Data Governance Policy

Purpose

This policy establishes uniform data governance standards and identifies the shared responsibilities for assuring the integrity of the data and that it efficiently and effectively serves the needs of Howard Community College.

Howard Community College values access to timely, accurate, and consistent information while fully appreciating the basic security and privacy requirements involved. Controlled access by employees to administrative information is necessary to support business functions.

This policy provides direction on the classification, ownership, and retention of data and information for Howard Community College as well as clarifying accountability for data and information. Data and information as pertaining to this policy includes both electronic and non-electronic data.

Howard Community College is reliant upon the confidentiality, integrity, availability, security, and privacy of its data and information to successfully conduct its operations, meet internal and external stakeholders' expectations, and provide services. Therefore, all staff, contractors, users, and external parties of Howard Community College have a responsibility to protect organizational data and information from unauthorized generation, access, modification, disclosure, transmission, or destruction and are expected to be familiar with and comply with this policy.

Scope

• This policy applies to all critical data and information in Howard Community College, including data and information hosted outside of Howard Community College stored in a cloud service. "Critical data," in this context, includes email, personal and shared files, specific application system records, website contents, and operating system-level information and data. The definition of critical data and scope of this policy will be reviewed annually by Planning, Research and Organizational Development (PROD) and Information Technology (IT).
• This policy applies to all who may be creators and/or users of such The policy also applies to third parties who access and use Howard Community College systems and IT equipment or who create, process, or store data owned by Howard Community College.

Definitions

Policy Statements

1. All data is owned by Howard Community College and, as such, all staff of Howard Community College are responsible for appropriately respecting and protecting the asset.
2. In order for Howard Community College to effectively manage and safeguard the data assets, procedures must be in place to guide appropriate data access, ensure the security of the data, and provide a means to address procedural exceptions.
3. A sustained data administration function should reinforce a set of definitions for commonly consumed data, with the understanding that there may be multiple valid definitions.
4. Data should be safeguarded to maintain the confidentiality and privacy of personally identifiable information; such safeguards should be balanced and reflect the necessity for Howard Community College to conduct its business. Data should be classified based on an agreed-upon data classification scheme and approved by Data Owners.
5. Access to Howard Community College data should be based on the business needs of the organization and should enhance the ability of Howard Community College to achieve its mission. Employees should have access to the data needed to perform their responsibilities, without regard to arbitrary barriers. In many cases, that data need not be individually identifiable.
6. Before individuals will be allowed to access Howard Community College data, training in the use and attributes of the data, functional area data policies, and Howard Community College policies regarding data is mandatory.
7. Extraction, manipulation, and reporting of Howard Community College data must be done only for Howard Community College business purposes:

• Personal use of Howard Community College data, including derived data, in any format and at any location, is prohibited.
• Where appropriate, before any information is used outside the Data User's functional unit, verification with the functional area manager and data owner is recommended.

8. Individuals seeking permission to access data outside of the access plan and defined roles must submit a written request for nonstandard access.

• This request should include a statement indicating the access being sought and the reason for the request and should be submitted to Planning, Research and Organizational Development.
• The Executive Director of Planning, Research and Organizational Development will send the request to the appropriate Data Steward/Owner for review and

Noncompliance

Violations of this policy will be treated like other allegations of wrongdoing at Howard Community College. Allegations of misconduct will be adjudicated according to established procedures. Sanctions for noncompliance may include, but are not limited to, one or more of the following:

1. Disciplinary action according to applicable Howard Community College policies
2. Termination of employment
3. Legal action according to applicable laws and contractual agreements

Agreement

I have read and understand the Howard Community College Data Governance Policy. I understand that if I violate the rules explained herein, I may face legal or disciplinary action according to applicable laws or company policy.

_____________________________________

Employee Name

_____________________________________ ____________________

Employee Signature Date