Authority: Executive Vice Chancellor and Provost; Executive Vice Chancellor for Finance & Administration; Vice Chancellor for Information Technology & CIO; and Vice Chancellor for Research and Innovation

History: First Issued October 27, 2026

Contact: Senior Vice Provost for University Data and Analytics ([email protected]); Or CISO/Director of Security & Compliance, Office of Information Technology ([email protected])

Related Policies:
POL 08.00.01 – Use of IT Resources Policy
REG 08.00.02 – Use of IT Resources Regulation
REG 01.25.12 – University Record Retention and Disposition Regulation
REG01.25.11 – Process for Requesting Access to Social Security Numbers
REG 04.00.08 – Security of Sensitive Plans Designs and Construction Documents Arrangements and Drawings
REG 07.40.01 – Disposal of University Property
REG 07.40.02 – Reporting Misuse of State Property
REG 01.25.19 University Data Regulation

Additional References:
University Data Regulation Guidance
NC State Data Management Framework
Information Technology Policies, Regulations and Rules
NC State Information Security and Privacy Acknowledgement Form

1. Purpose

1.1 Purpose

1.1.1 The purpose of this Rule is to define the classification process for the governance of University Data to allow for the appropriate degree of protection to be applied consistently across the university based on identified threats, risks, security, operational use, privacy, data governance and regulatory requirements.

2. Data Classification

2.1  Data Classification

2.1.1 Pursuant to REG 01.25.19 – University Data Regulation, University Data shall be classified into different groupings based on differences in its content and type. These groupings of data are given classification levels to inform Data Users of the appropriate way to access, handle, and protect data according to factors including but not limited to data security, privacy, regulatory compliance, data governance, and the operational use of data. Data Classification will be determined by the applicable Data Steward(s) based on risks related to the impact that may result from loss or unauthorized disclosure of data. It will also account for privacy requirements, operational use needs, and data ethics related considerations. These risk types encompass strategic, reputational, financial, operational, compliance, and health & safety elements. Risk types are represented on an impact scale based on the risk tolerance of NC State. Risk assessments are informed by the university’s information security program and supporting entities.

2.1.2  The degree of protection required for Data Elements is based on four classification levels: Ultra Sensitive/Purple, Highly Sensitive/Red, Moderately Sensitive/Yellow, and Not-Sensitive Data/Green, as well as any applicable contractual, legal and/or compliance requirements.  Examples of these data types are provided in the University Data Regulation Guidance.

a)  Ultra Sensitive Data (purple classification level)

Ultra Sensitive Data includes data where unauthorized disclosure or loss poses an exceptionally high risk or impact to the university or its affiliates, or where specific data categories require special privileged access management to support the university’s ability to prevent unauthorized data modification, use, or destruction.

b)  Highly Sensitive Data (red classification level)

Highly Sensitive Data includes data where unauthorized disclosure or loss poses a high risk or impact to the university or its affiliates. Authorized users of this data are responsible for managing data confidentiality, integrity, and availability to prevent unauthorized data modification, use, or destruction.

c)  Moderately Sensitive Data (yellow classification level)

Moderately Sensitive Data includes data where unauthorized disclosure or loss poses a moderate to low risk or impact to the university or its affiliates. Authorized users of this data are responsible for managing data confidentiality, integrity, and availability to prevent unauthorized data modification, use, or destruction.

d)  Not-Sensitive Data (green classification level)

Not-Sensitive Data includes data where unauthorized disclosure or loss poses a low risk or impact to the university or its affiliates. This information may be disclosed to individuals regardless of their university affiliation. Minimal security measures are needed to control the unauthorized modification, use, or destruction of this data.

e)  Data Yet to be Classified

Data Yet to be Classified refers to data that is created or collected within the university’s data environment, requires classification in order to support associated business processes, and has not been classified by the applicable Data Steward(s).  This data should be controlled, at a minimum, as purple/ultra sensitive until final classification is assigned.

3. Glossary

When used in this Rule, the following definitions shall apply:

3.1  “Availability” refers to ensuring timely and reliable access to information and resources.

3.2  “Data Access” means the ability, right, or permission to access data (including collection, access, storage, and disposition). This includes data stored in software, hardware, peripherals, audio, video, printed and digital materials.

3.3  “Data Category” is a broad classification or type of University Data.

3.4  “Data Disposition” means the act of disposing or transferring the care or possession of University Data.

3.6  “Data Element” refers to the most basic unit of data that has a unique meaning and represents a specific characteristic or attribute of an entity. Examples of Data Elements include gender, race, and geographic location.

3.8  “Data Environment” means the collection of computer systems and associated infrastructure devices, facilities, and people that support the storage, processing, or transmission of University Data.

3.9  “Data Classification” refers to the classification governance methodology for the management of university data and allows for the appropriate degree of protection to be applied consistently across the university based on identified threats, risks, and security requirements.

3.10  “Data Protection Controls” are the safeguards or countermeasures that are prescribed for protecting the confidentiality, integrity, and availability of University Data.

3.11 “Data Steward” refers to individuals who have been made responsible and accountable for the Confidentiality, Integrity, and Availability of University Data, Data Categories and Data Elements within their assigned Data Domain.

3.12  “Data Storage” means the collective methods and technologies that capture and retain information.

3.13  “Sensitive Data” means data that needs to be protected from unauthorized disclosure.

3.14  “University Data” means all the information content related to the business and mission of NC State that exists in any form (e.g., software, hardware, peripherals, audio, video, printed or digital) and its applicable metadata that is either owned by the University, an associated entity, or used by the university under contract with an external provider where NC State has custodial responsibility.