Skip to main content

DC-3 Public Data

Description​

Public data is the lowest data classification level, and includes data openly available to the public. This may include low-sensitivity data which is openly distributed and presents no risk to the university, such as official university communications and public announcements. Most data hosted on publicly-accessible websites falls into this classification level. Few restrictions are placed on this type of data.

Guidance

Corresponding Texas A&M System Classification: Public

Applicability​

  • Examples of Public data include, but are not limited to:

  • PERSONAL DATA

    • Public directory information for employees or departments
    • Directory information for students who have not requested a FERPA block
    • Intercollegiate sports information (team rosters, schedules, etc)

  • RESEARCH DATA

    • Research publications not under embargo

  • ADMINISTRATIVE DATA

    • Data intended for distribution on a publicly-accessible website
    • Official university communications and public announcements

Implementation​

  • 1ACCESS

    • 1.1Access to Public data shall be limited to those with a documented business need, as determined by the Data Steward or a Data Manager.
    • 1.2In accordance with security control AC-22, individuals authorized to post information onto a publicly accessible information resource must be designated by the Data Steward or a Data Manager, and trained to ensure the posted data does not contain nonpublic data.
    • 1.3AC-22, data posted to a publicly accessible information resource must be reviewed periodically to ensure that nonpublic data is not included, and to remove any nonpublic data if found.

  • 2STORAGE

    • 2.1For all information resources that store or process Public information, the impact level of the resources should be carefully considered. In accordance with SAP 29.01.03.M0.13, moderate and high impact information resources must reside in a Texas A&M enterprise data center.
    • 2.2There are no requirements for the encryption of Public data at rest.

  • 3TRANSMISSION

    • 3.1There are no requirements for the encryption of Public data in transit.

  • 4MONITORING

    • 4.1In accordance with security controls SI-4, AU-2, AU-3, AU-4, AU-5, and AU-6, information systems containing Public data should enable effective logging and monitoring of system and security events.

  • 5INCIDENT REPORTING

    • 5.1In accordance with security control IR-6 and IR-8, any known or suspected instance of unauthorized access or use of Public data must be reported to the CISO.

  • 6DISPOSAL

    • 6.1In accordance with security control MP-6, information resources containing Public data must be sanitized prior to disposal or surplus.