U10: Information designated Level 3 or higher may only be used, stored or processed on servers or services (such as file sharing or collaboration services, file transfer systems, cloud-based backup and recovery services, etc.) that meet applicable Harvard data protection requirements.

U9: Information designated Level 3 must not be stored on user devices, or portable media, unless the device or media is encrypted.

U8: All devices (including desktops, laptops and mobile devices such as smartphones and tablets) storing or processing confidential information must meet Harvard device protection requirements.

See User Device Requirements.

U7: Confidential information (Level 2+) must only be shared with those authorized to receive it. 

U6: Confidential information must only be accessed for authorized purposes.

U5: Passwords must be changed immediately if there is suspicion of compromise.

U4: Passwords used on all systems for Harvard business should be of sufficient length and complexity to reasonably protect them from being guessed by humans or computers. Further, users must leverage multi-factor authentication (two-step verification) wherever supported. (Harvard systems behind HarvardKey authentication will meet our length, complexity, and multi-factor standards.)

U3: Different passwords must be used for Harvard and non-Harvard accounts.

U2: All passwords and other access credentials must be protected. They must never be stored in plaintext and must not be stored directly in scripts or configuration files.

U1: Users’ passwords and other access credentials must never be shared.

V2. Written contracts including appropriate university riders must be executed with all vendors/other third parties who collect, process, host, or store information classified as Level 3 and above.   ...

V1. Written contracts and appropriate riders must be executed with all vendors and other third parties who have access to Harvard non-public systems.

P6: Destruction of records must be accomplished by means that make it impossible to reconstruct the records.

P5: Level 3 or 4 records can be faxed to a non-public fax machine only if arrangements have been made so that the intended recipient will take the copies off the machine immediately upon receipt.

P4: Any physical transfer of records must use means that are appropriately secure and such transfers must be tracked to confirm that they actually reached the intended recipient.