CONFIDENTIAL DATA POLICY

Purpose

Confidential data is typically the data that holds the most value to a company. Often, confidential data is valuable to others as well, and thus can carry greater risk than general company data. For these reasons, it is good practice to dictate security standards that relate specifically to confidential data.

The purpose of this policy is to detail how confidential data, as identified by the Data Classification Policy, should be handled. This policy lays out standards for the use of confidential data, and outlines specific security controls to protect this data.

Scope

The scope of this policy covers all company-confidential data, regardless of location. Also covered by the policy are hardcopies of company data, such as printouts, faxes, notes, etc.

Policy

For clarity, some of the information below is repeated from the Data Classification Policy.

Treatment of Confidential Data

Storage

Confidential information must be removed from desks, computer screens, and common areas unless it is currently in use. Confidential information should be stored under lock and key (or keycard/keypad), with the key, keycard, or code secured.

Transmission
Strong encryption must be used when transmitting confidential data, regardless of whether such transmission takes place inside or outside the company's network. Confidential data must not be left on voicemail systems, either inside or outside the company's network, or otherwise recorded.

Destruction
Confidential data must be destroyed in a manner that makes recovery of the information impossible. The following guidelines apply:

• Paper/documents: cross cut shredding is required.
• Storage media (CD's, DVD's): physical destruction is required.
• Hard Drives/Systems/Mobile Storage Media: physical destruction is required. If physical destruction is not possible, the IT Manager must be notified.

Use of Confidential Data
A successful confidential data policy is dependent on the users knowing and adhering to the company's standards involving the treatment of confidential data. The following applies to how users must interact with confidential data:

• Users must be advised of any confidential data they have been granted access to. Such data must be marked or otherwise designated "confidential."
• Users must only access confidential data to perform their job function.
• Users must not seek personal benefit, or assist others in seeking personal benefit, from the use of confidential information.
• Users must protect any confidential information to which they have been granted access and not reveal, release, share, email unencrypted, exhibit, display, distribute, or discuss the information unless necessary to do their job or the action is approved by their supervisor.
• Users must report any suspected misuse or unauthorised disclosure of confidential information immediately to their supervisor.
• If confidential information is shared with third parties, such as contractors or vendors, a confidential information or non-disclosure agreement must govern the third parties' use of confidential information. Refer to the company's outsourcing policy for additional guidance.
• If confidential information is shared with a third party, the company must indicate to the third party how the data should be used, secured, and, destroyed.

Security Controls for Confidential Data

Confidential data requires additional security controls in order to ensure its integrity. The company requires that the following guidelines are followed:

• Strong Encryption. Strong encryption must be used for confidential data transmitted internal or external to the company. Confidential data must always be stored in encrypted form, whether such storage occurs on a user machine, server, laptop, or any other device that allows for data storage.
• Network Segmentation. The company must use firewalls, access control lists, or other security controls to separate the confidential data from the rest of the corporate network.
• Authentication. Two-factor authentication must be used for access to confidential data.
• Physical Security. Systems that contain confidential data, as well as confidential data in hardcopy form, should be stored in secured areas. Special thought should be given to the security of the keys and access controls that secure this data.
• Printing. When printing confidential data the user should use best efforts to ensure that the information is not viewed by others. Printers that are used for confidential data must be located in secured areas.
• Faxing. When faxing confidential data, users must use cover sheets that inform the recipient that the information is confidential. Faxes should be set to print a confirmation page after a fax is sent; and the user should attach this page to the confidential data if it is to be stored. Fax machines that are regularly used for sending and/or receiving confidential data must be located in secured areas.
• Emailing. Confidential data must not be emailed inside or outside the company without the use of strong encryption.
• Mailing. If confidential information is sent outside the company, the user must use a service that requires a signature for receipt of that information. When sent inside the company, confidential data must be transported in sealed security envelopes marked "confidential."
• Discussion. When confidential information is discussed it should be done in non-public places, and where the discussion cannot be overheard.
• Confidential data must be removed from documents unless its inclusion is absolutely necessary.
• Confidential data must never be stored on non-company-provided machines (e.g. home computers).
• If confidential data is written on a whiteboard or other physical presentation tool, the data must be erased after the meeting is concluded.

Examples of Confidential Data

The following list is not intended to be exhaustive, but should provide the company with guidelines on what type of information is typically considered confidential. Confidential data can include:

• Employee or customer social security numbers or personal information
• Medical and healthcare information
• Electronic Protected Health Information (EPHI)
• Customer data
• Company financial data (if company is closely held)
• Sales forecasts
• Product and/or service plans, details, and schematics, 
• Network diagrams and security configurations
• Communications about corporate legal matters
• Passwords
• Bank account information and routing numbers
• Payroll information
• Credit card information
• Any confidential data held for a third party (be sure to adhere to any confidential data agreement covering such information)

Enforcement

This policy will be enforced by the CTO. Violations may result in disciplinary action, which may include suspension, restriction of access, or more severe penalties up to and including termination of employment. Where illegal activities or theft of company property (physical or intellectual) are suspected, the company may report such activities to the applicable authorities.