy Approver(s) City of Alexandria Information Technology Services

Related Policies Administrative Regulation 10-13: SECURITY OF CONFIDENTIAL OR SENSITIVE

DATA

Storage Location Effective Date tbd

Next Review Date [tbd following approval, then at regular intervals]

Purpose Data is a vital asset to the City of Alexandria (City). The City’s policy is to take reasonable and appropriate steps to identify and protect data originated or owned by the City, or entrusted to the company by others. All City data, regardless of format or medium (e.g., written, electronic, verbal) is covered by this policy, unless specifically exempted by the CISO, CIO, or Deputy CIO, in writing. That exemption will be reviewed on an annual basis.

Proper data classification, protection and handling are the responsibility of all company employees, including consultants, contractors and temporary employees.

The following documents comprise the execution of data classification for each department and are included in the enclosures section:

• The City’s Data classification policy — This policy document outlines the companywide responsibilities for identifying sensitive data.

• The City’s data handling guidelines — This is a living document that defines certain data classes and handling requirements.

Data Classification Definitions The following lists data classifications and their definitions. Examples listed are not inclusive, and if there is any ambiguity around the classification of the data, it should be sent to the CISO for review.

Class Definition Public Public data poses no risk to the company if made generally available. It does not require authentication, however that does not make it exempt from unauthorized disclosure. Some examples are:

• Marketing materials

• Strategic plan

• Open data

• Town hall meetings

Internal Internal data is data whose loss, corruption or unauthorized disclosure is of importance only inside the City and, therefore, would not result in a tangible https://alexandriava1.sharepoint.com/:u:/r/sites/COA-AdministrativeRegulations/SitePages/A.R.-10-13--Administrative-Regulations.aspx https://alexandriava1.sharepoint.com/:u:/r/sites/COA-AdministrativeRegulations/SitePages/A.R.-10-13--Administrative-Regulations.aspx business, financial or legal loss. While compromises are not critical, due care is required when handling this data. Examples include:

• Employee training materials

• Internal communication

• Policies, procedures, standards, and guidelines

Sensitive Sensitive data is data whose loss, corruption or unauthorized disclosure would seriously harm the City’s reputation or business position, resulting in severe financial, reputation and legal loss to either the City or its residents.

Examples include:

• Project details

• Employee performance review details

Confidential Confidential data is data whose loss, corruption or unauthorized disclosure would severely harm the City’s reputation or business position, resulting in severe financial, reputation and legal loss. This includes all regulated data (e.g. PCI-DSS, HIPAA). Information in this category is exempt from the Virginia Freedom of Information Act and other other applicable local, state, and federal regulations. Compromise of confidential information can also result impact law and order, government conduct, emergency services, and the privacy of the residents.

Some examples are:

• Personally Identifiable Information

• Information Technology Infrastructure documentation

• HIPAA data

• PCI-DSS data

• Emergency/Disaster Response/Business Continuity plans

All City data defaults to “Internal” unless otherwise labeled or defined in the City’s data handling guidelines.

Non-Compliance Violations of this policy or related misconduct will be addressed through established City procedures as outlined in City of Alexandria Administrative Regulation 6-20, Discipline of Employees. Sanctions for non-compliance may include, but are not limited to, one or both of the following:

1. Loss of access to the violated data source;

2. Disciplinary action outlined in City of Alexandria Administrative Regulation 6-20, Discipline of Employees.

Enclosures

(1) City of Alexandria’s Data Classification Policy

(2) Data Handling Matrix

(3) Data Classification Responsibilities

Revision History

Version ID Date of Change

Author Rationale

V2 3/21/2018 David Benson/Suellen Savukas Initial Draft V3 4/23/2018 David Benson Dev. Group Feedback V4 4/25/2018 David Benson Dev. Group Feedback V5 5/22/2018 David Benson/Ryon Saenz Security Addendum V6 5/23/2018 David Benson Training Clarification V7 7/9/2018 David Benson/Anthony Harvey Minor Edits/Sec. Addndm

Data-Handling Matrix The following matrix is required unless a department has its own approved set of procedures for labeling and handling sensitive data. Any standards or guidelines that are created by an individual department must have those documents approved, in writing, by the legal department.

Matrix

Public Internal Sensitive Confidential Storage Data Location. No restrictions. Company desktop/laptop and registered mobile devices; corporate databases and authorized SaaS applications.

Company desktop/laptop and registered mobile devices; corporate databases and authorized SaaS applications.

Company desktop/laptop and registered mobile devices; corporate databases and authorized SaaS applications.

Electronic Data Protection.

No requirement. Password authentication.

Password authentication; device-level encryption.

Multifactor authentication; device-level encryption;

Continuous monitoring.

Physical Data Protection.

No restrictions. Reasonable precautions to restrict display and access.

Store in a locked container.

Store in a locked container.

Labeling Electronic Data Must be explicitly labeled or defined as "public" in City's data classifications.

