Policy
Policy Type: Administrative
Responsible: Vice President of Administrative Services
Related Policies:
Linked Operating Standards:
Related Laws: Laws: FERPA; Gramm-Leach-Bliley Act (GLBA), Illinois Information Protection Act (PIPA)
Related External Standards: NIST Cybersecurity Framework 2.0, NIST Special Publication 800-53/800-171; and PCI DSS
HLC Criterion: 2A2A
Actions taken by the institution’s governing board, administration, faculty and staff demonstrate adherence to established policies and procedures.
, 4A4A
The institution’s administrative structures are effective and facilitate collaborative processes such as shared governance; data-informed decision making; and engagement with internal and external constituencies as appropriate.
, 4B4B
The institution’s financial and personnel resources effectively support its current operations. The institution’s financial management balances short-term needs with long-term commitments and ensures its ongoing sustainability.
, 4C4C
The institution engages in systematic strategic planning for quality improvement. It relies on data, integrating its insights from enrollment forecasts, financial capacity, student learning assessment, institutional operations and the external environment.
1.0 Statement
Shawnee Community College recognizes the protection of personally identifiable information (PII) and other sensitive institutional information as a critical component of its information technology and cybersecurity internal control environment. The College shall maintain reasonable administrative, technical, and physical safeguards designed to protect such information from unauthorized access, acquisition, use, disclosure, alteration, loss, misuse, or destruction.
The College’s information technology and cybersecurity internal controls shall be informed by recognized industry standards and frameworks, including guidance established by the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA), as appropriate. Such controls shall comply with applicable federal and state laws, regulations, contractual obligations, and industry requirements, including, as applicable, the Family Educational Rights and Privacy Act (FERPA), Gramm-Leach-Bliley Act (GLBA) and Safeguards Rule, Illinois Personal Information Protection Act (PIPA), Payment Card Industry Data Security Standard (PCI DSS), and other requirements applicable to College operations.
Information technology and cybersecurity controls shall be established and maintained using a risk-based approach and shall support the confidentiality, integrity, and availability of College information, systems, and technology resources.
2.0 Scope
This policy applies to College-owned, managed, or authorized information systems, networks, applications, databases, cloud-based services, devices, and other technology resources that collect, process, transmit, access, or store PII.
It applies to employees, student workers, contractors, consultants, vendors, and other authorized users of College technology resources.
3.0 Access and Authentication Controls
Access to systems containing PII or other sensitive information shall be limited to authorized users based upon legitimate institutional responsibilities, legitimate educational interest where applicable, and the principle of least privilege.
The College shall maintain controls that, as appropriate:
- Require unique user credentials;
- Establish password and authentication requirements;
- Utilize multi-factor authentication for systems or accounts based upon risk and technical capability;
- Restrict administrative and privileged access;
- Prohibit unauthorized sharing of user accounts or credentials;
- Require appropriate authorization before system access is established or modified;
- Periodically review user and privileged access; and
- Promptly disable or modify access following separation, transfer, or changes in job responsibilities.
4.0 Data Protection
PII and other sensitive institutional information shall be protected throughout its lifecycle, including collection, storage, processing, transmission, retention, and disposal.
Appropriate controls may include:
- Encryption of sensitive information in transit and at rest, where appropriate;
- Secure College-approved storage environments;
- Restrictions on downloading, copying, or transferring PII;
- Secure configuration of systems and devices;
- Data classification and handling requirements;
- Secure methods for electronic transmission;
- Appropriate backup and recovery controls; and
- Secure deletion or destruction of electronic information and storage media.
PII shall not be stored or transmitted through unauthorized personal email accounts, personal cloud-storage services, removable media, applications, artificial intelligence platforms, or other technology services that have not been approved for College use.
PII from student education records shall not be accessed, used, or disclosed except as authorized by FERPA, other applicable law, and established College policies and procedures.
5.0 Network, System, and Endpoint Security
The College shall maintain reasonable cybersecurity controls designed to protect its technology environment from unauthorized access and malicious activity.
Controls may include:
- Firewalls and network security controls;
- Endpoint protection and threat-detection technologies;
- Anti-malware protections;
- Security updates and patch management;
- Vulnerability identification and remediation;
- Email security and phishing protections;
- Secure system configuration;
- Network segmentation where appropriate;
- Logging and monitoring of security-related activity; and
- Other safeguards determined appropriate based upon identified risks.
