Policies

ITP 8201 Data Security

Section: 8000 Information Technology
Sub Section: 8200 Data Governance
Title: ITP 8201 Data Security
Associated Policies: ITP 8100 Acceptable Use; ITP 8202 Electronic Communication; ITP 8203 Disaster Recovery
Associated Regulations: ITR 8100 Acceptable Use
References: Computer Services Electronic Data Governance Operating Manual
Supersedes: NA
Responsible Administrator: Chief Technology Officer
Initial Approval: 06-21-2017	Last Revision: 04-19-2023

Three Rivers College is committed to ensuring that all access to and uses of sensitive information are performed in a secure manner. Therefore, measures are in place to minimize the risk to the College from unauthorized disclosure of sensitive data, whether accidental or deliberate. To comply with data protection guidelines, sensitive information must be collected and used appropriately, stored safely, and not disclosed to any other person(s) unlawfully.

The purpose of this Data Security Policy is to define the security controls necessary to safeguard the confidentiality and integrity of sensitive College information. This policy provides a framework in which security threats to College information systems can be identified and managed on a risk basis and establishes terms of reference which ensure uniform implementation of data security controls throughout the college.

The United States follows what is referred to as a 'sectoral' approach to data protection legislation. Under this approach, laws of data protection and privacy rely on a combination of legislation, regulation, and self-regulation rather than governmental control. Therefore, the College establishes self-regulated guidelines for data security.

Accurate, timely, relevant, and properly protected information is a critical asset of Three Rivers College. The College recognizes that failure to implement adequate security controls over sensitive information could potentially lead to:

Irretrievable loss of important data.
Serious financial consequences.
Damage to the reputation of the college; and
Legal penalties.

The Network Administrator performs the duties of the Data Security Officer (DSO) for the College. The DSO shall direct a Data Security Team (DST) which consists of the system administrator, Chief Technology Officer (CTO), and assigned data stewards. The Data Security Officer in conjunction with the Data Security Team, shall be responsible for:

Establishing, maintaining, and enforcing electronic and physical information security and access standards for all entities under the direction of the College President.
Enforcing board-approved technology policies and regulations established collaboratively by the CTO and the College Cabinet.
Managing information security incidents, including establishing and communicating incident response procedures for all members of the campus community.
Adopting and implementing industry best practices and standards for secure transportation and transmission of electronic data.
Informing all college information systems users of their individual responsibilities, and establishing standards to protect sensitive data and privacy.
Working in conjunction with the College Cabinet and their associated areas of responsibility to protect the security of electronically held information.
Periodically auditing college-controlled information systems for vulnerabilities.

This Data Security Policy applies to anyone authorized to access college data. Failure to comply with this policy may result in loss of data access privileges and possible disciplinary action.

DOCUMENT HISTORY:

06-21-2017:		Initial approval of policy ITP 8201 Data Security.
04-19-2023:		Changed DSO to Network Administrator from Chief Technology Officer.

ITP 8202 Electronic Communication

Section: 8000 Information Technology
Sub Section: 8200 Data Governance
Title: ITP 8202 Electronic Communication
Associated Policies: ITP 8201 Data Security; ITP 8100 Acceptable Use
Associated Regulations: ITR 8100 Acceptable Use
References: College Identity Standards
Supersedes: NA
Responsible Administrator: Chief Technology Officer
Initial Approval: 06-21-2017	Last Revision:

Three Rivers College electronic communications such as email is the property of the College. The purpose of this Electronic Communications Policy is to establish a foundation for the controls necessary to safeguard the integrity of said College property. Three Rivers College official electronic communications such as email and text messages must go through College controlled systems. The official means of email communication is the College email systems; therefore, all faculty, staff, and students must use their College email account(s) unless law, contract, or other college policy prohibits email or requires another form of communication. Exceptions to this rule must receive approval from the Computer Services Department.

All College-owned electronic computing and networking resources, such as Blackboard, myTRCC, and email, must be used instead of 3rd party resources. Therefore, Three Rivers College students, faculty, and staff are expected to use their college email accounts for College business purposes. College email and all forms of electronic communication are subject to monitoring and archiving.

The College sends electronic communications to faculty, staff, and students by email to their college email address. It is expected that the email will be received and read by the recipient within a reasonable amount of time, as email communications may be time-sensitive; however, email should not be considered or used as the only means of College emergency communications.

College-owned electronic communications in the form of email must comply with the College’s policy and regulation ITP and ITR 8100 Acceptable Use and policy ITP 8201 Data Security, as well as College Identity Standards. This Electronic Communications Policy applies to anyone with authorized access to electronic communications owned by the College. Failure to comply with this and any related College policy or regulation may result in loss of data access privileges and possible disciplinary action.

DOCUMENT HISTORY:

06-21-2017:

initial approval of policy ITP 8202 Electronic Communication.

