Information Systems Media Protection
BLINN COLLEGE ADMINISTRATIVE REGULATIONS MANUAL
SUBJECT: Information Systems Media Protection
EFFECTIVE DATE: March 1, 2020; amended September 19, 2023
BOARD POLICY REFERENCE: CS
PURPOSE
Develop policies and procedures for information system maintenance.
PROCESS
Media Protection Policy and Procedures (MP-01)
The College District
- Develops, documents, and disseminates to information system owners:
- A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and
- Reviews and updates the current:
- Media protection policy biennially; and
- Media protection procedures annually.
Media Protection Policy
All electronic media containing sensitive or personally identifiable information must be protected and secured to limit access to authorized personnel and systems only. Electronic media in employee portable devices must be encrypted using current cryptographic technology (IA-07). Portable media containing sensitive or personally identifiable information must be encrypted using current cryptographic technology (IA-07). Electronic media while not physically in its information system must be physically stored in a locked room or container.
All electronic media must be destroyed using means of physical destruction or using crypto or secure erase techniques per NIST guidelines. Documentation of electronic media including serial numbers of hard drives disposed must be maintained for three years by information system owners.
Information system owners are responsible for implementing the media protection policy.
Media Access (MP-02)
The College District restricts access to removable media containing sensitive or personally identifiable information to information system owners and authorized users.
Media Sanitization (MP-06)
The College District
- Sanitizes portable and removable media prior to disposal, release out of organizational control, or release for reuse using physical destruction, crypto or secure erase techniques in accordance with applicable state, federal and organizational standards and policies; and
- Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Academic Technology has primary responsibility for sanitizing and disposing of media in coordination with the Purchasing department. A media sanitization departmental procedure further defines the handling of media that stored confidential information.
Media Use (MP-07)
The College District prohibits the use of portable media containing sensitive or personally identifiable information that is not encrypted.