Apply Standards
The Minimum Standards are a set of fundamental cybersecurity criteria designed to ensure a consistent baseline is applied across University assets. These standards help students, faculty, and staff protect University assets, safeguard data integrity, prevent unauthorized access, and comply with both internal policy and external regulatory obligations.
- Researchers should visit the OVPR’s Research Data Management site for additional policy considerations.
- Contractual or legal requirements may override these standards.
- Institutional policy or system limitations may override these standards.
Regulated Data (HIPAA, FERPA, PCI DSS): You may need to set up systems with special security controls like encryption or audit logs for health, student, or credit card data.
Sponsored Research Projects: Grant or sponsor requirements might require you to use specific security standards (like NIST or FISMA) when configuring your systems.
Vendor or Cloud Agreements: Some contracts with vendors or cloud providers may limit which security settings or locations you can use for your systems.
International Data Laws (GDPR): Sometimes, you must configure systems to store or process data only in certain regions to follow international or local laws.
Legacy Systems: There may be older (legacy) systems that cannot meet every aspect of the Minimum Standard (for example, lacking support for modern encryption).
Vendor Constraints: Some third-party software or platforms may have built-in restrictions that prevent full alignment with the Minimum Standard.
Business Continuity/Emergency Needs: During declared emergencies or business continuity events, temporary exceptions might be required for operational needs.
Accessibility and Accommodation: To accommodate Community Members with disabilities, alternative configurations or technologies might be required.
In these cases, documented exceptions and compensating controls are typically required.
University Minimum Standards
- Use the University Risk Classification schema to determine which Minimum Standard should be applied.
- Only high level requirements are represented in the tables below. Use the linked guides to apply the Minimum Standards.
- Level 5 (Federal Requirements): Reserved for exceptional cases. If you think your data meets Level 5, contact your School Privacy & Security Officer for guidance.
Personal Devices
Computers, laptops and mobile devices. Purchased and maintained by a community member.
Use this How To Guide for additional details to apply the Minimum Standards (HarvardKey required).
University Devices
Computers, laptops and mobile devices. Purchased and maintained by the University (purchased through University Finance or research grants).
Use this How To Guide for additional details to apply the Minimum Standards (HarvardKey required).
Servers
On premises or cloud based computing resource used for processing, storage, and application support.
Use this How To Guide for additional details to apply the Minimum Standards (HarvardKey required).
SaaS
Software as a Service, provides software applications over the internet, accessed through a web browser.
Use this How To Guide for additional details to apply the Minimum Standards (HarvardKey required).
IaaS
Infrastructure as a Service, control plane (management plane), provides resources like virtual servers, storage space, and networking over the internet.
Use this How To Guide for additional details to apply the Minimum Standards (HarvardKey required).
Privacy Insight
At Harvard, we are dedicated to safeguarding personal data. Securing assets is an important step but not all that is required. Certain information, including health and financial data, may require additional steps to comply with a law and/or regulation beyond securing an asset. For more information, reference the Privacy Principles guide and training.