Information Classification

The purpose of this Information Classification Standard is to provide a framework for protecting the University of Florida and UF Health (ufhealth.org) information. Consistent use of this classification system will facilitate business activities and help keep the costs for information security to a minimum. In order to protect information from unauthorized disclosure, use, modification, and deletion, an information classification system has been designed as follows:

Restricted: Data in any format collected, developed, maintained or managed by or on behalf of the university, or within the scope of university activities, that are subject to specific protections under federal or state law or regulations or under applicable contracts. Examples include, but are not limited to medical records, social security numbers, credit card numbers, Florida driver licenses, non-directory student records and export controlled technical data.

Sensitive: Data whose loss or unauthorized disclosure would impair the functions of the university, cause significant financial or reputational loss or lead to likely legal liability. Examples include, but are not limited to, research work in progress, animal research protocols, financial information, strategy documents and information used to secure the university’s physical or information environment.

Open: Data that does not fall into any of the other information classifications. This data may be made generally available without specific information owner’s designee or delegate approval. Examples include, but are not limited to, advertisements, job opening announcements, university catalogs, regulations and policies, faculty publication titles and press releases.

More of Data Classification Policy: http://www.it.ufl.edu/policies/information-security/data-classification/