Data and IT Resource Classification Standard

Table of Contents:

I. Overview

II. Scope

III. Definitions

IV. Classification Levels

• Business Impact

• Protection Level Classification Table

• Availability Level Classification Table

• Recovery Level Classification Table

V. Additional Information

VI. Responsibilities

VII. Related Documents and Policies

Protection 
Level P4

(formerly UCB PL2 and PL3)

Institutional Information and related IT Resources that require notification to affected parties in case of a confidentiality breach. This category also includes data and systems that create extensive "Shared-Fate" risk, where a compromise would cause further and extensive compromise among multiple (even unrelated) sensitive systems.

Unauthorized disclosure or modification of P4 data or resources could result in significant fines or penalties, regulatory action, or civil or criminal violations. There is also an inherent significant risk to UC reputation and business continuity, along with harm or impairment to UC students, patients, research subjects, employees, or guests/program participants.

• Data or systems that create extensive "Shared-Fate" risk between multiple sensitive systems, e.g., enterprise credential stores such as the CalNet credential database; Domain Name Service (DNS). This can include both campuswide and unit-level systems. 
• Data elements with a Statutory Requirement for Notification to affected parties in case of a confidentiality breach, such as:
  • Government issued identification numbers:
    • Social Security number (SSN), Driver's license number, California ID card number, Tax ID number, passport number, military ID number, other government-issued ID numbers
  • Financial account numbers, credit or debit card numbers and financial account security codes, access codes, or passwords
  • Personal medical information, including protected health information (PHI) covered under HIPAA 
  • Personal health insurance information
  • Biometric data used for authentication purposes, including facial recognition
  • A username or email address, in combination with a password or security question and answer that would permit access to an online account

  • Genetic data as defined by California AB-825 (effective 1/1/2022)

• General Data Protection Regulation (GDPR) "special categories" of identifiers (Article 9).
• Passwords, PINs and passphrases, or other authentication secrets that can be used to access P4 information or to manage P4 IT Resources 
• Federal Controlled Unclassified Information (CUI)
  

• Personally Identifiable information about loans (including student loans), federally funded student financial aid, and any other financial aid that requires repayment

• Official financial, accounting, and payroll systems of record and authoritative source systems; also systems that handle and process financial transactions, and the account codes, account numbers, PINs, etc. necessary to make the transactions 
• Individually identifiable human subject research data containing P4 data elements, or that the Institutional Review Board (IRB) or Campus Privacy Office determines is high risk/P4
• Human genomic data subject to GDPR or HIPAA (regardless of de-identification status)
• High risk export controlled data or technology (DoE 10 CFR Part 810, high-risk EAR/ITAR). Contact the Export Control Office for a determination.
• Industrial Control Systems affecting life and safety
• individually identifiable criminal background check information

Protection 
Level P3

(formerly UCB PL1)

Institutional Information and IT Resources whose unauthorized use, access, disclosure, acquisition, modification, loss, or deletion could result in moderate fines, penalties, or civil actions. This classification level also includes lower risk items that, when combined, represent an increased risk. 

Unauthorized disclosure or modification of P3 data or resources could result in legal action, harm the privacy of a group, cause moderate financial loss, or contribute to reputational damage.

• 500 or more records of personally identifiable information not specifically classified elsewhere in this Standard
• Personal information as defined in the European General Data Protection Regulation (GDPR) or China’s Personal Information Protection Law (PIPL) regardless of record count. Must not include GDPR "special categories" of identifiers (Article 9) - see P4 section
• FERPA-Protected Student Records not containing P4 information. Does not include: 
  • P2 Public Directory Information

  • Student IDs with no additional identifying or FERPA-protected information -OR- student email addresses with no additional identifying or FERPA-protected information

