Written Information Security Plan (WISP)

Purpose

The WISP was implemented to comply with various federal and state regulations including
but not limited to; the Federal Trade Commission [16 CFR Part 314], and with our obligations
under the financial customer information security provisions of the federal Gramm-Leach-
Bliley Act (“GLB”) [15 USC 6801(b) and 6805(b)(2)], and the FTC’s Red Flag Rules.

As such, the purpose of this Plan is to:

• Ensure the security and confidentiality of confidential or restricted information.
• Protect against any potential threats or hazards to the security or integrity of such
  information; and
• Protect against unauthorized access to, or use of, such information in a manner that
  creates a substantial risk of identity theft or fraud.

Scope

This Plan applies to all Saint Vincent College and Seminary employees, whether full- or part-
time, including faculty, administrative staff, contract, and temporary workers, hired
consultants, interns, and student employees, as well as to all other members of the Saint
Vincent Community (hereafter referred to as the “Saint Vincent”). It is to be considered a plan
setting a minimum standard for the securing of data. Each department is free to adopt more
stringent restrictions for its employees. Any request by a department for adoption of standards
or practices below the minimum set in this document must be approved in writing by the
President and/or Executive Vice-President of Saint Vincent. The department must renew its
request annually. This Plan also applies to certain contracted third-party vendors (see section
8 for further information). The data covered by this Plan includes any information stored,
accessed, or collected at the College or for College operations.

Policy Record

1. Effective Date: 06/23/2021
2. Approval: Fr. Paul Taylor, President
3. Policy History: Minor editorial updates for clarity, 10/27/2026
4. Policy Owner: Information Technology Department

Policy

SECTION 1: OBJECTIVE

The objective of Saint Vincent College in the development and implementation of this
comprehensive written information security plan (“WISP”), is to create effective
administrative, technical, and physical safeguards to ensure the protection and integrity of all
information received, maintained, and created by Saint Vincent College and Seminary. The
WISP sets forth our procedure for evaluating and addressing our electronic and physical
methods of accessing, collecting, storing, using, transmitting, and protecting all information
received, maintained, and created by Saint Vincent College and Seminary.

SECTION 2: DATA CLASSIFICATION

All data covered by this policy will be classified into one of three categories outlined below,
based on the level of security required for each, starting with the highest level.

Confidential

Confidential data refers to any data where unauthorized access, use, alteration, or disclosure
of this data could present a significant level of risk to Saint Vincent. Confidential data should
be treated with the highest level of security to ensure the privacy of that data and prevent any
unauthorized access, use, alteration, or disclosure.
Confidential data includes, but is not limited to, all data that is protected in accordance with
federal or state laws or regulations. These laws include, but are not limited to, 16 CFR 313
(Privacy of Consumer Financial Information), the Federal Gramm-Leach-Bliley Act, the
FTC’s Red Flag Rules, and 73. P.S. Ch. 43 (Breach of Personal Information Act). See
appendix A.

Restricted

Restricted data refers to all other personal and institutional data where the loss of such data
could harm an individual’s right to privacy or negatively impact the finances, operations, or
reputation of Saint Vincent. Any non-public data that is not explicitly designated as
Confidential should be treated as Restricted data.

Restricted data includes data protected by the Family Educational Rights and Privacy Act
(FERPA), referred to as student education records. This data also includes, but is not limited
to, donor information, research data on human subjects, intellectual property (proprietary
research, patents, etc.), College financial and investment records, employee salary
information, or information related to legal or disciplinary matters.

Restricted data should be limited to access by individuals who are employed by or matriculate
at Saint Vincent and who have legitimate reasons for accessing such data, as governed by
FERPA, or other applicable law or College policy. A reasonable level of security should be
applied to this classification to ensure the privacy and integrity of this data.

Public (or Unrestricted)

Public data includes any information for which there is no restriction to its distribution, and
where the loss or public use of such data would not present any harm to Saint Vincent or
members of the Saint Vincent Community. Any data that is not classified as Confidential or
Restricted should be considered Public data.

