System Access Policy
JSU must protect and control access to the sensitive Data it creates, collects, stores and process in paper, and electronic formats in accordance with all applicable federal and state laws and university policies.
System Access Policy
Abstract
JSU must protect and control access to the sensitive Data it creates, collects, stores and process in paper, and electronic formats in accordance with all applicable federal and state laws and university policies.
Policy Statement
Jackson State University’s (“JSU” or “University”) Division of Information Technology’s (“DIT”) intention for publishing a System Access Policy for CUI data is to identify how the University will protect access to systems collecting creating , storing and process CUI data.
Purpose
NIST SP 800-171 focuses on protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems and organizations and recommends specific security requirements to achieve that objective. The requirements recommended for use in SP 800-171 are derived from FIPS Publication 200 and the moderate security control baseline in NIST Special Publication 800-53 and are based on the CUI regulation (32 CFR Part 2002, Controlled Unclassified Information).
Scope
This policy applies to all organization workforce members and all systems, network, and applications that process, store or transmit CUI. This policy also applies to all vendors, partners, researchers and contractors.
Responsibilities
The Chief Information Security Officer is responsible for ensuring the implementation of this policy.
Definitions
- Information system – a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.
- Information resources – JSU laptops, desktops, printers, scanners, servers, network devices, paper documents, and mobile devices such as smartphones
- Policy Number
- 50000.025/ CMMC AC.1.001
- Effective Date
- 4/22/2023
- Review/Revised Date
- 3/09/2026
- Category
- Information Technology
- Policy Owner
- CIO/Information Technology
- Policy Contact
- CISO/Information Technology
Policy
All environments involved with CUI must comply fully with the NIST 800-171 standards (either directly or through compensating controls. Jackson State University and its employees, vendors, and contractors will implement the following CUI access control requirements for systems with CUI data:
- 1.1Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- 1.2Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 1.3Control the flow of CUI in accordance with approved authorizations.
- 1.4Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
- 1.5Employ the principle of least privilege, including for specific security functions and privileged accounts.
- 1.6Use non-privileged accounts or roles when accessing non-security functions
- 1.7Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
- 1.8Limit unsuccessful logon attempts.
- 1.9Provide privacy and security notices consistent with applicable CUI rules.
- 1.10Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity
- 1.11Terminate (automatically) a user session after a defined condition.
- 1.12Monitor and control remote access sessions.
- 1.13Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
- 1.14Route remote access via managed access control points.
- 1.15Authorize remote execution of privileged commands and remote access to security-
- 1.16relevant information
- 1.17Authorize wireless access prior to allowing such connections
- 1.18Protect wireless access using authentication and encryption
- 1.19Control connection of mobile devices
- 1.20Encrypt CUI on mobile devices and mobile computing platforms
- 1.21Verify and control/limit connections to and use of external systems
- 1.22Limit use of portable storage devices on external systems
- 1.23Control CUI posted or processed on publicly accessible systems
Sanctions and related standards
Sanctions/Compliance
Failure to comply with this or any other security policy will result in disciplinary actions as per the Sanction Policy. Legal actions also may be taken for violations of applicable regulations and laws.
Related Standards, Policies, and Processes — Account Management
- User registration and de-registration
- User access provisioning
- Management of privileged access rights
- Review of user access rights
- Removal or adjustment of access rights
Access Enforcement
- Teleworking
- Access to networks and network services
- Information access restriction
- Use of privileged utility programs
- Standard
- NIST SP 800-171
- Derived From
- FIPS Publication 200 and NIST SP 800-53 moderate baseline
- Regulation
- 32 CFR Part 2002, Controlled Unclassified Information
- Framework
- CMMC AC.1.001
- Applies To
- Workforce members, vendors, partners, researchers and contractors
- Enforced By
- Chief Information Security Officer
Related pages
See something suspicious?
Report cyber incidents to the Division of Information Technology right away.
JSU Cyber Awareness
Student Center
Jackson, MS 39217-0280
