Protecting information

1. Protecting information Institute for Nonprofit Innovation and Excellence January 29, 2019

2. Overview • Data Classification • Personally Identifiable Information (PII) • Protected Health Information (PHI) • Controlled Unclassified Information (CUI) • Data Privacy • Cyber Liability Insurance • Physical Security • NIST Cyber Security Framework (CSF) • ****

3. Data Classification

4. Personally identifiable information • Personally identifiable information (PII) is any data that could potentially identify a specific individual. Any information that can be used to distinguish one person from another and can be used for de-anonymizing anonymous data can be considered PII.

5. Protected health informaton • PHI stands for Protected Health Information. • The HIPAA Privacy Rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of personal health information needed for patient care and other important purposes.

6. Controlled unclassified information • Controlled Unclassified Information (CUI) is a category of unclassified categories issued in a directive on May 9, 2008, by President George W. Bush. CUI replaces categories such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU) and Law Enforcement Sensitive (LES) categories.

7. Data privacy • Data privacy, also called information privacy, is the aspect of information technology (IT) that deals with the ability an organization or individual has to determine what data in a computer system can be shared with third parties.

8. Cyber liability insurance • Cyber insurance is one option that can help protect your business against losses resulting from a cyber attack. If you’re thinking about cyber insurance, discuss with your insurance agent what policy would best fit your company’s needs, including whether you should go with first-party coverage, third-party coverage, or both. Here are some general tips to consider.

9. Cyber liability insurance

10. Physical security • CYBERSECURITY BEGINS WITH STRONG PHYSICAL SECURITY • Store securely • Limit physical access • Send reminders • Keep stock

11. Physical security • HOW TO PROTECT DATA ON YOUR DEVICES • Require complex passwords • Use multi-factor authentication • Limit login attempts • Encrypt

12. Nistcsf