ITP 8203 Disaster Recovery

Section: 8000 Information Technology
Sub Section:8200 Data Governance
Title: ITP 8203 Disaster Recovery
Primary Policy: ITP 8100 Acceptable Use
Associated Policies: ITP 8201 Data Security
Associated Regulations: NA
References: NA
Supersedes: NA
Responsible Administrator: Chief Technology Officer
Initial Approval: 06-21-2017		Last Revision:

Three Rivers College is committed to ensuring that procedures are in place in the event of a disaster that would impact the College’s Data Center, data, and electronic systems. Therefore, a formal Disaster Recovery Plan for essential college systems is in place to minimize the risk to the college. The Disaster Recovery Plan is based on risk assessments of critical elements of the college’s data systems and infrastructure in order to effectively prepare and respond to a crisis or disaster that may fully or partially disable the integrity of these systems.

The purpose of this Disaster Recovery Policy is to ensure that accurate and timely response procedures are developed and maintained by the College to protect the College’s Data Center, data, and their associated electronic systems. The Disaster Recovery Plan is reviewed and tested periodically by the Data Security Team to ensure accuracy, currency, and reliability. A periodic review will be performed on the portions of the plan that are not practical to test.

Core elements of the College’s Disaster Recovery Plan:

Destruction of a College Location
Destruction of a Data Center
Mass Loss of Computer Services Staff
Destruction or Failure of Servers Within a Data Center
Destruction or Failure of Storage Hardware in a Data Center
Destruction or Corruption of Data in a Data Center
Destruction or Failure of Network Equipment in a Data Center
Destruction or Failure of Supporting Equipment in a Data Center
Massive Data Breach
Ransomware and other Malware Attacks
Long-Term Power Loss
MoreNET (ISP) Outage
VoIP Outage (Including AT&T Circuit)

DOCUMENT HISTORY:

06-21-2017:

Initial approval of policy ITP 8203 Disaster Recovery.

ITP 8204 Website Privacy

Section: 8000 Information Technology
Sub Section: 8200 Data Governance
Title: ITP 8204 Website Privacy
Associated Policies: ITP 8201 Data Security; GAP 1320 Consumer Protection; GAP 1410 Record Retention and Destruction; FP 3105 Risk Management; SP 2415 Confidentiality of Student Records; GAP 1130 Request for College Documents; ITP 8100 Acceptable Use
Associated Regulations: SR 2740 Student Right and Responsibilities; GAR 1410 Record Retention and Destruction; FR 3105 Protection, Prevention, and Mitigation of Identity Theft; SR 2415 Confidentiality of Student Records; ITR 8100 Acceptable Use
References: Google Terms of Service and Use Rules; General Education Provisions Act, Federal Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99); RSMo109; Missouri Sunshine Law: Section 610.010-610.200
Supersedes: NA
Responsible Administrator: Chief Technology Officer
Initial Approval: 05-20-2020	Last Revision: 04-19-2023

Three Rivers College is committed to safeguarding information and services offered on the College website to minimize risk for the College community. The purpose of the website is to provide information about the College and to offer necessary online services to students, faculty, and staff. College services provided online include, but are not limited to, the College admission procedure, registration, bookstore, tuition payment, financial aid, and class schedules. The College has measures in place to minimize the risk from unauthorized use and recognizes the importance of protecting the privacy rights of users. The College complies with FERPA guidelines for privacy and all other applicable laws, policies, and guidelines to securely manage and safeguard the privacy of website users.

Information Gathering

When you visit TRCC.edu, Three Rivers College’s web server automatically recognizes the Internet domain and IP address from which you accessed the website. The College and third-party vendors collect certain information regarding the use of TRCC.edu, such as the browser and IP address. This information does not result in the identification of personal e-mail addresses or other personal information. In addition, the College gathers information regarding the volume and timing of access to the college website by collecting information on the date, time, and website pages accessed by visitors. This information is used to improve the content of TRCC.edu is not shared with other organizations. Only aggregate information is collected, and individual visitors’ personal information is not identified.

If you choose to share personal information with the college by sending virtual communication, logging into College web servers, or filling out an electronic form with personal information, the College may use the information only for the purposes you authorized or in support of College sponsored programs. Some of the information may be saved for a designated period to comply with Missouri’s archiving policies but will not be disclosed to third parties or government agencies unless required by state or federal law or in support of College sponsored programs. If we are requiredto disclose the information by law, the College will make every effort to notify you of the disclosure in advance.

Online services accessible through myTRCC, College email, or Blackboard provide password-protected access to individuals’ personal records including, but not limited to, personal contact information, class records information, and tuition-payment history. This information is accessible only by the individual and by designated College personnel. Banking account information in theStudent Information System is stored in an encrypted state.

How Information is Used

The information gathered through TRCC.edu is used to improve the website experience for visitors, prospective students, existing students, and employees. Information captured in myTRCC enables users to access their personal records and utilize online services offered by Three Rivers College. The College does not sell, rent, swap, or authorize any third party to use your email address for commercial purposes without your permission, except when legally required to do so.

Cookies

The Three Rivers College website may place “cookies” on your computer unless your browser is set to reject cookies. The cookies enable the College website to recognize you when you return to the website and enables the personalization of the website with preferences or information you have provided during the communication sessions. You may disable cookies through your individual browser options.

