Guideline

Request an Information Security Policy Exception

Summary

When a device doesn’t meet campus information security requirements, it poses a risk to all other devices on the network. Campus information security requirements are designed to protect our systems and data. Anything that doesn’t meet these requirements may face removal from the campus network if it poses a significant risk.

If you – or your department/unit – have a device or IT service that can’t meet campus information security requirements but must remain on the network, you should request a policy exception to avoid it...

Incident Response Planning Guideline

Looking for the Campus Incident Response Plan? Go to Campus Incident Response Plan instead. The below Incident Response Planning Guideline refers to systems and applications that need to adhere to Campus MSSEI policy.

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling covered data. The recommendations below are provided as additional guidance for the...

General Monitoring and Detection Guideline

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling covered data. The recommendations below are provided as additional guidance to meet the Network Monitoring requirements in MSSEI section 9.1.1.

MSSEI Requirement 9.1.1

Summary: Units must...

Commercial Software Assessment Guideline

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling Institutional Information. The recommendations below are provided as additional guidance for meeting security requirements for application software.

Requirement

From MSSEI requirement 1.1 Security Planning:
Information security requirements must be identified and addressed prior to development or acquisition of systems or software, and during all phases of development, from initiation through...

Data Encryption in Transit Guideline

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling covered data. The recommendations below are provided as additional guidance to assist with achieving requirements 6.1 Encryption In Transit and...

Authenticated Scans Guideline

UC Berkeley security policy mandates compliance with Minimum Security Standard for Electronic Information for devices handling Institutional Information. The recommendations below are provided as additional guidance for requirement 9.3 Privileged Scan.

MSSEI Requirement 9.3 Privileged Scan:

Units must implement privileged scans for vulnerability assessment of high-risk P3, P4...

Block Auto-run on Removable Devices Guideline - Retired

Guideline Retired - 2026

This Guideline was obsolete and has been retired as-of January 2026. Please refer to the current version of the Minimum Security Standards for Electronic Information (MSSEI) for current campus security requirements.

For questions, please contact security-policy@berkeley.edu

Data Access Agreement Guidelines - Retired

Guideline Retired - 2026

This Guideline was obsolete and has been retired as-of January 2026. Please refer to the current version of the Minimum Security Standards for Electronic Information (MSSEI) for current campus security requirements.

For questions, please contact security-policy@berkeley.edu

Need to Know Access Control Guideline - Retired

Guideline Retired - 2026

This Guideline has been retired as-of March 2026. Please refer to section 5.8 of the current version of the Minimum Security Standards for Electronic Information (MSSEI), including the linked Implementation Information, for current campus security requirements around Controlled Access Based On Need-To-Know.

For questions, please contact security-policy@berkeley.edu

Patching and Updates Guidelines

All UC Berkeley IT Resources and all devices connected to the UC Berkeley network or cloud services must comply with the Minimum Security Standard for Networked Devices. The recommendations below are provided as guidance to assist with achieving the “Patching and Updates” Requirements.

MSSND Patching and Updates Requirement

Devices connected to a UC Berkeley...