 Standards

Requirements for governing SFA's security program, including the security strategy, documentation, leadership roles, planning and reporting, system inventory, and the insider-threat and research-security programs; supports Policy 06-107.1.

Requirements for identifying, assessing, and managing cybersecurity risk at SFA, including risk assessments, continuous monitoring, control assessments, and vendor risk management; supports Policy 06-107.1.

Requirements for managing the security responsibilities of staff and vendors across the employment lifecycle, from screening and rules of behavior through transfers, offboarding, and discipline; supports Policy 06-107.1.

Requirements for SFA's security and privacy training, including general awareness training, role-based training for specialized duties, and training records; supports Policy 06-107.1.

Requirements for protecting SFA data and personal information throughout its life, including data handling and classification, encryption and transmission, consent and notices, and retention; supports Policy 06-107.1.

Requirements for the responsible use of SFA technology, including mobile and endpoint devices and the security duties of managers and general users; applies to everyone with no exceptions and supports Policy 06-107.1.

Requirements for protecting Protected Health Information (PHI) at SFA's Academic Clinics designated as HIPAA Healthcare Components, covering administrative, physical, and technical safeguards, business associate agreements, privacy, and breach notification; supports Policy 06-107.1. Student Health and Counseling records are FERPA-governed and out of scope.

Requirements for the responsible procurement, deployment, and use of artificial intelligence at SFA, including AI governance, inventory and risk classification, data-input controls, prohibited uses, human oversight of consequential decisions, and testing and monitoring; supports Policy 06-107.1.

Requirements for controlling who can access SFA systems and data, including account and authenticator (password) management, least privilege, and identity and login controls; supports Policy 06-107.2.

Requirements for tracking and protecting SFA's technology assets across their life, from inventory and acceptable use through secure return, disposal, and reuse; supports Policy 06-107.2.

Requirements for building, configuring, and maintaining SFA systems securely, including secure development, configuration baselines, system maintenance, and change management; supports Policy 06-107.2.

Requirements for keeping SFA services running and recoverable during a disruption, including continuity and disaster-recovery planning, impact analysis, alternate capacity, and backups; supports Policy 06-107.2.

Requirements for watching for and responding to security threats, including event logging, network security, malware protection, penetration testing, threat intelligence, and vulnerability remediation; supports Policy 06-107.2.

Requirements for preparing for and responding to security incidents at SFA, including incident planning, response, communication, and reporting; supports Policy 06-107.2.

Requirements for protecting Criminal Justice Information (CJI) in line with the FBI CJIS Security Policy, including access control, multi-factor authentication, personnel background screening, media protection, physical security, and audits; applies primarily to the University Police Department and supports Policy 06-107.2.

Requirements for physically protecting SFA's facilities and equipment, including physical access controls, visitor controls, environmental protections, and data-center facility requirements; supports Policy 06-107.3.