All unlabeled data should be considered internal, unless otherwise labeled or defined.

Label all electronic (Word, Excel, PowerPoint and others); use watermark option where possible in electronic documents.

Label all electronic (Word, Excel, PowerPoint and others); use watermark option where possible in electronic documents.

Physical Data Storage location (cabinet, folder, etc.) must be explicitly labeled.

City generated Public documents must be labeled for movement.

All unlabeled data should be considered internal, unless otherwise labeled or defined.

Storage location (cabinet, folder, etc.)

must be explicitly labeled. Documents must be labeled for movement.

Storage location (cabinet, folder, etc.)

must be explicitly labeled. Documents must be labeled for movement.

Access Control Granting of Access.

READ: No restrictions.

UPDATE: Data owner or designee.

READ: Data owner designates by role.

UPDATE: Data owner designates by role.

READ: Data owner designates by department or individual.

UPDATE: Data owner designates by individual.

READ: Data owner designates by individual.

UPDATE: Data owner designates by individual.

Transmission Email. No restrictions. No internal restrictions. External recipients require a nondisclosure agreement (NDA) in place and notice provided in the “Fax/Email Cover” section below.

Encrypted only.

External recipients require a NDA in place and notice provided in the “Fax/Email Cover” section below.

By data owner only and encrypted.

External recipients require a NDA in place and notice provided in the “Fax/Email Cover” section below.

Sharing. No restrictions. Only via authorized content collaboration platform (Onedrive/Sharepoint).

Encrypted only. Only via authorized content collaboration platform (Sharepoint/Fileserver).

By data owner only and. Only via authorized content collaboration platform (Sharepoint/Fileserver).

Large Transfers.

No restrictions. Consult IT. Consult IT and Legal. Consult IT and Legal.

Faxing. No restrictions. Take reasonable precautions to restrict access and confirm delivery to recipient.

Include Fax cover notice provided in the “Fax/Email Cover” section below.

Restrict access to sending machine during transmission, and notify recipient to stand by for receipt of fax and confirm delivery. Include Fax cover notice provided in the “Fax/Email Cover” section below.

Restrict access to sending machine during transmission, and notify recipient to stand by for receipt of fax and confirm delivery. Include Fax cover notice provided in the “Fax/Email Cover” section below.

Print/Copy Printing. No restrictions. Must be present at printer.

Must be present at printer. Printed copy must be watermarked and include date/time and the user printing.

Data owner only. Must be present at printer.

Printed copy must be watermarked and include date/time and the user printing.

Copying. No restrictions. In-house copying preferred; shred or place spoils and overruns in proprietary waste.

If outside copying is used, original should be returned to the company and spoils should be destroyed by the supplier.

In-house copying required; shred spoils or overruns.

In-house copying required; shred spoils or overruns.

Destruction Method

Electronic data. Any. Shred or place in proprietary waste.

Contact ITS. Contact ITS.

Physical data. Any. Shred or place in proprietary waste.

Shred. Shred.

Physical devices.

Any. Return device to ITS. Return device to ITS. Return device to ITS.

Fax Cover/Email Notice Disclaimer "Notice: The data contained in this message is proprietary data belonging to the City of Alexandria, VA and is intended for the confidential use of the addressee. If you are not the addressee, or an agent of the addressee, you are hereby notified that you have received this message in error and that any review, dissemination, distribution or copying of this message is strictly prohibited. If you have received this message in error, please notify us immediately."

Data Classification Responsibilities This section describes the roles and responsibilities assigned under the City’s data classification policy to all City employees, including consultants, contractors and temporary employees.

Although every employee is responsible for proper data classification, protection and handling at a basic level, additional data classification responsibilities are also present for various staff positions and organizations throughout the City. These include the following.

Employee Responsibilities

• Understand the guidelines referenced by this policy and handle all data in accordance with this policy and guidelines.

• Immediately report an accidental or malicious breach of this policy to the appropriate department.

Management Responsibilities

• Communicate this policy and ensure that employees receive appropriate training regarding this policy.

• Ensure compliance with this policy.

• Ensure appropriate notification of any breaches of this policy, especially those breaches subject to privacy law or other regulated disclosure notifications.

Data Owner Responsibilities

• Ensure that the data they are responsible for is properly classified.

• Periodically review and assess data classifications and adjust as required.

City Attorney’s Office Responsibilities

• Periodically review and assess data classifications; adjust as required.

• Provide a "data nondisclosure agreement" template to data owners and others that can be used when data is provided to third parties.

• Manage third-party nondisclosure agreements and provide guidance on how such third-party data should be classified and handled internally.

ITS Responsibilities

• Support data classification technologies that make possible the implementation of this policy.

• Support the infrastructure and security technologies that make possible the implementation of sensitive data-handling guidelines.

Records Management Department Responsibilities

• Ensure that data storage, handling, retention and destruction {standard or guidelines} outlined within this policy are followed.

Internal Audit Department Responsibilities

• Monitor compliance with this policy.