Overview
George Mason University employees and other authorized individuals are responsible for protecting university information throughout its lifecycle. The level of protection required depends on the information’s sensitivity, intended use, and applicable legal, regulatory, or university requirements. Classifying information helps determine the appropriate safeguards, storage locations, access permissions, sharing methods, and retention requirements. Information that requires greater protection must be secured with stronger controls.
Classification helps determine:
- How it may be shared or transferred
- How it must be protected
- How it must be retained and disposed of
- Where it may be stored
- Who may access it
Who Must Follow These Requirements
The requirements apply when the following individuals conduct administrative, educational, financial, research, service, or other university business:
- Affiliates
- Faculty
- Independent contractors
- Other individuals who handle university information
- Staff
- Student and Student employees
- Vendors
Information Covered
These requirements apply to university data, information, and records in any format, including:
- Audio and video
- Digital text and files
- Images
- Microfilm
- Other physical or electronic records
- Paper documents
Handling information includes:
- Accessing or viewing
- Creating or collecting
- Disposing of or destroying
- Managing or preserving
- Sharing, transferring, or mailing
- Storing
- Using
Before You Store or Share University Information
- Determine its classification.
- Follow applicable records-retention and disposal requirements.
- Identify any legal, regulatory, contractual, security, or university requirements that apply.
- Identify the information involved.
- Limit access to individuals with an authorized university business need.
- Select a Mason-approved storage or collaboration service appropriate for the information’s classification.
IMPORTANT
If a file, dataset, or record contains information from more than one classification, apply the requirements for the highest classification. This approach is known as the high-watermark principle.
Storage Solutions and Data Classification Matrix and Tables
Storage Services/Solution Matrix
Use the following resources to classify information and select an appropriate storage service:
| Function | Shortcut |
|---|---|
| Clear Page or Start Over | F5 |
| Delete Record | SHIFT+F6 |
| Down/Next Record | Down Arrow |
| Execute Filter Query | F7 |
| Execute Query | F8 |
| Exit, Cancel Page, Close Current Page, or Cancel Search/Query (in Query mode) | CTRL+Q |
| Insert/Create Record | F6 |
| List of Values | F9 |
| Next Field or Item | Tab |
| Next Section | ALT+Page Down |
| Open Related Menu | ALT+SHIFT+R |
| Open Tools Menu | ALT+SHIFT+T |
| Previous Field or Item | SHIFT+Tab |
| Previous Section | ALT+Page Up |
| Save | F10 |
| Search or Open Filter Query | F7 |
| Select on a Called Page | ALT+S |
| Start Over | F5 |
| Up/Previous Record | Up Arrow |
Highly Sensitive Data
| Function | Shortcut |
|---|---|
| Change MEP Context | CTRL+SHIFT+C |
| Choose/Submit | ENTER |
| Clear All in Section | SHIFT+F5 |
| Clear One Record | SHIFT+F4 |
| Clear Page or Start Over | F5 |
| Count Query | SHIFT+F2 |
| Delete Record | SHIFT+F6 |
| Down/Next Record | Down Arrow |
| Duplicate Item | F3 |
| Duplicate Selected Record | F4 |
| Edit | CTRL+E |
| Execute Filter Query | F7 |
| Execute Query | F8 |
| Exit, Cancel Page, Close Current Page, or Cancel Search/Query (in Query mode) | CTRL+Q |
| Expand/Collapse Drop-down Field | ALT+Down Arrow |
| Export | SHIFT+F1 |
| First Page | CTRL+Home |
| Insert/Create Record | F6 |
| Last Page | CTRL+END |
| List of Values | F9 |
| More Information | CTRL+SHIFT+U |
| Next Field or Item | Tab |
| Next Page Down | Page Down |
| Next Section | ALT+Page Down |
| Open Menu Directly | CTRL+M |
| Open Related Menu | ALT+SHIFT+R |
| Open Tools Menu | ALT+SHIFT+T |
| Page Tab 1 Page Tab 2 and so on | CTRL+SHIFT+1 CTRL+SHIFT+2 and so on |
| Previous Field or Item | SHIFT+Tab |
| Previous Page Up | Page Up |
| Previous Section | ALT+Page Up |
| Print Screenshot | CTRL+Alt+P |
| Refresh or Rollback | F5 |
| Save | F10 |
| Search or Open Filter Query | F7 |
| Select | ALT+S |
| Toggle Multi/Single Records View | CTRL+G |
| Up/Previous Record | Up Arrow |
Restricted Data
[table “154” not found /]Public Use
Definitions
Data Owner
A data owner is the university official or designated authority responsible for approving access to and appropriate use of specific university information.
High-Watermark Principle
The high-watermark principle requires applying the controls associated with the highest classification when information from multiple classification levels is stored, shared, or handled together.
Personally Identifiable Information
Personally identifiable information is information that allows an individual’s identity to be reasonably determined through direct or indirect means.
Examples may include:
- Biometric record
- Name
- Other information that can be linked to a specific individual
- Social Security number
Record
A record is any document, data, or file created or received while conducting public business that provides evidence of that business, regardless of its format or storage medium.
Examples may include:
- Administrative records
- Fiscal documentation
- Student academic files
Related University Policies
Data Stewardship
University Policy 1114 establishes responsibilities and general methods for controlling and appropriately managing public and university data. The policy applies to university information systems and uses of public and university data.
Physical and Logical Access Security
University Policy 1312 establishes access and security requirements intended to protect the privacy, security, and confidentiality of university systems.
Records Management
University Policy 1102 establishes responsibilities for managing, retaining, and destroying public records.
Responsible Use of Computing
University Policy 1301 establishes requirements for the appropriate use of Mason computing services.
Additional Resources
- Compare Storage Services and Solutions
- Government Data Collection and Dissemination Practices Act
- Mason storage-service information pages
- Request an IT security consultation
- Review Data Classification and Storage Requirements
- University Records Management resources
Need Help?
The classifications and examples provided in university guidance are not all-inclusive. If information is not listed or you are unsure how to classify, store, or share it: