Policies & Procedures Manual - Elizabeth City State University

400.3.1.21Adopted: 04/23/09Page 6 of 7a. File cabinets, desk drawers, overhead cabinets, and any other storage space containingdocuments with Identifying Information will be locked when not in use.b. Storage rooms containing documents with Identifying Information and record retention areaswill be locked at the end of each workday or when unsupervised.c. Desks, workstations, work areas, printers and fax machines, and common shared work areaswill be cleared of all documents containing Identifying Information when not in use.d. Whiteboards, dry-erase boards, writing tablets, and other writing surfaces in common sharedwork areas will be erased, removed, or shredded when not in use.e. When documents containing Identifying Information are discarded, they will be placed insidea locked shred bin or immediately shredded using a mechanical cross cut or Department ofDefense-approved shredding device. Locked shred bins are labeled “Confidential papershredding and recycling.”B. Other Policies and ProceduresThis Program incorporates by reference the following internal policies and procedures:a. Network Security Policyb. Banner Security Policyc. E-Mail Retention Policy8. Program AdministrationA. Oversight or program administration of this policy shall be as following:a. Responsibility for developing, implementing and updating this Program lies with the BOT anddesignated Chief Information Officer as Program Administratorb. The Program Administrator shall be responsible for ensuring appropriate training of Universitystaff on the Program, for reviewing any staff reports regarding the detection of Red Flags and thesteps for preventing and mitigating Identity Theft, determining which steps of prevention andmitigation should be taken in particular circumstances and considering periodic changes to theProgram.B. Staff TrainingUniversity employees responsible for implementing the Program shall be trained under the direction ofthe Program Administrator in the detection of Red Flags and the responsive steps to be taken when a RedFlag is detected.C. ReportsAppropriate staff shall report to the Program Administrator at least annually on compliance by theUniversity with this Program. The report shall address matters such as the effectiveness of the policiesand procedures of the University in addressing the risk of Identity Theft in connection with the openingof Covered Accounts and with respect to existing Covered Accounts; Service Provider arrangements;