Re: Faculty personal laptops with FERPA data

[Joel McKenzie <mckenzie () WCU EDU>]

Hi Sherri,

We have a very similar situation with adjuncts. We have an exception in our Data Handling Procedures that reads  
"Instructors may store student data for necessary course-related work on a PC local hard drive or removable storage, 
however it must be encrypted and removed after one year." With virtual desktops and OneDrive storage now available to 
everyone, we are trying to move them away from using their local machines for storage. I'm hoping we can remove that 
exception eventually.


-Joel P. McKenzie, MBA, CISSP

-Chief Information Security Officer

-Western Carolina University

________________________________
From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of Yerk-Zwickl, 
Sherri <yerk-zwickl () CAMPBELL EDU>
Sent: Monday, July 29, 2019 12:40 PM
To: SECURITY () LISTSERV EDUCAUSE EDU <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: [SECURITY] Faculty personal laptops with FERPA data


All,

I have been searching the archives for some info I thought would be pretty straightforward, but haven’t found anything 
recent, so here goes…



In updating our security policies we are defining information classifications that explicitly defines FERPA (and other 
data) as Confidential. Our revised AUP states that Confidential data cannot be stored on personal devices/laptops.

We have tons of adjunct faculty that use their own laptops for teaching and of course that means FERPA data being 
stored on those computers.



How are you dealing with this situation? Clearly we will not be buying all these adjuncts laptops so that they are 
university-owned and managed devices.



Would gratefully accept your advice on how your institutions handle this situation…



Thanks,

Sherri



Sherri Yerk-Zwickl

Associate Vice President for Information Technology and Chief Information Officer



[ITS_Horizontal Align - Screen_SYZ]