CMC ITS Policy

Information Security Policy

Effective Date: May 1, 2026  ·  Aligned with NIST 800-171  ·  Review Cycle: Annual

TL;DR — Key Takeaways

  • This is CMC's technical backbone — NIST 800-171 aligned, covering confidentiality, integrity, and availability of all institutional data.
  • FERPA, GLBA, and HIPAA compliance is mandatory. All systems and data are governed by this policy regardless of where they are stored or processed.
  • MFA is required for all remote access and administrative functions. Non-compliance may result in immediate access suspension.

1. Overview

The Information Security Policy (ISP) is the technical backbone of CMC's security posture. Aligned with NIST 800-171 standards, this policy governs how the institution protects the confidentiality, integrity, and availability of its data to ensure FERPA, GLBA, and HIPAA compliance.

The ISP formalizes security practices already in place across CMC's infrastructure — regular log reviews, mandatory password changes upon account recovery, default data encryption at rest, and multi-factor authentication for network access. By codifying these procedures in policy, CMC ensures consistent enforcement and meets rigorous compliance standards across the Claremont Colleges consortium.

2. Scope & Applicability

This policy applies to:

  • All CMC employees, faculty, and staff
  • Students with institutional system access
  • Contractors and third-party vendors with system access
  • All devices connected to the CMC network (owned, leased, or personal)
  • All institutional data regardless of where it is stored or processed
  • All Claremont Colleges consortium members with shared system access

3. Core Principles: Confidentiality, Integrity, Availability

Confidentiality

Protect information from unauthorized access. Controls: MFA (Duo), RBAC, encryption at rest and in transit, DLP monitoring, network segmentation.

Integrity

Ensure data accuracy and prevent unauthorized modification. Controls: change management, integrity monitoring, version control, backup verification.

Availability

Maintain access to systems when needed. Controls: redundant infrastructure, Pure Storage & AWS backups, UPS/generator, incident response planning.

4. Identity & Access Management

  • All users must have a unique institutional identity (Single Student ID) — no shared accounts
  • Multi-Factor Authentication (Duo) is mandatory for all remote access and administrative functions
  • Account provisioning follows the principle of least privilege
  • Accounts are reviewed and deprovisioned on a regular cadence
  • Service accounts require documented approval and regular credential rotation

5. Network Security

  • All wireless networks require authentication — EduRoam (802.1X), CMC-Wired, CMC-Guest
  • Cisco Firepower Threat Defense firewalls protect all network perimeters
  • Intrusion Prevention Systems (IPS) monitor for malicious traffic in real time
  • Network segmentation isolates critical systems, research environments, and HIPAA workstations
  • VPN access requires MFA and all sessions are logged

6. Endpoint Security

  • All managed devices run approved endpoint management software (Microsoft Intune)
  • Antivirus and endpoint detection and response (EDR) is required on all managed devices
  • Full disk encryption (FileVault / BitLocker) is enabled by default on all issued devices
  • Remote wipe capability is maintained for all enrolled lost or stolen devices
  • Regular patch management ensures timely remediation of known vulnerabilities

7. Data Protection

  • Data is classified using the P1–P4 framework
  • P3 and P4 data must be stored on approved platforms only (Box, OneDrive, secured SharePoint)
  • Encryption is required for data in transit (TLS 1.2+) and at rest on all systems
  • Data retention schedules are enforced and aligned with FERPA, GLBA, and HIPAA requirements
  • DLP tools actively monitor and block unauthorized transmission of P3+ data

8. Incident Response

  • All security incidents must be reported immediately — do not attempt to self-resolve
  • Incident response follows NIST SP 800-61 guidelines
  • SIEM (Security Information and Event Management) monitors all systems 24/7
  • Regular tabletop exercises test and refine incident response capabilities

9. Compliance Framework

NIST 800-171 FERPA GLBA HIPAA SOC 2 CCPA
  • SOC 2 audit framework validates control effectiveness annually
  • NIST 800-171 compliance for all controlled unclassified information (CUI)
  • Annual penetration testing and vulnerability scanning via Tenable.io
  • Business Associate Agreements (BAAs) required for all HIPAA-covered services
"By formalizing these procedures in policy, CMC ensures consistent enforcement and meets the rigorous compliance standards required of a modern liberal arts institution." — CMC Chief Information Officer

10. Related Policies & References