Securely Storing & Sending Files

Are emails that are sent to students secure?

• Yes. Email sent from an cortland.edu email address are stored in MS365 and MS Exchange Online.  This service is hosted by Microsoft  and is governed under a SUNY wide contract. It has specific protections related to FERPA and data security.

Can I send student grade info to a student upon request via email?

• Yes, but it should only be sent to a cortland.edu address. Information Resources cannot verify the identity nor the delivery of messages to non-cortland.edu email addresses.

Does research data with no PII need to be stored securely?

• It's not required, but always encouraged. Information Resources would like to have a conversation about the safety, backups and retention of that data.  Even "rolledup" or "anonymized" data can be harmful to the reputation of the faculty member or institution, if compromised.

Does research data with PII need to be stored securely?

• Often, yes. PII can be different things and some research with PII can be governed by law. When this is the case, that data absolutely needs to be stored on a Cortland server (U drive, shares drive, OneDrive). Information Resources will help anyone who deals with this type of research. Often the presence of PII is enough to put it at a level which needs to be stored on a Cortland server. If it's combined with other data elements it rises to a level where additional security may be required. Especially when dealing with children under 13 years old, health data, etc. Please contact Information Resources when working with PII data.

Do electronic files of graded papers need to be stored securely?

• Yes, these should be stored on a U drive, Shares drive or OneDrive.

Do electronic files of papers not graded (keep for assessment or records reasons) need to be stored securely?

• Yes, if it falls under FERPA due to a student’s names or information being on it.

Department Assessment files – which may contain PII but do not contain “grades.”

• It is best practice to store department assessment files that may contain PII to a secure location such as the U drive, Shares drive or OneDrive.

Back-up hard drives not connected to your computer and kept in your locked office.

• Backup hard drives, even under lock and key, can have a tremendous amount of data on them. That data would be better in a secure environment. Typical external drives are also prone to physical failures, dropped or even bumped drives can result in loss of data. Information Resources would like to work with faculty and staff to make sure their data is safe. Some faculty and staff have more data than a U drive can allow, but it does not mean IR cannot work with them on a safe storage solution. Please contact Information Resources if you have questions about data security or storage solutions.