SECTION 3: DATA SECURITY COORDINATOR

Saint Vincent College has designated the Assistant Vice President, Information Technology,
and the Director of Infrastructure and Cybersecurity Services, to implement, supervise and
maintain the WISP. These designated employees (the “Data Security Coordinators”) will be
responsible for:

• Initial implementation of the WISP.
• Oversight of ongoing employee information security awareness training for all owners,
  managers, employees, and independent contractors that have access to confidential or
  restricted data on the elements of the Plan.
• Monitoring the Plan’s safeguards.
• Assessing Third Party Service providers that have access to and/or
  host/transmit/backup/maintain confidential or restricted data and requiring those service
  providers by contract to implement and maintain such appropriate security measures for
  confidential or restricted data.
• Reviewing the scope of the security measures whenever there is a material change in
  our business practices that may implicate the security or integrity of records containing
  confidential or restricted data.
• Identify and utilizes resources to be informed about information security threats and
  emerging vulnerabilities.
• Reviewing legislation and laws and updating policies and procedures as required.
• Report regularly to Executive Management and the Technology Board of Directors
  Committee the College’s status regarding information security and risk posture.

Procedures

SECTION 4: INTERNAL RISKS

To combat internal risks to the security, confidentiality, and/or integrity of any electronic,
paper, or other records containing confidential or restricted data, and evaluating and
improving, where necessary, the effectiveness of the current safeguards for limiting such
risks, the following measures are mandatory and effective as of June 22, 2021:

Administrative Measures:

• A copy of this WISP must be distributed to each current Saint Vincent employee at the
  commencement of their employment.
• Conducting an annual training session for all data stewards, managers, employees, and
  independent contractors who have access to confidential or restricted data on the
  elements of the WISP. All attendees at such training sessions are required to certify
  their attendance at the training, and their familiarity with our requirements for ensuring
  the protection of confidential or restricted information.
• When unfeasible to annual train part-time or contractual workers, training will be
  provided during reactivation of their network access.
• The amount of confidential or restricted information collected must be limited to the
  amount reasonably necessary to accomplish our legitimate business purposes.
• All data security measures will be reviewed whenever there is a material change in our
  business practice that may reasonably implicate the security or integrity of records
  containing confidential or restricted information. The Data Security Coordinators or a
  designee will be responsible for this review and will fully apprise Senior Cabinet and
  Departmental Management of the results of that review and any recommendations for
  improved security arising from that review.
• Confidential or restricted information must not be removed from the College premises
  in electronic or written form without legitimate business need and without the use of
  reasonable security measures including redaction or encryption of said confidential
  information.
• Written and electronic records containing confidential or restricted information will be
  securely destroyed or deleted at the earliest opportunity consistent with business needs
  or legal retention requirements. Our retention and secure destruction periods are
  included in the Saint Vincent College’s Retention and Destruction Policy. The
  document link can be found in this WISP’s Appendices.
• Employees are required to report suspicious or unauthorized use of confidential or
  restricted information to a supervisor or the Data Security Coordinators.
• Whenever there is an incident that requires notification, there will be an immediate
  mandatory post-incident review of events and actions taken, if any, with a view to
  determining whether any changes in our security practices are required to improve the
  security of confidential or restricted information for which we are responsible.

Physical Measures:

• Access to records containing confidential or restricted information must be limited to
  those persons who are reasonably required to know such information in order to
  accomplish our legitimate business purpose.
• At the end of the workday, all files and other records containing confidential or
  restricted information must be stored in locked rooms, offices, or cabinets. All data
  security measures will be reviewed whenever there is a material change in our business
  practice that may reasonably implicate the security or integrity of records containing
  confidential or restricted information. The Data Security Coordinators or a designee will
  be responsible for this review and will fully apprise management of the results of that
  review and any recommendations for improved security arising from that review.

Technical Measures:

• When employees who have access to confidential or restricted information are
  terminated (voluntary or involuntary), Saint Vincent College terminates their access to
  network resources and physical devices that contain confidential or restricted
  information. This includes termination or surrender of network accounts, database
  accounts, keys, badges, phones, and laptops or desktops.
• Employees’ user IDs and passwords must conform to accepted security standards. All
  accounts with multi-factor authentication must follow Digital Identity Guidelines (NIST
  SP 800-63-3) guidelines for password strength, security, two-factor authentication, and
  expiration.
  Where technically possible, all Saint Vincent maintained systems that store confidential
  or restricted information will employ automatic locking features which lock access after
  multiple unsuccessful login attempts.
• Electronic records (including records stored on hard drives and other electronic media)
  containing confidential or restricted information must be disposed of in accordance in a
  manner that complies with Guidelines for Media Sanitization (NIST SP 800-88). This
  requires that information be destroyed or erased so that confidential or restricted
  information cannot practicably be read or reconstructed.

