Information Security Office Menu

Minimum Information Security Controls Standard

A PDF version of this document is also available.

Purpose

This standard outlines the minimum controls for protecting information assets, as required by the Information Asset Classification and Management Policy ( IV.06.02 ). The purpose of requirements identified herein is to reduce risks to the confidentiality, integrity and availability of University data and systems (“information assets”) and to protect the privacy of members of the University community.

Scope

This standard applies to all users with access to University information assets, and all devices that store, process or transmit University data.

Standard

All users with access to University information assets, and all devices that store, process or transmit University data shall meet the following minimum controls for protecting University information assets, unless an exception is approved by the Information Security Office (ISO).

Exception Request

There may be valid reasons why a given required control cannot be met; e.g., technology limitations, conflict with other controls, the presence of compensating controls, lack of funding, and financial needs that exceed the potential risk of not implementing the control. Exception requests must be submitted to ISO detailing reasons the control cannot be met and proposing compensating controls to minimize the risk caused by not meeting the controls. Exceptions request should be submitted using this form  https://service.uoregon.edu/TDClient/2030/Portal/Requests/ServiceDet?ID=43440 

Compliance Management

The ISO shall implement processes and services to continuously monitor information systems for compliance with this standard.

Policy Violation

Non-compliance with this standard is a violation of the University Information Asset Classification Policy ( IV.06.02 ) and are subject to University sanctions. In cases where noncompliance poses serious risks to University information assets, ISO may take steps to mitigate such risks including temporarily quarantining vulnerable or compromised computers, temporarily disabling affected network ports, blocking known bad or compromised IP addresses, disabling affected network ports, blocking known bad or compromised IP addresses, disabling compromised user accounts, or other actions as necessary to protect University information assets and users.

Definitions

Mandatory Controls must be applied as described in this standard.

Recommendation Controls should be applied as described in this standard.

Compensating Controls are alternative controls put in place to meet or exceed the security requirement, typically to address difficulty or impracticality in implementing the required control. Typically, compensating controls are temporary until it becomes practical to implement the required controls.

For control definitions, refer to the glossary.

See Glossary 

UO Minimum Security Controls by Classification

The following security controls must be implemented for University-owned systems or vendor/partner systems that store, process or transmit University data in accordance with the classification of the system. Personally-owned systems (e.g., BYOD, home computers, personal phones, etc.) that are used to store, process or transmit University data are required to meet or exceed these standards, before such use is approved by ISO.

• Servers
• Workstations
• Application Systems
• Network Infrastructure Devices
• Mobile Devices

Table Legend

M = Mandatory; This control must be applied to information systems if this classification of is data present on the system or transits through the system.

R = Recommended; The ISO recommends   that this control be applied to information systems if this classification of is data present on the system or transits through the system.

NR = Not Required; This control is  not required to be applied to information systems if this classification of is data present on the system or transits through the system.

Servers

Workstations: Desktops, laptops, and devices with full-featured OS

Application Systems: Web-layer, middleware, databases, etc.

Network Infrastructure Devices: Routers, Firewalls, Switches, APs, etc.

Mobile Devices: Tablets, smartphones, IoT's, printers and devices with pared-down OS, etc.

Acronyms

• SCCM – Microsoft System Center Configuration Manager
• CMDB – Configuration Management Database
• SSH – Secure Socket Layer protocol
• BYOD – Bring your own device
• SCP - Secure Copy protocol
• SFTP - Secure File Transfer Protocol
• VPN – Virtual Private Network
• TLS - Transport Layer Security
• IPSec – Internet Protocol Security
• SIEM – Security Information and Event Management
• CVSS – Common Vulnerability Scoring System, supported by the National Institute of Standards and Technology National Vulnerability Database (NIST NVD)

McAfee (ending June 2025) - The UO site license for McAfee, now called Trellix will end in June 2025.  Transition to Microsoft Defender.