Information Security Office Menu

Server Management Standard

Purpose

• Instruct system, application and service administrators, owners and users on the appropriate use of Server Management Standard controls required as a condition for access to University of Oregon ("University") computing and information resources, as required by the Information Asset Classification and Management Policy ( IV.06.02 )
• Requirements identified herein reduce risks to the confidentiality, integrity and availability of University data and systems (“information assets”) and to protect the privacy of members of the University community. 

Applies To

This Standard applies to all University of Oregon or vendor owned servers connected to university networks, or any other server connected to university networks, including virtual machines or servers located in a cloud environment. 

Definitions

See ISO Standards - Glossary and Iconography for details.

Standard

• University owned servers SHALL be inventoried and managed by the IT unit or individual providing support, using processes and systems approved by the Information Security Office.
• University owned servers SHALL apply controls associated with the appropriate risk level for the data the server will process, store or access, as specified on Table1.

Associated Controls

Requesting Exceptions

In the event the standard cannot be achieved by reasonable means, you can request an exception by completing the Information Security Standard Exception Request form. Be ready to provide details as to why the standard can't be followed, the duration of the exception request and mitigating controls being put in place to meet the requirement.

Requesting Exceptions

Any user who suspects a violation of the standard should report the suspected violation to University Audit using the EthicsPoint System. EthicsPoint is available here.

Implementation Guidelines

Guidelines related to the implementation of this standard can be found on the Information Security Office website.

Additional Information

If you have any questions or comments related to this Standard, please send an email to the University Information Security Office at infosec@uoregon.edu .

Additional information can also be found visiting the following resources:

• University Information Security Program Policy
  • https://policies.uoregon.edu/vol-4-finance-administration-infrastructure/ch-6-information-technology/information-security-program 
• University Acceptable Use Policy
  • https://service.uoregon.edu/TDClient/KB/ArticleDet?ID=30997 
  • https://service.uoregon.edu/TDClient/KB/ArticleDet?ID=30999 
• University Information Asset Classification & Management Policy
  • https://policies.uoregon.edu/vol-4-finance-administration-infrastructure/ch-6-information-technology/information-asset 
• Data Security Classification Table
  • https://infosec.uoregon.edu/data-security-classification-table
• NIST 800-53
  • https://www.nist.gov/privacy-framework/nist-sp-800-53 

Revision History