Risk Management

This document is designed to enable University departments to self-assess their information security needs. Departments may utilize this survey in order to determine what types of administrative controls and practices are in place (or needed) while performing its daily business. Using this survey may help identify reasonable, foreseeable external and internal risks to the security, confidentiality, and integrity of data. These risks may result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of sensitive information.

As part of the KU Information Management plan, the University seeks to identify sensitive information under its control so that it may be properly classified, managed, and protected. Completion of this survey will help the University develop meaningful policies and procedures with regards to information protection. Additionally, the results of this survey will help KU in its training and education programs for faculty and staff that handle sensitive information as part of performing their job duties. In answering these questions, it is important that you understand a few key terms in the field of information security. Keep in mind that “unauthorized” actions may be intentional or accidental:

• Confidentiality: A loss of confidentiality is the unauthorized disclosure of information
• Integrity: A loss of integrity is the unauthorized modification or destruction of information.
• Availability: A loss of availability is the disruption of access to or use of information or an information system.