Information Security

Context/Purpose

Information and the associated processes, systems and networks are valuable assets of the ��AV and the management of personal data has important implications for individuals. Appropriate protection is required for all forms of information to ensure business continuity and to avoid breaches of the law and/or contractual obligations. The ��AV is committed to the security of information, both within the college and in communications with third parties.

Policy Statement

This policy is intended to protect the security of the ��AV’s information assets and is applicable to all ��AV staff, faculty and students.

Scope

Compliance with Law or Legislation

The ��AV holds and processes information about employees, students, and other data subjects for academic, administrative and commercial purposes. When handling such information, the ��AV, and those to whom this Policy applies, must be in compliance with the current BC Freedom of Information and Protection of Privacy Act (FOIPOP) [RSBC 1996]. Responsibilities under the FOIPOP Act are set out in the ��AV’s Freedom of Information and Protection of Privacy Policy.

Responsibilities

Information security is the responsibility of all members of the ��AV community. Every person handling ��AV related information or using ��AV information systems is required to observe this Policy and these Regulations.
The ��AV’s Technology Steering Committee which includes ��AV Executives may establish specific procedures to ensure information security with regard to the ��AV-related information is protected. These procedures may include a matrix that defines who is responsible for the security of certain types of information and the measures required to protect that information.
Security Controls – The ��AV will maintain reasonable detection and prevention controls to protect against, and detect instances of, malicious software and unauthorized access to networks and systems. All users of ��AV’s computers, including laptops and mobile devices; on which ��AV-related information is kept shall comply with procedures established by the ��AV in order to ensure compliance with legislation and to ensure that up-to-date security controls are maintained on those systems.
All members of the ��AV community must report immediately to the Director of Technology Services or their delegate any observed or suspected security incidents where a breach of this policy has occurred.

Definitions

For the purposes of this Policy, “information security” means the preservation of:

a) Confidentiality – i.e. protecting information from unauthorized access and disclosure;

b) Integrity – i.e. safeguarding the accuracy and completeness of information and processing methods; and

c) Availability – i.e. ensuring that information and associated services are available to authorized users when required.

For the purposes of this policy “information” includes all data and information that is printed or written on paper, stored electronically, transmitted by post or using electronic means including cloud based services or social media sites, shown on visual media, or spoken in conversation.

Procedures

Policy Review

The ��AV’s Technology Steering Committee will review and make any recommendations for update of this policy to the ��AV Management Committee before it is submitted to the Board of Governors.

����AV