MSSEI Self Assessment Plan Step-by-Step Guide

Applications and systems that handle protected data are required to meet the campus Minimum Security Standard for Electronic Information policy (MSSEI).  The MSSEI Self Assessment Plan (SAP) is a tool for describing the controls in place to meet those requirements.  A completed MSSEI SAP for UC P4 classified systems is required before the Information Security Office (ISO) can assess compliance with campus security policies.

The following is a step-by-step guide for completing the MSSEI SAP, with instructions for what information needs to be provided in each section.  The self assessment plan is meant to be a snapshot in time of implemented security controls, and should be updated after any significant changes are made.

The self assessment plan is NOT meant to include information that can directly lead to the compromise of protected data, such as account credentials.  A completed SAP should be considered classified as UC P3 data and shared with collaborators on a need-to-know basis.

Other Compliance Responsibilities:

Please be aware that this assessment only addresses information security requirements and risks. A Privacy or Accessibility consultation may also be needed if your use case has privacy or accessibility implications. Some examples include:

• Privacy:
  • Information about European residents is involved;
  • If there are questions about the applicability of privacy-related laws or regulations, including data de-identification, data breach notification laws, HIPAA, FERPA, GDPR, and the California Consumer Privacy Act (CCPA); 
  • A Supplier is passing information classified at Protection Level P3 or higher to other third parties.
  • Please contact privacyoffice@berkeley.edu
• Accessibility:
  • Applications, tools, or products intended for student, departmental, or campuswide use
  • Please contact webaccess@berkeley.edu. If you need a web accessibility review of a website or web-based product, please also fill out a “Request a Clinic” form

Refer to the campus Data Classification Standard and guideline for details about how to classify campus data, including examples for each data class.  If unsure about the correct classification, contact ISO at policy@berkeley.edu for additional guidance.

Especially important to the description of the system are Section 3 - Architecture Model and Section 4 - Data Flow Description

In Section 5, Support & Development Staff:

• List any staff members who have elevated privileges* in the application or its underlying devices

• Include a description of their responsibilities and email contact information

* Elevated privileges may mean administrator permissions to make changes to the application configuration, or bulk access to protected data, etc.

6. Resources

Section 6, Resources, is intended for referencing system security documentation.*  The campus security policies are listed, but this section can also reference other documents or resources that impact security controls, such as departmental policies. 

* These references should not include any technical documentation that could be exploited by an attacker.

Step 2. Describe How MSSEI Requirements Are Being Met

Before attempting to complete this section, read the policy and guidelines for each requirement first.* The guidelines provide detailed recommendations about how to meet control requirements, including resources for campus services to help support MSSEI compliance efforts.

Instructions are provided for each MSSEI requirement.  Include as much detail as seems relevant, so that others reading the SAP will readily understand.

* There is a link to the guidelines for each MSSEI requirement in Section 7.

Covered Devices

The MSSEI policy defines three Device/Use Categories that are covered by the requirements:

• Institutional Devices

• Privileged Access Devices

• Individual Devices*

Each covered device has its own subset of MSSEI requirements based upon the protection level classification of the application or system.  To see which requirements apply for each device category, refer to the MSSEIBaseline Data Protection Profile Summary table.

Where applicable for each of the requirements in Section 7, space is provided to enter a description of the controls that apply for covered Institutional and Privileged Access Devices.