SECTION 5: EXTERNAL RISKS

To combat internal risks to the security, confidentiality, and/or integrity of any electronic,
paper, or other records containing confidential or restricted information, and evaluating and
improving, where necessary, the effectiveness of the current safeguards for limiting such
risks, the following measures are mandatory and effective as of June 22, 2021:

• Employees must not email any student, parent, alumni, donors, supplier, vendor, staff or
  employees’ information or documents containing Confidential data without encryption.
• Reasonably up-to-date firewall protection and operating system security patches
  reasonably designed to maintain the integrity of confidential or restricted information
  installed on systems with confidential or restricted information.
• Reasonably up-to-date versions of system security agent software that includes malware
  protection and reasonably up-to-date patches and virus definitions installed on systems
  processing confidential or restricted information.
• Vulnerability scanning and access monitoring versions of system security agent
  software that includes malware protection and reasonably up-to-date patches and virus
  definitions installed on systems processing confidential or restricted information.

SECTION 6: THIRD-PARTY VENDOR AGREEMENTS

Saint Vincent exercises appropriate diligence in selecting service providers capable of
maintaining appropriate security safeguards for confidential and restricted information. The
primary budget holder for each department is responsible for identifying those third parties
providing services to the College that have access to confidential and restricted information.
All relevant contracts with these third parties are reviewed and approved by the Data
Coordinators to ensure the contracts contain the necessary safeguarding of confidential and
restricted information. It is a collaborative responsibility of the primary budget holders and
Data Coordinators to confirm the third parties are annually maintaining appropriate security
measures to protect confidential and restricted information consistent with this WISP.

SECTION 7: REPORTING DATA BREACHES

If you have reason to believe that any Regulated, Restricted, or Confidential data has been lost
or stolen or may have been compromised or there is the potential for identity theft, regardless
of the media or method, report the incident immediately by contacting
InfoSec@stvincent.edu.

SECTION 8: DEPARTMENTAL REQUIREMENTS

The Information Technology Department (Data Custodian) is responsible for maintaining the
technology infrastructure that supports access to the data, safe custody, transport, and storage
of the data and provide technical support for its use.

Each College department (Data Steward) is responsible for the implementation of this WISP
in each office or business unit within its department, and must develop associated written
processes and rules, consistent with the WISP, that address how the WISP will be followed. A
copy of the departmental rules must be provided to the Information Technology Department.

SECTION 9: ENFORCEMENT

Violations of this WISP or departmental rules related to may result in the suspension or loss
of user privileges, and/or discipline up to and including termination of employment. If
warranted, at Saint Vincent College’s sole discretion, additional civil, criminal, and equitable
remedies may be pursued.

Definitions

Risk: The probability of a loss of confidentiality, integrity, or availability of information resources.

Data: For the purposes of this document, data refers to information stored, accessed, or collected at
the Saint Vincent about members of the College Community.

Appendices

Appendix A Covered Information

Policies Cross-referenced:

• Acceptable Use Policy
• Information Risk Management Policy
• Retention and Destruction Policy

Appendix A

Personal Information or Personally Identifiable Information (PI/PII)

As defined by Pennsylvania law (73 P.S. Chapter 43), the first name and last name or first
initial and last name of a person in combination with any one or more of the following:

• Social Security number.
• Driver’s license number or a State identification card number issued in lieu of a driver’s
  license; or
• Financial account number, credit, or debit card number, in combination with any
  required security code, access code or password that would permit access to an
  individual’s financial account.

For the purposes of the WISP, PI/PII also includes passport number, alien registration number
or other government-issued identification number.

Controlled Unclassified Information (CUI)

Unclassified information (data) that does not meet the standards for National Security
Classification under Executive Order 12958, as amended, but is:

• Pertinent to the national interests of the United States or to the important interests of
  entities outside the federal government, and
• under law or policy requires protection from unauthorized disclosure, special handling
  safeguards, or prescribed limits on exchange or dissemination.

Federal financial aid data is considered CUI and as such, the Federal Government strongly
recommends implementing protection of unclassified information according to the National
Institute of Standards and Technology (NIST) NIST SP 800-171 framework.

Nonpublic Financial Information

The Gramm-Leach-Bliley Act (FTC 16 CFR Part 313) requires the protection of “customer
information”, that applies to any record containing nonpublic financial information (“NFI”)
about a student or other third party who has a relationship with the College, whether in paper,
electronic or other form, that is handled or maintained by or on behalf of the College. For
these purposes, NFI will include any information:

• A student or other third party provides in order to obtain a financial product or service
  from the College.
• About a student or other third party resulting from any transaction with the College
  involving a financial product or service; or
• Otherwise obtained about a student or other third party in connection with providing a
  financial product or service to that person.