6.0 System Monitoring and Logging
The College may monitor technology resources and maintain system and security logs as necessary to protect institutional systems, investigate suspected security events, maintain operational integrity, and comply with applicable requirements.
Access to security logs shall be appropriately restricted. Logs shall be maintained based upon operational, security, legal, and regulatory requirements.
7.0 Backup, Recovery, and Availability
The College shall maintain backup and recovery processes appropriate to the criticality of institutional systems and information.
Critical systems and data shall be backed up at intervals appropriate to operational and recovery requirements. Backup processes should include appropriate protections against unauthorized access, modification, or deletion.
Recovery procedures shall be periodically reviewed or tested to support the College’s ability to restore critical operations following a cybersecurity incident, system failure, disaster, or other disruption.
8.0 Third-Party and Cloud-Based Systems
Third-party technology providers that access, process, transmit, or store PII or other sensitive College information shall be subject to appropriate review based upon the nature of the service and associated risk.
Where a third-party provider receives access to PII from student education records under FERPA, the College shall ensure that the disclosure is authorized under FERPA and that applicable requirements governing the use, maintenance, protection, and redisclosure of such information are satisfied.
Contracts or agreements involving access to FERPA-protected education records shall address, as applicable, the College’s control over the use and maintenance of the information, limitations on use and redisclosure, information security and confidentiality, data retention and disposal, and other requirements necessary to protect student education records.
Contracts or agreements shall address, as appropriate:
- Information security and confidentiality;
- Protection and permitted use of College data;
- Access controls;
- Cybersecurity incident notification;
- Data retention and disposal;
- Availability and recovery expectations; and
- Compliance with applicable legal, regulatory, and contractual requirements.
9.0 Cybersecurity Incident Reporting and Response
Suspected or actual cybersecurity incidents involving PII, College systems, accounts, or technology resources shall be reported promptly in accordance with established College procedures.
Cybersecurity incidents may include unauthorized system access, compromised credentials, phishing, malware or ransomware, lost or stolen devices, unauthorized disclosure of PII, suspicious system activity, or other events that may compromise the confidentiality, integrity, or availability of College information or systems.
The College shall maintain procedures for assessing, containing, investigating, documenting, recovering from, and responding to cybersecurity incidents. Appropriate College officials shall determine whether legal, regulatory, contractual, law-enforcement, insurance, or individual notification requirements apply.
10.0 Cybersecurity Awareness
Individuals with access to College technology resources shall receive cybersecurity awareness education or training appropriate to their responsibilities.
Training may address phishing and social engineering, password and authentication security, handling of PII, secure use of College technology resources, incident reporting, and other identified cybersecurity risks.
Individuals with privileged or elevated system access may be required to complete additional role-specific training.
11.0 Risk Assessment and Review
Information technology and cybersecurity controls shall be periodically evaluated based upon changes in technology, operations, threats, vulnerabilities, legal requirements, and institutional risk.
Identified vulnerabilities or control deficiencies shall be evaluated based upon risk and addressed through remediation, compensating controls, risk acceptance, or other appropriate action.
The College may use recognized cybersecurity standards and frameworks to guide the development and evaluation of its information security controls.
12.0 Responsibilities
Information Technology is responsible for establishing, implementing, and maintaining technical cybersecurity controls for College-managed technology resources and for monitoring the effectiveness of those controls.
College leadership and administrators are responsible for supporting appropriate cybersecurity practices and ensuring that access to institutional information is consistent with operational responsibilities.
Employees and authorized users are responsible for protecting their credentials, complying with established cybersecurity requirements, appropriately handling PII and sensitive information, and promptly reporting suspected security incidents.
13.0 Compliance
Information technology and cybersecurity controls shall be administered consistent with applicable federal and state laws, regulations, contractual obligations, and College requirements, including, where applicable, FERPA, the Gramm-Leach-Bliley Act (GLBA) and Safeguards Rule, the Illinois Personal Information Protection Act (PIPA), and applicable records-retention requirements.
The President or designee may establish operating standards, procedures, technical standards, and other requirements necessary to implement this policy and respond to evolving cybersecurity risks.
| Change Log | Governance Unit: Administrative Services Council |
| Date | Description of Change |
| 8-18-26 | Initial Development and Facility Team Review |
| 9-18-26 | Legal Review |
| 9-24-26 | Approved by Executive Council |