Policy

The UC Berkeley Data and IT Resource Classification Standard is issued under the authority vested in the UC Berkeley Chief Information Officer by the UC Business and Finance Bulletin IS-3 Electronic Information Security (UC BFB IS-3), and in the Campus Cyber-risk Responsible Executive (CRE) by the UC Business and Finance Bulletin IS-12, IT Recovery (UC BFB IS-12).

The MSSEI applies to all devices used with Institutional Information, and to all IT infrastructure and services. Its requirements apply regardless of device ownership (e.g., University-owned, personal, third-party vendor, partner institution) or location (e.g., on-site, off-site, cloud).

An update to the Departmental Information Security Contact Policy was approved by the campus Compliance & Enterprise Risk Committee (CERC) in November 2022. The Policy defines Department-level responsibilities for ensuring prompt and appropriate action in the event of an information security incident. The main purpose of the Policy remains unchanged: to ensure that ISO is able to contact the proper people in each Department and have them take appropriate action in the event of a security incident. The specific responsibilities for both Departments and Information Security Contacts have been...

Per the Minimum Security Standards for Networked Devices Requirement #8: Remote Access Services, any service that provides or allows access to campus systems or networks from all (or significant portions) of the public Internet must be approved by the CISO -- see list.

This has always been true, but what does it actually mean for you, personally, as part of the UC Berkeley community?

UC Berkeley’s Roles and Responsibilities Policy identifies specific roles and responsibilities for protecting UC IT resources and information. It brings together responsibilities from a variety of UC Berkeley and University of California Policies so everything is in one place.

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling covered data. The recommendations below are provided as additional guidance for requirement 9.2 Continuous Vulnerability Assessment and Remediation.

These resources provide information and supporting documents relating to IS-3 and UC Berkeley's implementation of IS-3.

Guidance to secure your device to be protected under the Minimum Security Standards for Networked Devices

This Guideline was obsolete and has been retired as-of January 2026. Please refer to the current version of the Minimum Security Standards for Electronic Information (MSSEI) for current campus security requirements.

For questions, please contact security-policy@berkeley.edu