Private Information Management Initiative

Private Information Management Initiative (PIMI) Overview

The Private Information Management Initiative seeks to identify and reduce the amount of Private Information found on RIT computers and storage devices. Private information is information that is typically used to conduct identity theft and may include Social Security Numbers (SSNs), credit card numbers, driver’s license numbers, bank account information, etc.

Reducing the amount of Private Information (PI) will help safeguard the RIT community against identity theft and will help RIT comply with relevant state and federal laws.

Goals

1. Increase awareness of the importance of safeguarding all private information, not just SSNs
2. Increase awareness of the existing RIT policies that address private information
3. Increase sense of individual accountability and responsibility in the area of policy compliance surrounding private information and a related understanding of the consequences for noncompliance
4. Effective destruction of non-approved and unnecessarily retained private information (paper and electronic forms) from business units and employee offices
5. Integration of the Records Management Policy into everyday employee activities

Representation

RIT Information Security Office (ISO) is leading this initiative with the assistance of project team representatives from each college and division. The representatives include:

• An Information Steward/Management Representative who will receive reports detailing the location of Private information and will lead remediation efforts of Private information found in electronic and paper forms.
• A Technical Representative who will assist in inventorying computers assigned to the respective college or division and will assist the Information Steward/Management Representative in remediation efforts.
• Current list of representatives

What to Expect

ISO is working with various RIT organizations to identify the location of SSNs and other Private Information by providing a software tool (Microsoft Purview) that will scan computers and attached drives to determine if they contain Private information. When Microsoft Purview finds suspected Private information, it provides a report to the computer user and to the ISO. The software also provides the computer user with tools to erase (shred) the information securely or to remove (redact) the private information from the files.

Scans will be initiated by ITS. Computer users may also initiate an on-demand scan at their convenience. Microsoft Purview is licensed for use on RIT-owned computers and is currently available for Windows and Macs.

For More Information

For more information, contact the ISO.

IAP Plan Requirements and Template

Excerpted from the Information Access and Protection Standard

1. Information Inventory
   1. All RIT organizational units (departments, divisions, etc.) should identify and maintain an inventory (type, classification, location, accessibility) of all Private, Confidential, and Internal information they handle or maintain. The ISO provides an Information Access and Protection Plan Template to facilitate this requirement. (The plan should be updated at least annually.)
2. Training
   1. Divisional VPs and Deans are responsible for ensuring that mandatory information handling training is provided to any RIT employees (including adjuncts, temporaries and contractors), student employees, volunteers (including trustees, agents, members of affiliate groups, etc.) with access to Confidential or Private information.
   2. This training should be conducted on an appropriate periodic basis. (Annually is appropriate, and can be fulfilled through the self-paced web-based RIT Information Handling, available through the Talent Roadmap.)
3. Non-disclosures
   1. Divisional VPs and Deans are responsible for ensuring that users comply with RIT non-disclosure requirements, which may include signing a non-disclosure agreement.
   2. Systems, applications, or web page administrators (including student employees) who administer information systems containing Confidential or Private information should sign the RIT Systems Support Personnel Non-Disclosure Agreement form.

Resources

• Information Access and Protection Plan Template (The template provides instructions, examples of information classifications, and an inventory with examples.)

All RIT faculty and staff are expected to follow the Private Information Management Initiative (PIMI) requirements below:

• Review paper files for private information.
• Scan RIT computers with Microsoft Purview for private information (if Microsoft Purview is not available, scanning with an alternative tool or reviewing the computer for Private Information is recommended). Information Technology Services (ITS) will initiate scans of most computers monthly.
• Scan or review personal/home computers, portable devices, and media for private information.
• Inform your manager in writing if there is a compelling business reason for retaining private information. Promptly secure the information in compliance with the RIT Information Access and Protection Standard.
• Notify and receive approval from your PIMI Information Steward/Management Representative.
• If you're unable to remediate the information found within Microsoft Purview, please redact (securely erase or securely destroy) unnecessary private information.
• Complete the Digital Self Defense 103 Information Handling course. 

Additional Requirements for Department Managers

• Ensure faculty and staff have reviewed paper files and scanned or reviewed electronic files.
• Ensure faculty and staff have redacted, securely erased or securely destroyed unnecessary private information.
• Receive authorization to retain any private information from the Divisional VP/Information Steward/Management Representative.
• Secure the remaining private Information in compliance with the RIT Information Access and Protection Standard.

This table provides recommendations on the correct handling of private information at RIT.

New York State defines private information (PI) as any personal information concerning a natural person combined with one or more of the following data elements: Social Security number, driver's license number, account number, or credit or debit card number in combination with any required security code.

Digital Self Defense 103 - Information Handling fulfills the training requirement for handling RIT Private or Confidential Information.

Consult the Microsoft Purview End User Documentation for Windows or Mac for more information.

Links to guidelines for media sanitization:

• Abstract on Media Sanitization
• NIST SP 800-88 Standard

Document Destruction

Document Destruction Activities provide a focused opportunity for RIT faculty and staff to archive securely or dispose of paper records that contain private information. Private Information includes financial account numbers, social security numbers, driver’s license numbers and other information that can be used in identity theft. Participation in this activity will enable RIT to secure Private Information that could otherwise be used to facilitate identity theft. Document Destruction Activities are part of the RIT Private Information Management Initiative, but they are managed by your department. We encourage all departments to schedule Document Destruction Activities.

Why are Document Destruction Activities so important?

With its concentration of student records and private information, Higher Education is often targeted by attackers hoping to harvest private information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) for use in identity theft. In addition, careless storage or loss of records often leads to data breaches that require compliance with various state and federal laws requiring notification of affected consumers.

Participation in Document Destruction Activities will reduce the likelihood for the RIT community to have their personal information fall victim to malicious attacks or loss. This activity will also provide an opportunity for faculty and staff to adhere to the RIT Records Management Policy (C22.0). Any questions regarding the appropriate retention period can be addressed to the RIT Office of Legal Affairs.

When are my Document Destruction Activities?

Contact your Private Information Management Initiative representative to find out what activities are being planned in your college or division for document destruction.

What do I need to do for my Document Destruction Activities?

It is important that you keep track of any documents that may leave another person susceptible to identity theft attacks. In preparation for your department’s Document Destruction Activities, please review the files in your office to ensure that you have not retained any private information (e.g. Social Security Number, Bank Account Number, Credit Card Number or Drivers License) that is not critical to your current work. Take this opportunity to review files and dispose of them in accordance with the RIT Records Management Policy (C22.0).

We encourage you to review your files now and dispose of those containing Private Information securely. Ensure that any RIT files in your home do not contain any private information.

How do I dispose of portable media and paper documents containing Private Information securely?

Visit our Information Disposal page for recommendations.

What if I have questions?

Contact your division or college's PIMI representative.