October is Cybersecurity Awareness Month. That phrase can sound like just another awareness campaign – posters in the lobby, a reminder in your inbox, a button to click. At a small college like CMC, though, awareness months matter precisely because we are small. We know each other. That closeness is one of the best things about this place, and it is also what an attacker counts on when they compromise one inbox to reach a hundred.
One clicked link, one reused password, one unpatched laptop left on a library table – that is all it takes to put our students’ records, our faculty’s research, and the College’s daily operations at risk. I say that not to alarm anyone but because the fix is not a product we can buy. It is a set of habits. And habits, at a place like CMC, are something we build together.
This month, ITS is turning awareness into structure: a policy rollout, new data standards, a new governance committee, and a contest with prizes. Here is what each means for you.
The Responsible Secure Computing Policy (RSCP)
The RSCP is live on its own page on this site, with its official text in the College Catalog. This month we are rolling out awareness of it across campus, including into our employee security training. It comes down to four habits:
- Credentials – Multi-factor authentication on critical CMC accounts. Never share your password with anyone, including ITS staff; we will never ask for it.
- Devices – Keep them current and encrypted. Install software through ITS-approved channels. Lock your screen when you step away, even briefly.
- Data – Know how your data is classified, and store it where it belongs: institutional storage for institutional data.
- Phishing – When a suspicious message lands, use the Report Phishing button rather than simply deleting it. Every report helps protect everyone else.
If you read one thing this month, make it the RSCP. Five minutes, and you will know exactly what the College expects – and what you can expect from us.
Data Classification Standards
Alongside the RSCP, we are rolling out the CMC Data Classification Standards. Every piece of information the College holds falls into one of four tiers – from public information to restricted data whose exposure would cause direct harm. Student records, personnel files, donor information, sensitive research data: each tier tells you where that material may be stored, who it may be shared with, and how quickly it must be reported if something goes wrong.
I know classification can sound abstract, so let me make it concrete: if you have ever wondered whether it is acceptable to email a spreadsheet of advisees’ grades to your personal address so you can work from home, the Data Classification Standards exist to give you a clear, one-look answer instead of a guess. That clarity protects you as much as it protects the College.
Launching the IT Steering Committee
Good security practice needs a home. This month we are formally starting up the IT Steering Committee (ITSC) – a governance body that brings faculty and administrative voices together with ITS to review technology procurement, weigh data classification and platform governance, and help guide security practice college-wide. Security should never be an ITS-only conversation. The people who teach, advise, run offices, and manage research data deserve a direct say in how the College balances openness with protection, and the ITSC gives them that seat.
You can read about the committee’s charge and membership on its page under About ITS.
The Cybersecurity Month Contest
Not everything this month is policy. We are also running a cybersecurity contest for students, faculty, and staff – with prizes. It is a short, friendly challenge: spot the phishes, test your instincts, and see how your score compares across campus. Whether you are a first-year student, a longtime faculty member, or somewhere in between, it takes only a few minutes.
Enter the Cybersecurity Month contest.
What We Are Asking of You
ITS can harden systems, tune filters, and patch servers overnight. But the layered defense always ends at a person, and that person is you. So here is our ask, this month and every month:
- Employees should complete the security-awareness training when it reaches their inbox – it is short, and it is genuinely useful.
- Read the RSCP. Know the four habits.
- Enter the contest.
- And when something looks wrong, say something – to the Report Phishing button, the Help Desk, or me.
Security at a small college is not a wall between us and the world; it is the practice of looking out for one another. We do that here better than most places I have worked. Let us make October the month we turn that instinct into structure.
Enter the Cybersecurity Month contest – open to students, faculty, and staff, with prizes. It takes only a few minutes.
Enter the Contest → Read the RSCP Data Classification IT Steering Committee– Carlos De La Rosa, Chief Information Officer