Data Classification, Storage, and Collaboration Requirements

Overview

George Mason University employees and other authorized individuals are responsible for protecting university information throughout its lifecycle. The level of protection required depends on the information’s sensitivity, intended use, and applicable legal, regulatory, or university requirements. Classifying information helps determine the appropriate safeguards, storage locations, access permissions, sharing methods, and retention requirements. Information that requires greater protection must be secured with stronger controls.

Classification helps determine:

• How it may be shared or transferred
• How it must be protected
• How it must be retained and disposed of
• Where it may be stored
• Who may access it

Who Must Follow These Requirements

The requirements apply when the following individuals conduct administrative, educational, financial, research, service, or other university business:

• Affiliates
• Faculty
• Independent contractors
• Other individuals who handle university information
• Staff
• Student and Student employees
• Vendors

Information Covered

These requirements apply to university data, information, and records in any format, including:

• Audio and video
• Digital text and files
• Images
• Microfilm
• Other physical or electronic records
• Paper documents

Handling information includes:

• Accessing or viewing
• Creating or collecting
• Disposing of or destroying
• Managing or preserving
• Sharing, transferring, or mailing
• Storing
• Using

Before You Store or Share University Information

• Determine its classification.
• Follow applicable records-retention and disposal requirements.
• Identify any legal, regulatory, contractual, security, or university requirements that apply.
• Identify the information involved.
• Limit access to individuals with an authorized university business need.
• Select a Mason-approved storage or collaboration service appropriate for the information’s classification.

---

Storage Solutions and Data Classification Matrix and Tables

Storage Services/Solution Matrix

Use the following resources to classify information and select an appropriate storage service:

Category	Service	Description	Primary Use Cases	Key Features
Collaboration Storage	OneDrive	Personal cloud storage tied to Microsoft 365 for George Mason files	Individual file storage	Accessible from anywhere, multi-device sync, personal library
	Microsoft Teams	Enterprise-wide collaboration platform within Microsoft 365	Team collaboration, file storage and sharing	Accessible from anywhere, synchronous editing, team-based storage
	SharePoint Document Libraries	Cloud-based document management system in SharePoint	Organized team file storage, external sharing	Accessible from anywhere, drag-and-drop organization
Enterprise Storage	Azure Files	Managed file share service in Azure	App storage, cloud workloads	Standard file system access, scalable cloud storage
	Azure Blob	Object-based cloud storage in Azure	Large datasets, backups, archives, analytics	Handles unstructured data, highly scalable
	Patriot Drive	On-premises enterprise storage	Access databases, automated file transfers	Limited use case, internal enterprise system
Research Computing Storage	HPC Hot Storage	High-speed flash storage on HPC clusters	Active computation, data analysis, project collaboration	High performance; hosts /home, /projects, /scratch; external sharing via Globus
	HPC Warm Storage	Hybrid HDD-SSD storage	Active analysis, data sharing, long-term storage	Cost-effective balance of performance and capacity;
	Secure Research Computing	Controlled research environment	Sensitive or regulated research data	Secure laptops and infrastructure, supports export-controlled and unclassified data
Media Storage	Kaltura MyMedia Library	Personal media repository in Canvas	Video, audio, and image storage; Zoom recordings	Automatically stores Zoom recordings, easy media management within Canvas

Highly Sensitive Data

Storage Location	Additional Information	Protected – Highly Sensitive Data	Justification
Patriot Drive Secure SharePoint (Refer to Highly Sensitive Data)	NA	The following student Information/ records: Non-directory data Student records (including directory data) flagged as confidential/private. Attributes defined as ‘Directory Information’ in Mason: FERPA. For Student Financial Aid that constitutes Federal Tax Information (FTI)**, refer to the separate listing below.	34 CFR 99 (FERPA) Va. Code § 23.1-405 34 CFR § 99.3 and 34 CFR § 99.37 Protecting Student Information FERPA for Staff and Faculty
	NA	Passwords/PINs and cryptographic private keys associated with User ID and/or system or technology services	Cybersecurity and fraud risk considerations
	NA	The following attributes when used in this combination should only be released to non-school officials for verification purposes. Student ID (G Number) Date of Birth	Office of the University Registrar: FERPA Va. Code § 23.1-405 (C)
	NA	Datasets containing Date of Birth	Date of Birth is often used for password resets and account claim processes. Va. Code §18.2-186.3
	Personally Identifiable Information (PII)* *Any personal information that can lead to identity theft if exposed. IMPORTANT: credit card data MUST NEVER be stored on Mason systems.	Social Security Numbers (SSN)	Va. Code § 2.2-3808 VVa. Code §18.2-186.6 VVa. Code § 18.2-186.3
		Financial account numbers	NACHA Va. Code §18.2-186.6 Va. Code § 18.2-186.3
		Driver’s license, state ID, military ID, passport, visa numbers	Va. Code §18.2-186.6 Va. Code § 18.2-186.3
	Protected Health Information	Medical/mental history, treatment, or diagnoses information; health insurance policy numbers, protected health information in hard copy or electronic formats.	Va. Code § 2.2-3705.2 45 CFR 160.103 HIPAA HITECH
	NA	Allegation and investigation records (all roles including students)	Title IX American Disabilities Act Privacy and confidentiality Law Enforcement
	NA	Data that must be withheld from release under the Virginia Freedom of Information Act (FOIA).	American Disabilities Act
	NA	Engineering, design, or operational information associated with Mason’s infrastructure. Such information should also be evaluated for FOIA exemption. This would include Network diagrams that contain detailed configuration information or network devices associated with systems categorized as ‘High” category.	Mason Policies and Standards Va. Code § 2.2-3705.2
	NA	Draft financial statements and similar reports that have not been approved for publication or distribution.	Drafts that may not be complete or accurate for being ‘work in progress’ can have material negative impact (e.g., reputational) if disclosed without being finalized.
Patriot Drive Archer Integrated Risk Management (IRM)	NA	Information shared by vendors or other parties under confidentiality or non-disclosure agreements.	Contractual obligations
Systems approved to store FTI such as Banner NIST 800-53 and NIST 800-171 compliant systems only	NA	**Federal Tax Information (FTI) for Federal Student Aid Programs	Internal Revenue Service (IRS) Publication 1075 Department of Education Announcement Department of Education Announcement
Secure Research Computing (SRC)*	* Contact the Office of Research Integrity and Assurance for applicable requirements and control restrictions	Research Support Services: Export control, Controlled Unclassified Information (CUI)	CUI NIST SP 800-171 ITAR
Rapid Prototyping Research Center*		Research Support Services: Controlled Unclassified Information (CUI)	CUI NIST SP 800-171 ITAR EAR

