Risk Level: Medium Risk
-
Secure destruction
—
by
Destroy devices and media that are no longer needed in a way such that no information can be recovered.
-
Data Retention
—
by
Observe applicable data retention policies upon project completion. Securely delete the information if possible. If you must retain a copy of information at this level, ensure that it remains secure.
-
Anonymize information
—
by
Anonymize information whenever possible and separate access to identified and de-identified data sets. For physical media store identified information in a separate locked file cabinet.
-
Code review
—
by
If you are developing (or contracting a vendor to develop) applications processing this level of information, review code and correct flaws prior to deployment.
-
Security by design
—
by
If you are developing (or contracting a vendor to develop) applications processing this level of information, include security as a design requirement.
-
Self Assessment
—
by
Review your systems and procedures regularly to ensure the tasks for this risk level are applied.
-
Incident Reporting
—
by
Promptly report actual or suspected compromise, including loss, theft, improper use, modification of, or access to information to security@mit.edu.
-
Mailing physical media
—
by
Use appropriately secure means when transferring physical media containing information. Track transfers to confirm that they reached the intended recipient.
-
Copiers & shared devices
—
by
Remove information on copiers, fax machines, or other shared devices promptly.