Portable storage media, such as approved USB drives, optical and tape media must be encrypted with strong passwords and proper key management in order to store Level 4 information. If you need an approved USB drive, have questions or need help, send an email to firstname.lastname@example.org to request an information security consultation for Harvard-approved external encrypted portable storage media.
It is important that anyone who performs administrative responsibilities on these systems have sufficient technical knowledge, via experience and/or training, to be able to implement these requirements and recognize when they need to seek help.
Servers storing or processing information belonging to more than one classification must meet the requirements associated with the highest classification. If you aren't able to identify whether or not a server may have HRCI, apply the level 4 controls.
Work from materials stored on approved servers or services and do not copy them to your local system. If you are conducting field research to collect Level 4 data and cannot meet this requirement send an email to email@example.com to request an information security consultation for Harvard-approved external encrypted portable storage media and process.
Before deletion or shredding of records, check to ensure that the records are no longer needed, and remember that some records that contain Social Security Numbers (SSNs) or other High Risk Confidential Information may be scheduled as eligible for transfer to Archives. Store any University Archives-selected identifiable records containing full SSNs securely; and see the HU...