• Security camera recordings, body-worn video system recordings, and cameras recording cash handling or payment card handling areas
• Building entry records
• Individually identifiable location data that tracks an individual's movement or building/room-level location
• Animal research protocols, and data related to animal researchers and members of the Animal Research Committee 
• Attorney-Client Privileged Information
• Individually identifiable human subject research data not containing P4 data elements and that the IRB or Campus Privacy Office have not determined is high risk. This includes human genomic data that can be re-identified using publicly available data.
• Low risk export controlled data or technology (EAR/ITAR). Contact the Export Control Office for a determination.
• IT security information, exception requests and system security plans
• Staff and academic Personnel Records not containing P4 information. Does not include P2 Public Directory Information
• Medical devices supporting diagnostics (not containing P4 information)
• Industrial control systems affecting operations

Protection 
Level P2

(formerly UCB PL0 and PL1)

Institutional Information and IT Resources that may not be explicitly protected by statutes or other contractual regulations, but are not commonly intended for public use or access and should only be accessed on a need-to-know basis. 

Unauthorized disclosure or modification of P2 data could result in minor damage or small financial loss, or cause a minor impact on the privacy of an individual or group.

• Information intended for release only on a need-to-know basis, including personal information not otherwise classified as P1, P3 or P4
• Non-P3/P4 data protected or restricted by contract, grant, or other agreement terms and conditions

• De-identified human subject or patient information (with negligible re-identification risk and no Notice-Triggering data elements) that the IRB or Campus Privacy Office have not determined is considered P3 or P4

• Routine email and business records not containing P3 or P4 information
• Exams (questions and answers)
• Calendar information not containing P3 or P4 information
• Meeting notes not containing P3 or P4 information
• Non-public research using publicly available data
• UCPath Employee ID
• Public Directory Information for faculty, staff, and students who have not requested a FERPA block
• Licensed software/software license keys
• Library paid subscription electronic resources

Protection 
Level P1

(formerly UCB PL0)

Information intended for public access, but whose integrity is important. For P1, unauthorized modification is the primary protection concern. The application of minimum security requirements is sufficient.

• Public-facing informational websites
• Course listings and prerequisites
• Public event calendars
• Hours of operation
• Parking regulations
• Press releases
• Published research

Definition: Loss of Availability would have a significant business impact to the Campus, a Campus Unit, and/or essential services. It may also cause serious financial losses. IT Resources that are required to be available by statutory, regulatory and/or legal obligations fall into this risk level. Critical IT Infrastructure also falls into this category.

• Central Campus authentication systems
• Student learning management system
• Backup data systems for A4 resources
• Central system management consoles
• Core network services, e.g. DNS, border/core routing, and firewalls
• Enterprise email 
• Official financial, accounting, and payroll systems of record and authoritative source systems; also systems that handle and process financial transactions, and the account codes, account numbers, PINs, etc., necessary to make the transactions
• Building access systems
• Medical records system
• IT infrastructure and industrial control systems affecting life and safety (e.g. emergency 911 location system)
• Campus procurement system
• Campus time reporting system

Availability
Level A3

Definition: Loss of availability would result in moderate financial losses and/or reduced customer service.

• Event ticketing systems
• Point-of-sale (POS) systems
• Issue tracking systems
• Security logs
• Building management systems
• File servers supporting business operations
• Operational knowledge base
• Clinical trial management system
• Medical devices supporting diagnostics
• Industrial control systems affecting operations
• Collaboration services such as calendaring, file sharing, code repositories

Definition: Loss of availability may cause minor losses or inefficiencies.

• Departmental websites
• Student life management system
• Staff learning management system
• Informational knowledge base

Definition: Loss of availability poses minimal impact or financial loss.

• Individual workstations, laptops, and other mobile devices
• Public directory
• Copy machines or printers

15 minutes

Core technology and infrastructure

Examples include: campus-wide authentication service, campus-wide key card access, campus-wide networking, Enterprise storage systems

Up to 6 hours

Critical 1 - Life/safety/alternatives not sustainable

Examples include: VPN services, reporting platforms, CRM systems, animal life/safety, electronic medical record (EMR) system

Recovery
Level R3

Up to 24 hours

Critical 2 - Alternatives sustainable up to 24 hours

Examples include: campus financial systems, HR systems, campus Zoom, campus website

Up to 5 days

Necessary

Examples include: Research storage systems, departmental informational websites

Up to 30 days

Deferrable

Examples include: productivity tracking tools (depending on use case), internal library staff applications, museum archives