Faculty & Staff

Category HS
Highest Sensitivity
(Confidential / Sensitive Data)

Category MS
Moderate
Sensitivity
(Internal / Official Use Only Data)

Category NS
Non-
Sensitive
(Public Data)

Protection requirement

Protection of data is required by acts, laws, regulations, Columbia University policy or contract

Columbia University has an obligation to protect the data

No regulatory requirement

Examples
(this is not an
exhaustive
list)

• Credit card numbers
• SSN
• Passwords
• Medical records
• Student records
• Prospective student info
• Personnel record
• Donor or prospect info
• Financial info
• Research materials
• Contract
• Confidential agreements
• Other data not listed here but identified within HIPAA, GLBA, FERPA, PCI DSS or other privacy acts, regulations, laws.

• Financial transactions which do not include
Category A data (e.g., telephone billing)
• Physical plant detail
• Certain management
information

• Publicly posted press releases
• Publicly posted schedules of cla