Know your data

Policies, procedures and standards

• Information Security and Classification Management Procedure
• Information Classification and Handling Standard (pdf, 183.1kb)
• Monash’s Cyber Security Policy and Standards

Security classifications

Very Sensitive

This classification applies to very sensitive information where:

• Unauthorised access or disclosure would seriously and adversely impact the University, its employees, its students and/or its partner organisations;
• Access, modification, distribution, retention and/or destruction of information is subject to restrictive regulatory obligations;
• Access is strictly limited to a selected group or process; and
• If compromised, would place the University in breach of its legal and regulatory responsibilities.

Examples

Institutional:

• Payment Card Information
• Tax File Numbers
• Any personally identifiable information combined with health or sensitive information
• Information that could be associated to an individual’s racial or ethnic origin, religious beliefs, sexual orientation, etc.

Research:

• Identifiable data containing direct identifiers e.g. Name, MRN, DOB and contact details
• Information classified by Human and Animal Ethics Committees
• Any information on children or young persons.

Sensitive

This classification applies to sensitive information where:

• Unauthorised access or disclosure may adversely impact on the University, its employees, its students and/or its partner organisations;
• Access, modification, distribution, retention and/or destruction is limited to a selected group or process; and
• If compromised, may place the University in breach of its legal and regulatory responsibilities.

Examples

Institutional:

• Financial Information
• Student information e.g. exam results and material
• Staff information e.g. details of employment
• Student Evaluation of Teaching and Units data
• Personal information.

Research:

• Re-identifiable data where direct identifiers have been removed but other indirect identifiers may be present e.g. Postcode + rare ICD-10 code still present
• Research datasets where data is not combined with personal identifiable information
• Communications with research partners.

Restricted

This classification applies to restricted information where:

• Unauthorised access, modification, distribution, retention and/or destruction or disclosure may have a negligible impact on the University, its employees, its students and/or its partner organisations;
• Does not include very sensitive or sensitive information, but is created or received within the University (including by students) and used internally;
• Disclosure would not cause damage to the University, its employees, its students and/or its partner organisations;

Examples

Institutional:

• Course materials and content
• Educational resources
• Training material
• Building plans and associated information
• Internal processes and procedures.

Research:

• De-identified data that is aggregate data with no identifying information included e.g. Counts of patient admissions to ICU ward per month
• Drafts of research publications
• Data from instruments and imaging systems (excluding those linked to an MRN or patient ID)
• Data from sensors, cameras, recorders etc. that do not contain identifiers (e.g. faces)

Public

This classification applies to publicly available information where:

• It's made available, or released to the general public; and
• No adverse effects are expected to result from the wide circulation of this information.

Examples

Institutional:

• The Monash University home page (www.monash.edu) and web presence
• Faculty course lists and the University Handbook
• Monash research achievements and broadcast events
• Information in the public domain
• General institutional and business information.

Research:

• Monash research achievements and broadcast events
• Publicly released annual reports (e.g. clinical study reports)
• Published research data/information in Bridges or discipline repositories.