Cloud Services
Op12.07-17 Cloud Services
Purpose
Cloud environments allow University employees to store large amounts of information and perform collaborative tasks more effectively. However, there are risks that must be mitigated to properly secure the information being placed into the cloud. To mitigate these risks, the University has designated three approved cloud environments that offer redundant storage and industry-leading security controls. These approved cloud environments are University issued Microsoft Office 365 Education Exchange email, Microsoft Office 365 Education OneDrive for Business and Microsoft Office 365 Education SharePoint.
The purpose of this policy is to provide the framework within which University employees are required to operate when processing and/or storing University information classified as Public, Private, Restricted or Highly Restricted in cloud environments.
Definitions
Cloud environment: A third party service that processes or stores information outside of Missouri State’s network.
University approved cloud environments: University issued Microsoft Office 365 Education Exchange email, Microsoft Office 365 Education OneDrive for Business and Microsoft Office 365 Education SharePoint.
SUDERS: Sensitive University Data Export Request System (SUDERS), an online system that facilitates information security risk assessments and reviews by the Information Security Officer, Chief Information Officer and Custodian of Records prior to University information classified as Private, Restricted or Highly Restricted being transmitted and/or stored outside Missouri State’s network.
Policy statement
Information stored in the cloud will be protected based on the level of sensitivity established by the University’s Information Classification policy. University information classified as Private, Restricted or Highly Restricted must not be processed or stored within a cloud environment except in the following circumstances:
- University information classified as Public, Private, Restricted or Highly Restricted may be sent within the Missouri State email system when both the sender and recipient are University issued Microsoft Office 365 Education Exchange email accounts.
- University information classified as Public, Private or Restricted may be stored in the University issued Microsoft Office 365 Education OneDrive for Business and Microsoft Office 365 Education SharePoint cloud environments.
- University information classified as Highly Restricted may be stored within the University issued Microsoft Office 365 Education OneDrive for Business and Microsoft Office 365 Education SharePoint cloud environments only after submitting a SUDERS request and receiving approval.
- University information classified as Private, Restricted or Highly Restricted may be stored in other cloud environments only after submitting a SUDERS request and receiving approval.
Note
This policy does not authorize sharing Private, Restricted or Highly Restricted information with anyone not employed by the University, or with any non-University email address, without an approved SUDERS request or an exception granted at the discretion of the Chief Information Officer.
Policy enforcement
This policy is enforced by the Office of Information Services. Failure to comply with this policy may result in disciplinary actions and/or removal of access to University computing systems and networks.