Guidelines for Storing Documents in the Cloud

Last Updated: 02/06/2018

Deciding if and how to make use of information technology services for creating, editing, storing and sharing documents has become more challenging. Traditionally, CU Boulder provided information technology services that were hosted on campus, using university owned equipment that was operated by university employees. Beginning in the mid-2000s, information technology companies began offering new information technology services that shifted away from the traditional hosting paradigm. Cloud Services, as they have come to be known, provide information technology services hosted off-campus, using non-university owned equipment that is operated by non-university employees. Cloud Services may often provide increased functionality at a lower cost than traditional services; however, they also generate very different data risk management considerations. Due to the university having less control over exactly which individuals have access to the data and over how the data is stored and managed, selecting and using Cloud Services for university documents requires different considerations than using traditional services.

This documentation provides guidance on how to determine if a Cloud Service meets the security and data governance requirements for appropriately managing CU Boulder documents including:

  • how to determine the Data Types and Data Classification of the data that would be stored in a cloud service,
  • summarizing the acceptable use for documentation storage for the most common Office of Information Technology provided cloud services,
  • and a process for determining the acceptable use of a particular Cloud Service for storing a document.

Vendor Contracts

The university consumes, generates, and provides access to data that is often subject to IP, FERPA, HIPPA, PCI, ITAR/EAR and other regulations. Vendor contracts often dictate where this regulated data may be stored. Please ensure that you are following the guidelines of your contracts to ensure you remain within the constraints of your agreements.

Data Classification and Security

The University of Colorado has adopted the following data classification types:

  • Highly Confidential Information
  • Confidential Information
  • Public Information

To learn more about data classification types, please refer to the university's Standards for Data Classification and System Security Categorization.

Data Classification for Common Data Types

Data Type Highly Confidential Data Confidential Data Public Information
Student Data Social Security Number
NID(?)
Financial Aid
Health information
Disability
Race
Ethnicity
Citizenship
Legal presence
Visas Religion

Military status
Veteran’s status
GPA
Probation
Suspension
COF
Service indicators
All non-directory data
Gender
Birthdate
Dorm
Emergency information
Student ID
UUID
Residency

Directory data
Human Resource Data Grievances/disciplinary actions
Performance evaluations (?)
Personnel records
Benefits
Salaries
Employment application
Employee ID numbers
Directory data
Health Data Medical records University insurance  
Personal Identifiable Information (PII) Social Security Numbers
Driver's License Numbers
   
Financial Data Payment Card Numbers
Financial Account Numbers
Loan numbers
Donor contact and gift amount
Fundraising information
 
CU Boulder Intellectual Property ITAR/EAR Proposals
ITAR/EAR Research plans and results
Any business document containing Highly Confidential data
Research proposals
Research plans and results
Instructional materials
Internal/unpublished business documents
Public policies
Published business documents

Acceptable Use for OIT Cloud Services

Table Legend

Indicator Description
Data Type Refer to Data Classification for Common Data Types table above for definitions of exactly which types of data belong to each data type classification.
Can be used for storage indicator Indicates the service can be used for documents containing the data type.
Can store depending on details of document indicator Indicates the service can store the document, but the acceptable use depends on the exact details within the document and how it may be shared/accessible by others.  If you intend to use the service for this document type, please contact the IT Security Office to review the use and what measures and practices will need to be in place to ensure the security of the information.
Can't be used for storage indicator Indicates the service is not acceptable for documents containing the data type.

Student Data

Data Types CU Boulder G Suite
messaging and collaboration services
CU Boulder Office 365
messaging and collaboration services
Desire2Learn
teaching and learning tools
Kaltura
teaching and learning tools
VoiceThread
teaching and learning tools
Large File Transfer
File transfer, storage and Infrastructure
Qualtrics
Business Services
Highly Confidential Can store depending on details of document indicator Can store depending on details of document indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can store depending on details of document indicator Can't be used for storage indicator
Confidential Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can store depending on details of document indicator Can store depending on details of document indicator Can be used for storage indicator Can store depending on details of document indicator
Public Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator

Human Resources Data

Data Types CU Boulder G Suite
messaging and collaboration services
CU Boulder Office 365
messaging and collaboration services
Desire2Learn
teaching and learning tools
Kaltura
teaching and learning tools
VoiceThread
teaching and learning tools
Large File Transfer
File transfer, storage and Infrastructure
Qualtrics
Business Services
Highly Confidential Can store depending on details of document indicator Can store depending on details of document indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can store depending on details of document indicator Can't be used for storage indicator
Confidential Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can store depending on details of document indicator Can store depending on details of document indicator Can be used for storage indicator Can store depending on details of document indicator
Public Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator

Health Data

Data Types CU Boulder G Suite
messaging and collaboration services
CU Boulder Office 365
messaging and collaboration services
Desire2Learn
teaching and learning tools
Kaltura
teaching and learning tools
VoiceThread
teaching and learning tools
Large File Transfer
File transfer, storage and Infrastructure
Qualtrics
Business Services
Highly Confidential Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can store depending on details of document indicator Can't be used for storage indicator
Confidential Can store depending on details of document indicator Can store depending on details of document indicator Can store depending on details of document indicator Can store depending on details of document indicator Can store depending on details of document indicator Can store depending on details of document indicator Can store depending on details of document indicator
Public Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator

Personally Identifiable Information (PII)

Data Types CU Boulder G Suite
messaging and collaboration services
CU Boulder Office 365
messaging and collaboration services
Desire2Learn
teaching and learning tools
Kaltura
teaching and learning tools
VoiceThread
teaching and learning tools
Large File Transfer
File transfer, storage and Infrastructure
Qualtrics
Business Services
Highly Confidential Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can store depending on details of document indicator Can't be used for storage indicator
Confidential Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can store depending on details of document indicator Can't be used for storage indicator
Public              

CU Boulder Intellectual Property

Data Types CU Boulder G Suite
messaging and collaboration services
CU Boulder Office 365
messaging and collaboration services
Desire2Learn
teaching and learning tools
Kaltura
teaching and learning tools
VoiceThread
teaching and learning tools
Large File Transfer
File transfer, storage and Infrastructure
Qualtrics
Business Services
Highly Confidential Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can't be used for storage indicator Can store depending on details of document indicator Can't be used for storage indicator
Confidential Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator
Public Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator Can be used for storage indicator

References

CU Boulder Cloud Service Documentation

Messaging and Collaboration Services

Teaching and Learning Tools

File Transfer, Storage and Infrastructure

Conferencing Services

OIT Business Services

University of Colorado Office of Information Security Resources