Policies
- USNH Cybersecurity Policy (effective July 1, 2022)
- USNH Acceptable Use Policy (effective July 1, 2022)
- USNH Information Classification Policy (effective July 1, 2022)
- USNH Password Policy (effective October 4, 2022)
- USNH Privacy Policy (effective August 1, 2022)
Standards
Application Security
- Artificial Intelligence Standard (effective 31 JULY 2023)
- Email Security Standard (effective 20 APRIL 2023)
communication
- Digital Millennium Copyright Act Requirements (DMCA) (effective 12 APRIL 2023)
- Training & Awareness Standard (effective 06 MARCH 2023)
Data security
- Security Categorization Standard (effective 15 SEPT 2022)
- Shared File Management Standard (effective 26 APRIL 2023)
- USNH Data Security Addendum (effective 05 JUNE 2023)
device management
- Endpoint Management Standard (effective 07 JULY 2023)
- Security Standards for Mobile Devices (effective 24 AUG 2022)
- Vulnerability and Patch Management Standard (effective 30 SEPT 2022)
Identity and Access Management
- Access Management Standard (effective 06 MARCH 2023)
- Account Management Standard (effective 25 AUGUST 2023)
- Access to Password Protected Information Standard (effective 12 APRIL 2023)
- Privileged Access Management Standard (effective 14 OCT 2022)
- Remote Access Security Standard (effective 14 OCT 2022)
- Sponsored Accounts Standard (effective 06 JUNE 2023)
network & connectivity
- Network Security and Management Standard (effective 29 JAN 2022)
- Privately Managed Network Standard (effective 08 MARCH 2023)
physical security
risk management
- Exception Standard (effective 15 SEPT 2022)
- Risk Acceptance Standard (effective 15 SEPT 2022)
- Risk Management Standard (effective 15 SEPT 2022)
system administration
- Secure Configuration Management Standard (effective 16 DEC 2022)
- Security Monitoring and Log Management Standard (effective 01 JUNE 2023)
vendor management
- Third-Party Information Security Standard (effective 10 MARCH 2023)
Standards
In Force:
- Cybersecurity Exception Standard (effective 15 FEB 2021)
- Cybersecurity Risk Management Standard (effective 15 FEB 2021)
- Cybersecurity Risk Acceptance Standard (effective 15 FEB 2021)
- Security Categorization Standard (effective 15 FEB 2021)
- Endpoint Management Standard (effective 10 AUG 2021)
- Access Management Standard (effective 19 AUG 2021)
- Cybersecurity Awareness & Training Standard (effective 19 AUG 2021)
- Privately Managed Network Standard (effective 19 AUG 2021)
- Vendor Cloud Service Security Standard (effective 19 AUG 2021)
- Access to Password Protected Information Standard (effective 6 JAN 2022)
- Digital Millennium Copyright Act Standard (DMCA) (effective 29 JAN 2022)
- Network Security and Management Standard (effective 29 JAN 2022)
- Sponsored Accounts Standard (effective 10 FEB 2022)
ET&S Policy & Standard Initiative
Technology/Cybersecurity Policies & Standards
Provide Feedback on Proposed Policies
Sign-up to Receive Policy & Standard Initiative Updates via Email
- Endpoint Management Standard (effective 6 AUG 2021)
- Cybersecurity Awareness and Training (effective 6 AUG 2021)
- Vendor Cloud Service Security (effective 6 AUG 2021)
- Privately Managed Network (effective 6 AUG 2021)
- Access Management (effective 6 AUG 2021)
Policies
In Force:
- USNH Use of Technological Resources Policy
- USNH Password Policy (effective 20 JAN 2020)
- USNH Privacy Policy (effective AUG 2018)
Proposed
Targeted effective date 01 MAY 2021
Feedback on or questions about these Proposed Policies can be submitted here.
Standards
In Force
- Cybersecurity Exception Standard (effective 15 FEB 2021)
- Cybersecurity Risk Management Standard (effective 15 FEB 2021)
- Cybersecurity Risk Acceptance Standard (effective 15 FEB 2021)
- Security Categorization Standard (effective 15 FEB 2021)
Proposed
Targeted effective date 01 MAY 2021
- Access Management Standard
- Cybersecurity Awareness & Training Standard
- Identity Management Standard
- Privately Managed Network Standard
- Privileged Access Management Standard
- Vendor Cloud Service Security Standard
Feedback on or questions about these Proposed Standards can be submitted here.
Planned
Phase 1 Remaining Standards, targeted to become effective 01 May 2021, will be available for review by early March 2021
- Access to Password Protected Information Standard
- Public and Sensitive Information Handling Standard
- Protected Information Handling Standard
- Restricted Information Handling Standard
- Confidential Information Handling Standard
- Endpoint Management Standard
Phase 2 Standards, targeted to become effective late summer/early fall 2021
- Account Management Standard
- Institutional Email Security and Use Standard
- Network Security and Management Standard
- Server Security and Management Standard
- Sponsored/Guest Access Management Standard
Phase 3+ Standards, planned for late 2021 and 2022
- Application Administration Standard
- Contingency Planning Standard
- Cybersecurity Roles and Responsibilities Standard
- Data Breach Notification Standard
- Data Center Facility Security, Access, and Use Standard
- Data Administration and Management Standard
- Information Technology Resource Secure Disposal Standard
- Information Technology Inventory Management Standard
- Non-Primary Identity Management Standard
- Password Management Standard
- Personnel Security Standard
- Physical Information Technology Asset Access and Management Standard
- Remote Access and VPN Standard
- Security Assessment and Testing Standard
- Security Configuration Management Standard
- Security Logging and Monitoring Standard
- Shared File Storage Standard
- System Acquisition, Development, and Maintenance Lifecycle Standard
- Vulnerability and Patch Management Standard
- Wireless Network Security and Management Standard
The Cybersecurity General services request can be used to ask questions or raise concerns about any of the published Standards. You can also contact the Cybersecurity GRC team with questions - Cybersecurity.GRC@usnh.edu. However, unless specifically noted as being open for Public Comment, Standards published to this site are final, approved versions provided to allow administrative, academic, and business units an opportunity to review prior to their effective date and, if needed, request exceptions.
