General Data (Low Risk)

Data and systems are classified as Low Risk if they are not considered to be Moderate or High Risk, and:

• The data is intended for public disclosure, or
• The loss of confidentiality, integrity, or availability of the data or system would have no adverse impact on our mission, safety, finances, or reputation.

Sensitive Data (Moderate Risk)

Policy 808 defines Sensitive Information as information or data that is related to Rice’s business and academic activities, although not cloaked with the same level of concern or legal protection as confidential information, is still considered by Rice to be “sensitive information”. Examples of these types of information include, but are not limited to: birth dates; home addresses; emergency contact information; employee ID numbers; employee disciplinary records; legal documents (unless publicly disclosed by the University); financial records (unless publicly disclosed by the University); infrastructure information (e.g., IT, physical plant) (unless publicly disclosed by the University).

Data and systems are classified as Moderate Risk if they are not considered to be High Risk, and:

• The data is not generally available to the public, or
• The loss of confidentiality, integrity, or availability of the data or system could have a mildly adverse impact on our mission, safety, finances, or reputation.

Confidential and Regulated Data (High Risk)

Policy 808 defines Confidential Information as information or data that is deemed confidential by law, regulation or University policy or which contains information that is highly private or personal or could lead to identity theft if mishandled. Examples of these types of information include, but are not limited to: social security numbers; credit card numbers; driver’s license or other government-issued identification numbers; bank account information; protected health information; and student education records (including grades and disciplinary records).

Confidential information can also include information or data that was created by other Rice University researchers or provide to Rice by third parties, provided that those researchers or third parties have made it clear that such information is confidential (by marking it as such).

Data and systems are classified as High Risk if:

• Protection of the data is required by law/regulation,
• Rice is required to self-report to the government and/or provide notice to the individual if the data is inappropriately accessed, or
• The loss of confidentiality, integrity, or availability of the data or system could have a significant adverse impact on our mission, safety, finances, or reputation.