• Overview
• Data Classification Examples
• Server and Application Data Examples
• Related Policies and Regulations
• Revision History
• Approvals

This standard serves as a supplement to the Information Resources Use and Security Policy, which was drafted in response to Texas Administrative Code 202 and UT System UTS-165. Adherence to the standard will facilitate applying the appropriate security controls to university data. 

This standard exists in addition to all other university policies and federal and state regulations governing the protection of the university's data. Compliance with this classification standard will not ensure that data will be properly secured. Instead, this standard should be integrated into a comprehensive information security plan.

Use the examples below to determine which classification is appropriate for a given type of data. When data falls into multiple categories, use the highest classification.

View Minimum Security Standards for Systems

Extended List of Confidential Data:

HIPAA

• Patient names, street address, city, county, zip code, telephone / fax numbers
• Dates (except year) related to an individual, account / medical record numbers, health plan beneficiary numbers
• PHI-related certificate / license numbers, device IDs and serial numbers, e-mail, URLs, IP addresses
• Any other unique identifying number, characteristic, or code
• Payment Guarantor's information

FERPA

• Grades (including test scores, assignments, and class grades)
• Student financials, credit cards, bank accounts, wire transfers, payment history, financial aid/grants, bills

Note that for enrolled students, the following data may ordinarily be revealed by the university without student consent unless the student designates otherwise:

• Name, directory address and phone number, mailing address, secondary mailing or permanent address, residence assignment and room or apartment number, campus office address (for graduate students)
• Place of birth
• Electronic mail address
• Specific semesters of registration at UT Austin; UT Austin degree(s) awarded and date(s); major(s), minor(s), and field(s); university degree honors
• Institution attended immediately prior to UT Austin
• ID card photographs for course instructor use

For more information, see the UT Austin FERPA Web Page.

Alumni/Donor Information

• Name
• Family information
• Amount / what donated
• Other non-public gift information
• Telephone / fax numbers, e-mail, URLs

Research Information

• Human subject information. See the Institutional Review Board for more information.
• Sensitive digital research data
• Export Controlled Information – Information or technology controlled under International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR), required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of a controlled item or product, including blueprints, drawings, photographs, plans, instructions or documentation.
• Classified information relating to defense articles and defense services;
• Information covered by an invention secrecy order;
• Software directly related to a controlled item;

This does not include information concerning general scientific, mathematical or engineering principles commonly taught in schools, colleges and universities or information in the public domain, nor basic marketing information on function or purpose or general system descriptions of an article or product.

UT Employee Information

• Insurance benefit information
• Family information, home address, and home phone number may be revealed unless restricted by the employee. UT Austin employees can restrict this information in UT Direct.

There can be confusion over which rules apply when an employee is also a student. The rule of thumb is that the student rules apply when the employee is in a student job title.

Business/Vendor Data

• Contract information (between UT Austin and a third party)
• NDA-protected certificate / license numbers, device IDs and serial numbers, e-mail, URLs, IP addresses

A server is any program that provides services to (programs on) other devices. A computer running a server program is frequently referred to as a server, though it may also be running other client (and server) programs.
View Server Hardening Guides

An application is any software that handles data at UT Austin.
View Minimum Security Standards for Application Development and Administration

The policies listed here inform this document; you should be familiar with these policies.

• Information Resources Use and Security Policy
• UT Austin Acceptable Use Policy
• UT System (UTS 165) Information Resources Use and Security Policy

This is not an all-inclusive list of policies and procedures that affect information technology resources.