Google Analytics

All Three Rivers College websites use Google Analytics; a Web analytics service provided by Google, Inc. Google Analytics uses cookies to collect information such as URLs, Internet domain and host names, browser software, and the date and time the site is visited. This information is used to monitor the effectiveness of the website and to consider potential improvements. The information is non-personal and is transmitted to and stored by Google on its servers. The College does not share specific information about a user. Information about Google Analytics terms of use, their privacy policies, and how to opt out of their data collection can be found on the college website at https://trcc.edu/privacy-policy/

E-commerce

Several sites within Three Rivers College enable you to pay for products or services online with a credit card. Unless otherwise noted, these transactions are encrypted. It is College policy that confidential information you enter in the transaction be used only for the purposes described in that transaction unless an additional use is specifically stated on that site.

Other Websites

The Three Rivers College website may contain links to other external public or private entities’ websites, whose privacy practices the College does not control.

Access to Student Records

A student’s record, with certain exceptions such as directory information, will not be released without prior written consent of the student. A student has the right to review and question the content of her/his educational record within a reasonable time after making a written request for such a review. If there are questions as to the accuracy or appropriateness of the record that cannot be resolved informally, an opportunity for a meeting will be provided.

Family Educational Rights and Privacy Act

Three Rivers College complies with the Family Educational Rights and Privacy Act (FERPA) of 1974, as amended, provides students access to information about themselves, permits students to challenge such information about themselves, and limits the release of such information about students without the student’s explicit written consent.

Disclosure of Education Records

Three Rivers College does not disclose student education records to anyone unless the student has provided a written and dated consent for disclosure of the record or the disclosure meets one of the allowable exceptions under the law.

Certain exceptions permit the college to disclose student education records without student consent, including:

To School Officials with Legitimate Educational Interests
To Schools in which a Student Seeks or Intends to Enroll
To Federal, State, and Local Authorities Conducting an Audit, Evaluation, or Enforcement of Educational Programs
In Connection with Financial Aid
To Entities Conducting Educational Research
To Accrediting Organizations
To Parents of a Dependent Student
To Comply with Judicial Order or Subpoena Provided the Institution makes a Reasonable Attempt to Notify the Student in Advance of Compliance
In a Health or Safety Emergency
Directory Information
Results of a Disciplinary Hearing to an Alleged Victim of a Crime of Violence
Results of a Disciplinary Hearing Concerning a student who is an Alleged Perpetrator of a Crime of Violence and who is Found to have Committed a Violation of the Institution’s Rules or Policies
Disclosure to the Parent of a Student Under 21 if the Institution Determines that the student has Committed a Violation of its Drug or Alcohol Rules or Policies
The Department of Homeland Security for Purposes Related to the Student Exchange and Visitor Information System (SEVIS)
Military Recruiters who Request Student-recruiting Information (including name, address, telephone listing, age, level of education and major)
The Department of Veterans Affairs
The Internal Revenue Service in Compliance with the Taxpayer Relief Act

Directory Information

Three Rivers College designates certain personally identifiable information contained within the student’s education record as “directory information”. The College may, at its discretion, disclose this information without a student’s prior written consent. This information is as follows: student name, home address, field of study, academic classification (freshman/sophomore), part-time or full-time status, participation in recognized activities and photos, dates of attendance, degrees and certificates, matriculation and withdrawal dates, memberships in national honor societies, awards and honors, and inclusion of an individual in a group photo. A student may restrict the publication and release of this directory information by filing a written request with the Chief Student Services Officer.

In addition, the following information is always considered releasable: previous dates of attendance, degrees and awards received, and previous educational agencies or institutions attended. For the regulation regarding the collection, retention, and dissemination of information about a student view see SR 2415 Confidentiality of Student Records.

Virtual Communication

Three Rivers College uses virtual communication methods to engage with prospective students, existing students, employees, and visitors to the website. Virtual communication may only provide general informational answers to questions. No personal or otherwise identifiable information may be released using this method. This includes but is not limited to admissions status, financial aid status, grades, payments, or financial information.

Choice to Provide Information

There is no requirement to provide information through the college website. However, online services will not be available to you without proper login. Failure of your browser to provide nonessential technical information will not prevent the use of the college website but may prevent accessing online services. Questions about this privacy policy, the practices of the website, or to correct any information, please contact website@TRCC.edu, or call 573-840-9660.

Changes to Privacy Policy

Three Rivers College may adjust the privacy policy at any time due to changes in the law, technology, College operations, or in attempts to better serve the needs of the College community. The College will use every effort to communicate in a timely manner any changes to this privacy statement in the manner described in the website policy and disclaimers.

DOCUMENT HISTORY:

05-20-2020:		Initial approval of policy ITP 8204 Website Privacy.
03-16-2021:		Edited to include a statement regarding student banking account information being stored in the College Student Information System in an encrypted state.
04-19-2023:		Edited for minor grammar changes, updated website link locations.