Skip to content Skip to navigation

Risk Classifications

Stanford has classified its information assets into risk based categories for the purpose of determining who is allowed to access the information and what security precautions must be taken to protect it against unauthorized access.

As of May 2015, a new set of classifications has been established and is now in effect for Stanford data and systems: Low Risk, Moderate Risk, and High Risk. The former framework - Prohibited, Restricted, Confidential, and Unrestricted - will be phased out by January 2016.

Special note to Stanford researchers: Except for regulated data such as protected health information (PHI), Social Security Numbers, and financial account numbers, research data and systems predominately fall into the Low Risk classification. Review the classification definitions and examples below to determine the appropriate risk level to apply.

Low Risk

Data and systems are classified as Low Risk if they are not considered to be Moderate or High Risk, and:

  1. The data is intended for public disclosure, or
  2. The loss of confidentiality, integrity, or availability of the data or system would have no adverse impact on our mission, safety, finances or reputation.

Moderate Risk

Data and systems are classified as Moderate Risk if they are not considered to be High Risk, and:

  1. The data is not generally available to the public, or
  2. The loss of confidentiality, integrity, or availability of the data or system could have a mildly adverse impact on our mission, safety, finances or reputation.

High Risk

Data and systems are classified as High Risk if:

  1. Protection of the data is required by law/regulation,
  2. Stanford is required to self-report to the government and/or provide notice to the individual if the data is inappropriately accessed, or
  3. The loss of confidentiality, integrity, or availability of the data or system could have a significant adverse impact on our mission, safety, finances or reputation.

Data Risk Classification Examples

Use the examples below to determine which risk classification is appropriate for a particular type of data. When mixed data falls into multiple risk categories, use the highest risk classification across all.

View Minimum Security Standards: Endpoints

Low Risk

  • Research data (at data owner's discretion)
  • SUNet IDs
  • Information authorized to be available on or through Stanford's website without SUNet ID authentication
  • Policy and procedure manuals designated by the owner as public
  • Job postings
  • University contact information not designated by the individual as "private" in StanfordYou
  • Information in the public domain
  • Publicly available campus maps

Moderate Risk

  • Unpublished research data (at data owner's discretion)
  • Student records and admission applications
  • Faculty/staff employment applications, personnel files, benefits, salary, birth date, personal contact information
  • Non-public Stanford policies and policy manuals
  • Non-public contracts
  • Stanford internal memos and email, non-public reports, budgets, plans, financial info
  • University and employee ID numbers
  • Project/task/award (PTA) numbers
  • Engineering, design and operational information regarding Stanford infrastructure

High Risk

  • Health Information, including Protected Health Information (PHI)
  • Health Insurance policy ID numbers
  • Social Security Numbers
  • Credit card numbers
  • Financial account numbers
  • Export controlled information under U.S. laws
  • Driver's license numbers
  • Passport and visa numbers
  • Donor contact information and non-public gift information

Server Risk Classification Examples

A server is defined as a host that provides a network accessible service.

View Minimum Security Standards: Servers

Low Risk

  • Servers used for research computing purposes without involving Moderate or High risk data
  • File server used to store published public data
  • Database server containing SUNetIDs only

Moderate Risk

  • Servers handling Moderate Risk Data
  • Database of non-public University contracts
  • File server containing non-public procedures/documentation
  • Server storing student records

High Risk

  • Servers handling High Risk Data
  • Servers managing access to other systems
  • University IT and departmental email systems
  • Active Directory
  • DNS

Application Risk Classification Examples

An application is defined as software running on a server that is network accessible.

View Minimum Security Standards: Applications

Low Risk

  • Applications handling Low Risk Data
  • Online maps
  • University online catalog displaying academic course descriptions
  • Bus schedules

Moderate Risk

  • Applications handling Moderate Risk Data
  • Human Resources application that stores salary information
  • Directory containing phone numbers, email addresses, and titles
  • University application that distributes information in the event of a campus emergency
  • Online application for student admissions

High Risk

  • Applications handling High Risk Data
  • Human Resources application that stores employee SSNs
  • Application that stores campus network node information
  • Application collecting personal information of donor, alumnus, or other individual
  • Application that processes credit card payments

Approved Services

This table indicates which classifications of data are allowed on a selection of commonly-used Stanford University IT.

Stanford Service Low Risk Moderate Risk High Risk: NON-PHI ¹ High Risk: PHI
Audio and Video Conferencing: Blue Jeans Approved for low risk data Approved for moderate risk data Approved for non-PHI high risk data Approved for PHI high risk data
AWS Infrastructure Approved for low risk data Approved for moderate risk data Approved for non-PHI high risk data not approved for high risk data
Backups: CrashPlanPROe Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Content Management: Drupal (Stanford Sites) Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Content Management: WordPress Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Calendar: Office365 Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Database Hosting: MySQL Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Document Management: Box Approved for low risk data Approved for moderate risk data

*

not yet approved for non-PHI high risk data
not approved for PHI
Document Management: Medicine Box Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Document Management: Google Drive and Docs Approved for low risk data Approved for moderate risk data

*

not yet approved for high risk data
not approved for PHI
Document Management: Office365 OneDrive Approved for low risk data Approved for moderate risk data

*

not approved for non-PHI high risk data
not yet approved for high risk data
Email: Google Mail (without “Secure:” in subject line) Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Email: Office365 (without “Secure:” in subject line) Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Email: Office365 and Google Mail (with “Secure:” in subject line) Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Email: Other Departmental Systems Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Encryption: Airwatch MDM Compliant Device Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Encryption: SWDE Compliant Device Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Encryption: VLRE Compliant Device Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
File Storage: AFS Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
File Storage: Secure AFS Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
File Storage: CIFS or NFS Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
File Storage: Secure File Storage Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
File Transfer: MedSecureSend (Accellion) Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Form Builder: Web Forms Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Instant Messaging: Stanford IM Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Issue Tracking: JIRA Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Network Access Control: SUNAC Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Request Tracking: Remedy Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Shared Computing: Barley, Cardinal, Corn Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Stanford Profiles: CAP Approved for low risk data not approved for moderate risk data high risk data not allowed high risk data not allowed
Survey Tool: Qualtrics Approved for low risk data Approved for moderate risk data not approved for high risk data Approved for PHI data
Voice Messaging Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
VPN Approved for low risk data Approved for moderate risk data Approved for general high risk data Approved for PHI data
Web Programming: CGI Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
Wiki: Confluence Approved for low risk data Approved for moderate risk data not approved for high risk data not approved for high risk data
¹ Payment Card Industry (PCI) data has special regulatory requirements that preclude using the services above. Contact the PCI team for assistance with handling this type of data.
* High Risk data not currently permitted, pending Data Loss Prevention (DLP) solution deployment.