Fragmented Campus Security Complicates Universities’ Compliance and Incident Response

Summary

An explainer on how fragmented, multi-campus IT can complicate universities’ security response and compliance with FERPA, GLBA, HIPAA and CMMC when regulated data is involved.

Key points

• Separate campus systems, teams and data stores can delay incident scoping and make it harder to identify affected data and applicable reporting duties.
• The article describes FERPA-related notification to Federal Student Aid within 24 hours when a breach compromises financial aid data.
• It says GLBA-covered institutions need a written security program, including risk assessment, access controls, encryption, incident response and vendor oversight.
• Health data may be held outside university hospitals; the article describes HIPAA reporting requirements for breaches affecting 500 or more people.
• CMMC Level 2 requires 110 security practices for organizations handling covered defense research, and noncompliance can affect contract eligibility.
• The article recommends shared visibility, consistent data classification, centralized security and compliance evidence, and tested incident response processes.

Industries