Learn how to tell how sensitive a piece of NCU information is, where it's allowed to live, and the everyday habits that keep it safe.
The three data levels
Every piece of university information falls into one of three levels. The higher the level, the more harm if it gets out.
LEVEL 3
Restricted
Protected by law or contract. Severe harm if exposed.
• Grades, transcripts, student ID numbers
• Social Security and other ID numbers
• Health information
• Card and bank account numbers
• Personnel and pay records
• Donor info, legal matters, unshared strategic plans
Strictest protection
|
LEVEL 2
Confidential
For people at NCU with a business need. Moderate harm if exposed.
• Internal procedures and workflows
• Meeting notes
• Internal emails and messages
• Drafts and project timelines
• Non-public operational data
NCU systems only
|
LEVEL 1
Public
Meant to be public. Little or no harm if shared.
• Website content
• Press releases
• Published catalogs and schedules
• General info about programs and events
Share freely
|
Not sure which level? Treat it as the highest level that could apply, and ask your supervisor or the Office of Innovation & Technology.
Where it can live
|
Where
|
Level 1
|
Level 2
|
Level 3
|
|
NCU computers and file servers
|
✓ Yes
|
✓ Yes
|
✓ Yes
|
|
OneDrive
|
✓ Yes
|
✓ Yes
|
✓ Yes
|
|
Teams and SharePoint
|
✓ Yes
|
✓ Yes
|
✓ Yes
|
|
Other NCU-approved cloud services, like Azure
|
✓ Yes
|
With approval
|
With approval
|
|
Personal devices and personal cloud (Google Drive, Dropbox, iCloud, Box)
|
✓ Yes
|
✗ No
|
✗ No
|
All NCU work belongs on NCU devices and accounts, even if it's Level 1. Work you create on a personal device still belongs to NCU.
Everyday rules
💻 Use NCU devices and accounts
• Do NCU work on NCU computers and in NCU Microsoft 365.
• No personal email, WhatsApp, Signal, or personal cloud storage for NCU work.
• On your own phone, only the Outlook and Teams apps are allowed.
|
👥 Share only with who needs it
• Give people only the access they need for their job.
• In OneDrive and Teams, share with Specific people.
• Remove access when someone no longer needs it.
|
☕ Working in public
• Angle your screen so others can't see it, and use a privacy screen if you can.
• Lock your device every time you step away.
• Don't talk about sensitive information where others can hear.
|
🤖 AI tools
• Level 3: never.
• Level 2: only after removing names and identifying details.
• Level 1: fine.
• See Using AI at Work.
|
If it ends up in the wrong place
|
If
|
Do this
|
|
NCU files ended up on your personal device or account
|
Move them to OneDrive or Teams right away, then permanently delete every copy from the personal device.
|
|
A work photo is on your personal phone
|
Move it to OneDrive, then delete it from your phone.
|
|
Restricted or confidential data may have been exposed
|
|
For the full rules, see the Information Security and Acceptable Use of Information Technology policies.
Get help
Questions about how to handle something? Call the IT Service Desk at 612.343.4170, visit Miller Hall 226, or email cybersecurity@northcentral.edu.