Sacramento State is committed to protecting the confidentiality, integrity, and availability of information assets owned, leased, or entrusted to the University. Therefore, we hereby adopt both the California State University Information Security Policies and Standards and the Sacramento State Supplemental Information Security Policies.

Policies vs. Standards vs. Procedures

• Policies are formal statements created by the university that reflect our mission, which in this case is the protection of Sacramento State's information and assets.
• Standards are rules or actions that must be done to ensure our policies are being followed. They indicate expected behavior and must be enforced.
• Procedures are detailed step by step instructions on how to implement or adhere to the standards.
• Guidelines are recommended practices that are based on industry-standard practices.

Sacramento State Information Security Policy

CSU Information Security Policy and Standards

I. Policy

II. Scope

III. Roles and Responsibilities

IV. ISO Policies

Policies and standards are organized in the following, clickable index:

Govern (GV)

Policy Section	Supplemental Policies	Standards	Procedures, Guidelines, Others
GV.OC - Organizational Context		GV.OC - Organizational Context
GV.RM - Risk Management Strategy	CSU System Business Continuity Program	GV.RM - Risk Management Strategy PR.PS - Platform Security
GV.RR - Roles, Responsibilities, and Authorities
GV.SC - Cybersecurity Supply Chain Risk Management	Information Security Responsible Use Policy	GV.SC - Cybersecurity Supply Chain Risk Management PR.PS - Platform Security	General Provisions for Information Technology Acquisitions Information Security Requirements - Supplemental Provisions Higher Education Cloud Vendor Assessment Tool CA State Regulation

Identify (ID)

Policy Section	Supplemental Policies	Standards	Procedures, Guidelines, Others
ID.AM - Asset Management	Systemwide Records Information Retention and Disposition Schedules Implementation Policy Health Insurance Portability and Privacy Act(HIPAA) FERPA(Student Records) Privacy CSU Privacy Program	ID.AM - Asset Management	Sacramento State Data Classification and Protection Standard CSU Records Retention and Disposition Schedules Sacramento State Data Privacy Policy and Standards Sacramento State Campus Privacy Notice Sacramento State Data Security & Records Retention Sacramento State Data Reporting Governance General Data Protection Regulation Sacramento State Campus Device Standards Sacramento State Workstation Security Standards Sacramento State Common Workstation Standards Sacramento State High Risk Workstation Standards Sacramento State Student Device Standards Mobile Device Security Sacramento State Technology Procurement Request
ID.RA - Risk Assessment	CSU System Business Continuity Program	ID.RA - Risk Assessment	Sacramento State Data Classification and Protection Standard Sacramento State Vulnerability Management Standard Sacramento State Vulnerability Management Supplemental Standard for Workstations Sacramento State Vulnerability Exception Procedure Sacramento State Vulnerability Exception Request Form Sacramento State Quarantine Procedures

Protect (PR)

Policy Section	Supplemental Policies	Standards	Procedures, Guidelines, Others
PR.AA - Identity Management, Authentication, and Access Control		PR.AA - Identity Management, Authentication, and Access Control PR.DS - Data SecurityPR.PS - Platform Security	Sacramento State Access Control Standard – Identify Verification Sacramento State Access Control Standard – Authentication Sacramento State Level 1 Systems Access Review Template CA State Regulation
PR.AT - Awareness and Training	Information Security Responsible Use Policy	PR.AT - Awareness and Training
PR.IR - Technology Infrastructure Resilience		PR.IR - Technology Infrastructure Resilience	Sacramento State Data Classification and Protection Standard Sacramento State Vulnerability Management Standard Sacramento State Vulnerability Management Supplemental Standard for Workstations Sacramento State Vulnerability Exception Procedure Sacramento State Vulnerability Exception Request Form Sacramento State Quarantine Procedures CA State Regulation

Detect (DE)

Policy Section	Supplemental Policies	Standards	Procedures, Guidelines, Others
DE.CM - Continuous Monitoring		DE.CM - Continuous Monitoring	Sacramento State Vulnerability Management Standard Sacramento State Vulnerability Management Supplemental Standard for Workstations Sacramento State Vulnerability Exception Procedure Sacramento State Vulnerability Exception Request Form Sacramento State Quarantine Procedures Sacramento State Campus Web & Mobile Development Security Guideline

Respond (RS)

Policy Section	Supplemental Policies	Standards	Procedures, Guidelines, Others
RS.MA - Incident Management		RS.MA - Incident Management RS.AN - Incident Analysis RS.MI - Incident Mitigation	Sacramento State Data Classification and Protection Standard
RS.CO - Incident Response Reporting and Communication		RS.CO - Incident Response Reporting and Communication RS.MI - Incident Mitigation	Sacramento State Data Classification and Protection Standard

Recover (RC)

Policy Section	Supplemental Policies	Standards	Procedures, Guidelines, Others
RC.RP - Incident Recovery Plan Execution		RC.RP - Incident Recovery Plan Execution