Information Security Policy
Policy Purpose
To establish an institutional commitment and expectation to uphold an Information Security Program and require adherence to the Program’s security requirements.
Persons Affected
Faculty, Staff, Students, Third Parties
Policy Statement
Farmingdale State College has established and maintains an Information Security Program (ISP) that provides the structure, safeguards, and direction necessary to protect college data and support our mission. The SUNY Information Security Policy 6900 External link has been adopted as the minimum baseline for the Information Security Program – with a commitment to meet or, in certain cases, exceed this standard. As part of the establishment of the Information Security Program, a designated, qualified individual with relevant expertise in information security, within the Information Technology department, will serve as the Information Security Program Lead.
Farmingdale State College is committed to protecting the confidentiality, integrity, and availability of college data and the systems that handle it, and to comply with applicable legal and regulatory requirements. As such, the Information Security Program will include administrative, technical, and operational safeguards appropriate to the size and complexity of the institution and the sensitivity of its information.
The college must maintain a set of information security policies that aid in addressing the ISP’s requirements. Any policies, implemented in addressing the ISP’s requirements, must adhere to the overarching principles and requirements set forth in SUNY system's Information Security Policy and the SUNY IT Standards, while addressing the specific needs, challenges, and risk landscapes of the college. These policies must not supersede any applicable laws or regulations.
As part of the ISP, the college will conduct an annual risk assessment to evaluate
risks to college operations, assets, and information. Risk assessments will also be
performed in alignment with applicable relevant conditions, directives and college
requirements as needed.
Roles and Responsibilities
Oversight
The Information Security Program Lead and the Executive Vice President for Administration
& Finance are primarily responsible for the oversight of the Information Security
Program.
Governance
The Information Security Program Lead is responsible for directing the governance
of the ISP. Such responsibilities include the selection and implementation of administrative
controls, such as college policies, in support of risk management that align with
the college’s unique strategies, goals, operational objectives, and risk profile.
The Program Lead may delegate specific activities to qualified designees, working
groups, or service providers, while retaining overall responsibility for governance.
Operations
The Information Security Program Lead, in conjunction with Information Technology,
are primarily responsible for selection and implementation of the ISP’s technical
and operational controls. The Information Security Program Lead will prepare a written
report to be provided to the college’s executive leadership for review and comment
on an annual basis.
Compliance
The Information Security Program Lead and the Executive Vice President for Administration
& Finance are primarily responsible for enforcement.
Vice Presidents are responsible for the compliance of their divisions with this policy, related college policies, and the overarching ISP’s controls. All members of the college’s community, including individual departments, are responsible for adhering to applicable college policies and security controls. This includes the responsibility for safeguarding the information they create, manage, or own.
Instances of non-compliance will be addressed on a case-by-case basis. All cases will be documented and notifications sent to responsible parties. These notices will include recommendations for corrective action. A reasonable period of time, depending on the level of exposure and criticality of the resource, will be stipulated for implementing corrective action. Follow up review(s) will determine the subsequent degree of compliance. Failure to meet compliance requirements may result in sanctions.
Nothing in this section is intended to be an impediment in responding to a security
incident.
Exceptions
Exceptions to the Information Security Program are permitted on a case-by-case basis. Review of exception requests must be performed by the Information Security Program Lead and the Executive Vice President for Administration & Finance. Upon review, a risk assessment of the exception must be performed to determine the risks associated with each request. Exceptions must be documented and retained for record keeping.
Responsible Office
Information Technology
Policy History
Revised: October 23, 2025