Restricted Data

Storage Location	Protected: Restricted	Justification
George Mason’s subscribed M365 including OneDrive	Student information attributes that may not be released under the directory information exception of FERPA. These are: Student Email Address Phone Number See Code of Virginia § 23.1-405(C) for conditions.	Office of the University Registrar: FERPA Va. Code § 23.1-405 (C)
	Unpublished research data that are not classified as Highly Sensitive Data (by the Principal Investigator or the Data Owner)	Patent, competitive and commercial potential, intellectual property, work product
	G numbers, Cardinal ID (by themselves, without any context or other attributes)	Privacy and potential fraud considerations
	Employment applications, employee performance evaluations, and personnel files without PII, as well as non-directory contact information	Privacy
	Personnel and financial information not covered by the definition of Highly Sensitive Data, but not intended to be made public.	N/A
	Internal communications and email, non-public reports or contracts, intellectual property, and all other information releasable in accordance with the Virginia Freedom of Information Act.	Least privilege, need-to-know
	Donor contact information and non-public gift information	Donor Privacy
Hopper Cluster by Office of Research Computing	Research project datasets that: Do NOT contain Personally Identifiable Information Are de-identified	45 CFR 46 HIPAA (Research Perspective)
Secure custom-configured George Mason-managed encrypted laptop or desktop	Research project datasets that: Do NOT contain Personally Identifiable Information Are de-identified	45 CFR 46 HIPAA (Research Perspective)

Public Use

Storage Location	Public Use Data	Justification
George Mason’s subscribed M365 including OneDrive	Published directory information (faculty, staff, students, etc.)	Office of the University Registrar: FERPA Va. Code § 23.1-405 (C) Va. Code § 23.1-405
	Research data that is unrestricted or based on publicly available information	Public Use
	George Mason’s Public Websites	Public Use
	Procedure manuals designated by the owner as intended for public use	Public Use
	Employment advertisements	Public Use
	Information in the public domain (e.g., campus maps, parking information, published news releases and announcements, events calendars)	Public Use

Definitions

Data Owner

A data owner is the university official or designated authority responsible for approving access to and appropriate use of specific university information.

High-Watermark Principle

The high-watermark principle requires applying the controls associated with the highest classification when information from multiple classification levels is stored, shared, or handled together.

Personally Identifiable Information

Personally identifiable information is information that allows an individual’s identity to be reasonably determined through direct or indirect means.

Examples may include:

• Biometric record
• Name
• Other information that can be linked to a specific individual
• Social Security number

Record

A record is any document, data, or file created or received while conducting public business that provides evidence of that business, regardless of its format or storage medium.

Examples may include:

• Administrative records
• Fiscal documentation
• Student academic files

Related University Policies

Data Stewardship

University Policy 1114 establishes responsibilities and general methods for controlling and appropriately managing public and university data. The policy applies to university information systems and uses of public and university data.

Physical and Logical Access Security

University Policy 1312 establishes access and security requirements intended to protect the privacy, security, and confidentiality of university systems.

Records Management

University Policy 1102 establishes responsibilities for managing, retaining, and destroying public records.

Responsible Use of Computing

University Policy 1301 establishes requirements for the appropriate use of Mason computing services.

Additional Resources

• Compare Storage Services and Solutions
• Government Data Collection and Dissemination Practices Act
• Mason storage-service information pages
  • Data Storage
  • Data Support Storage
  • File Storage Services
  • What are the user’s responsibilities in protecting Highly Sensitive Data on the system?
• Request an IT security consultation
• Review Data Classification and Storage Requirements
• University Records Management resources

Need Help?

The classifications and examples provided in university guidance are not all-inclusive. If information is not listed or you are unsure how to classify, store, or share it:

• Email [email protected].
• Request an IT security consultation.