Policies
100 Information Security Program
This policy is the foundation of the policy library and provides a rationale for the directives communicated in all other information security policies.
101 Information Security Status Monitoring, Reporting, and Review
This policy communicates logging requirements for academic, clinical, administrative, research, and technical information security activities at WashU.
102 Information Security Authentication, Authorization, and Audit
This policy outlines the process for granting, managing, and reviewing access to university systems and data based on user roles during normal and emergency operations at Washington University in St. Louis (WashU).
103 Information Security Device Management
This policy outlines security expectations for all devices (e.g., laptops, mobile phones, thumb drives, external hard drives, etc.) that access the information resources of Washington University in St. Louis (WashU) and includes specific details for devices handling WashU Protected Data and Information.
104 Information Security Vulnerability Management
This policy communicates the core principles and objectives for information security vulnerability management, including planning, detection, mitigation, and patching.
105 Information Security Risk Management
This policy describes how the Office of Information Security (OIS) helps manage technical and process risks to the Confidentiality, Integrity, and Availability (CIA) of information resources at Washington University in St. Louis (WashU).
106 Information Security Infrastructure Risk Management
This policy provides guidance and directives to the computing community at Washington University in St. Louis (WashU) to ensure the ongoing Confidentiality, Integrity, and Availability (CIA) of our information resources.
107 Information Technology Business Continuity and Disaster Recovery Planning
This policy communicates the expectations for developing, maintaining, and practicing risk-based plans for Information Technology Business Continuity (ITBC) and Information Technology Disaster Recovery (ITDR).
108 Information Security Requests to Access User Content
This policy describes how the Office of Information Security (OIS) handles requests for access to content created by active or former WashU Community members.
109 Information Security Incident Reporting, Response, and Recovery
This policy communicates a planned and systematic approach to incident handling from reporting to recovery and analysis.
110 Information Technology Change Control and Management
This policy outlines processes for maintaining the security and integrity of information assets throughout their lifecycles.
111 Information Security for Software Development, Management, and Administration
This policy establishes secure application development and procurement practices for departments and schools at Washington University in St. Louis (WashU).
112 Information Security Acceptable Use
This policy outlines expectations for the appropriate use of WashU-provided information resources, ensuring that all WashU Community members understand their responsibilities.
113 Information Security Encryption
This policy specifies acceptable encryption algorithms for use with Washington University in St. Louis (WashU) data, encryption requirements for WashU Confidential and Protected Data, and acceptable key management practices, following recommendations of the National Institute of Standards and Technology (NIST).
114 Information Security Exceptions
This policy clearly communicates how the OIS handles exception requests when compliance with published policies and standards is not possible.
115 Notice of Monitoring and Information Security Investigative Practices
This policy conveys the commitment of the OIS to the responsible collection, use, and safeguarding of personal information.