UNIVERSITY OF WISCONSIN River Falls

Computer and Information Security

UWIT0013
Computer Security Incident & Investigation

This series consists of incidents involving unauthorized attempted entry attempts, probes, and/or attacks on data processing systems, information technology systems, telecommunication networks, and electronic security systems including associated software and hardware. This would include official reports and other documentation if appropriate.

Retention: EVT+ 5 years EVENT= Date that incident was resolved Destroy/Delete
Pll? May contain Pll
Confidential? Yes Wis SS Stats 19.62(5)
Copies: Destroy when no longer needed.

UWIT0014
Assignment and Authorizations for Users

This series consists of but not limited to:″ privileged user forms for managed servers and authorizations for privileged staff,″ Signed employee confidentiality agreements and user access and request and authorizations.

Retention: EVT +4 Years EVENT= Departure of Employee from employment Destroy/Delete Confidential may contain Pll
Pll? Yes
Confidential? Yes Wis SS Stats 19.62(5)
Copies: Destroy when no longer needed.

UWIT0015
Computer & Information Systems Logs

This record series consists of firewall logs, system logs, network logs, or other logs used to maintain the integrity and security of the university's computer systems.

Retention: CR +30 days or until review of logs is complete, whichever occurs first.Destroy/Delete
Pll? No
Confidential? No
Copies: Destroy when no longer needed.

UWIT0016
IT Disaster Recovery Planning and Testing Records

This series consists of Business Continuity Plans for recovery records created or received subsequent to implementing disaster recovery processes and recovering electronically-stored information which are not part of the routine business cycle for disaster recovery records.

Retention: Until Superseded Destroy/Delete
Pll? No
Confidential? No
Copies: Destroy when no longer needed.

UWIT0017
IT Disaster Recovery Records

This series includes the public records created during the disaster recovery process, which include but are not limited to: indexes, inventory lists, computer logs, working papers, and correspondence. This series also includes computer tapes, or other media, which are held in reserve in the event that an information system fails to function and records need to be recovered and restored. Most often, disaster recovery records are obsolete after two weeks,because they are superseded by newly-created records following routine business cycles.Therefore, the records retention time period reflects the routine business cycle for this records series. UW institutions may extend this retention period using a separate written policy, but no UW institution shall adopt a shorter business cycle than two weeks.

Retention: EVT +14 Days EVENT= Date of Disaster/Event Destroy/Delete
Pll? Yes specify: Social Security numbers
Confidential? Yes Wis SS Stats 19.62(5)
Copies: Destroy when no longer needed.

NOTES: Back-Up There is no retention schedule for back-up tapes or other forms of data back-up. A back-up tape or drive should be just that: a data/records back-up kept solely as a security precaution but not intended to serve as the record copy or as a records retention tool.In the case of disaster, the back-up would be used to restore lost records; otherwise, university records that have not met their retention should not be disposed of on the basis of the existence of a back-up. If for any reason (for instance, a disaster erases e-mails on your server)the only existing copy of an item that has not met its retention period is on a back-up tape or drive, the custodial agency of that record must ensure that the record on the back-up is maintained for the appropriate retention period. Aback-up containing record copies/only existing copies of items that have not passed their retention would have to be retained for the length of the longest unmet retention period. Preferably, the records should be restored to the agency from the back-up to ensure that the back-up is not used as a records retention tool.