Transmission/Transfer of DCL3 and DCL4 Data Standard

Data classified as Level 3 or Level 4 under the University's Data Classification System should only be transmitted or transferred when absolutely necessary. This includes, but is not limited to, transmitting/transferring to other University staff, other University systems, non-University staff and non-University systems.

The following requirements must be followed to ensure that the security and integrity of the data is maintained at all times.

Requirements

Email

1. Email should be sent with an appropriate notice advising any unintended recipient to destroy the email.
2. Email must be encrypted or the contents otherwise protected from casual disclosure (i.e., placing the contents within a password protected document as an attachment).
3. Sender must make every reasonable effort to ensure that the recipient(s)'s email address is correct.
4. Sender must verify that the email has been received by the intended recipient. If receipt can't be confirmed, sender and/or intended (University) recipient must make every reasonable effort to determine whether the email was actually sent, to what address and that it is subsequently deleted. Additionally, the incident must be reported to the appropriate business unit ISO.

Facsimiles

1. Faxes should be sent with an appropriate cover letter advising any unintended recipient to destroy the fax.
2. Sender and recipient must coordinate transmittal of the document prior to sending.
3. Sender must make every reasonable effort to ensure that the recipient's fax number is correct.
4. The original document must be shredded after transmittal unless retention is required.
5. Fax machines must be in a secure, non-public location.
6. The "store and forward" memory function must be disabled.
7. Sender must verify immediately after transmittal that the fax has been received by the intended recipient. If receipt can't be confirmed, sender and/or intended (University) recipient must make every reasonable effort to track down the location of the fax.

Physical Transfer of Paper Documents or Other Media

1. Physical transport of paper documents or other media are allowed using:
   
   1. US Postal Service
   2. UPS, FedEx or other commercial delivery services
   3. Campus Mail (envelopes must be properly sealed and marked confidential)
   4. Intercampus couriers (items should be enclosed in properly marked and sealed containers)
2. Intra- or inter-campus couriering must be handled by University-employed couriers when appropriate. When such couriers are not used, the delivery must be made by a known and trusted employee or volunteer.
3. When possible, sender must be able to track progress during and after physical transport. (Signature receipt for a registered US Postal Service delivery is an example of an acceptable form of tracking.)
4. If mailed or couriered documents or media are known to be lost the incident must be reported to the appropriate business unit ISO.