Overview

Liberty University’s Information Security Program is designed to direct and support protection of confidential data, secure infrastructure operations, secure software development life cycle, and vendor risk management. It sets forth a university-wide program for evaluating electronic accessing, collecting, storing, using, transmitting and protecting university information assets and technology resources.

It is the collective responsibility of all users of Liberty University information systems to ensure:

  • Confidentiality of information and adoption of the established safeguards against unauthorized access.
  • Compliance with applicable laws, regulations and Liberty University policies governing information security and privacy protection.

This program provides an outline to ensure ongoing compliance with policy and regulations related to the program and positions the university to address future changes in the information security landscape, including new or amended regulations.

The information security program is in support of Liberty University’s goal for ethical business practices and responsible protection of all student, staff, faculty, and alumni information.

Program Objectives

Liberty University’s Information Security Program is a combination of policy, security architecture modeling, and descriptions of current IT Security services and control practices. When integrated, the overall program describes administrative, operational, and technical security safeguards that must be implemented for/in information systems involved in the processing and storage of sensitive or private information.

The Information Security Program provides business value by:

  • Aligning the information technology security department’s efforts to advance the university mission while supporting privacy, legal and regulatory obligations.
  • Partnering with stakeholders as trusted advisors and enablers in the acquisition, development, and configuration of technologies to protect the security, the resilience of IT resources and information assets consistent with related policies, procedures, and guidelines.
  • Promote awareness of information security responsibilities and affect behavior through awareness and training.
  • Advise and collaborate with IT-enabled business functions by providing cyber risk guidance and facilitation, creating a partnership that operates with a clear understanding around our operational uptime goals and IT service delivery.
  • Safeguarding the privacy of individuals and their information. With the increasing risk of identity fraud and other potential misuses of personal information, it is paramount that the university safeguard personal information entrusted to its stewardship.
  • The university is the custodian of financial records and transactions. Information security provides the foundation and governance to safeguard these records which is critical to maintaining trusted relationships essential to our business functions. Electronic communication is governed by specific policies depending on the types of data and generally by the Acceptable Use Policy.
  • Prevent the use of university systems for malicious acts. The open nature of the university and the desire to provide ease of access to a large and diverse group of constituents makes us a target for unauthorized users to inappropriately utilize university resources. Evolve security strategies, standards, and procedures to maintain relevance when faced with changes in business processes, technologies, laws, and regulations, or identified risks.
  • Comply with state and federal laws. State and federal laws and regulations require the university to take reasonable steps to ensure the security of the data (FERPA, PCI DSS, GLBA, GDPR). Failure to safeguard this information could result in legal action or cause the university to lose its ability to offer services.