Guidelines, Standards and Laws

Confidential information, educational records and user accounts are governed by federal and state laws and regulations, the CSU Information Security Policy and Chancellor’s executive orders, and University guidelines, standards and Administrative Procedures.

IT Security and Compliance is responsible for coordinating the development and dissemination of information security guidelines, standards and procedures for the University. See the links below to access CSU policy and University guidelines, standards and procedures.

The CSU Information Security Policy provides high-level direction for managing and protecting the confidentiality, integrity and availability of CSU information assets. In addition, the policy defines the organizational scope of the CSU information Security Policy.

Executive Orders (EO) are formal orders issued by the California State University Chancellor to direct the establishment of campus programs and procedures, and provide guidance in the development and implementation of such programs.

Standards define the minimum requirements necessary to address information security risks and the specific requirements that ensure compliance with legal regulations, CSU policy and information security best practices. Standards represent the minimum basis upon which Board of Trustee’s audits are based. Standards undergo a formal review and approval process prior to publication.

User Guidelines provide general recommendations and instructions for campus users to comply with information security standards and the CSU Information Security Policy. They are often more technical in nature than policies and standards, and are created and updated as needed to account for changes in technology, regulations or University practices, User guidelines undergo a formal review and approval process prior to publication.

Procedures are step-by-step instructions for accomplishing specific tasks and often include recommended tools for performing those tasks. Procedures are informal documents with no impact on users and therefore, undergo only an internal technical review and approval process prior to publication.