Key Points

Why Data Classification Matters

  • Data classification is mandatory at Pomona College
  • Pomona uses three tiers: Public, Proprietary, Restricted
  • Restricted data requires encryption (AES-256-GCM) using gocryptfs
  • Data breaches have significant business, legal, and reputational costs
  • PIs are responsible for classification; you implement it correctly
  • Incident reporting is your responsibility; contact immediately if compromised

Regulations and Compliance

  • Multiple regulations (FERPA, EAR/ITAR, NIST 800-171) drive Pomona’s data policy
  • FERPA protects student education records; violations risk federal funding
  • Export controls (EAR/ITAR) apply to cryptography, advanced materials, and dual-use research
  • NIST SP 800-171 governs DOD-funded research with CUI
  • Pomona’s Information Security Policy applies to all data on college systems
  • When in doubt about export control, consult ORSP before sharing or publishing

The Three Tiers Overview

  • Public data is either fully publicly available or freely shared within lab/groups; no special handling required
  • File permissions: PUBLIC=755 (canonical)
  • Public data still requires attribution and version control
  • Two categories exist: fully public and shared internal to groups
  • Classification determines where data is stored and how it’s protected

Identifying Data Types

  • Proprietary data is restricted to specific authorized individuals; encryption recommended
  • Restricted data requires mandatory encryption (AES-256-GCM via gocryptfs) and audit logging
  • File permissions: PUBLIC=755, PROPRIETARY=750 (canonical; 600 variant for sub-team-only files), RESTRICTED=700+gocryptfs
  • FERPA, EAR/ITAR, CUI, and PII data are automatically Restricted
  • When in doubt, classify conservatively and ask your PI

The Classification Process

  • Inventory your data: know what you have before classifying
  • Understand content: ask whether your data contains PII, health info, export-controlled tech
  • Apply rules systematically: check Regulatory triggers first, then Proprietary, then Public
  • Classification is not a one-time event; re-classify as research evolves
  • Ask for help: consult PI, ORSP, or ITS when uncertain

Decision Framework

  • Use the decision tree to classify systematically: check regulatory triggers first
  • Document decisions: create an audit trail for classification choices
  • Re-classify regularly: as research evolves (publication, sharing, retention end)
  • Avoid common mistakes: classifying by format, over-classifying, or never reclassifying
  • Implement requirements: classification is meaningless without proper handling

Handling PUBLIC Data

  • Public data: World-readable (755) or group-readable (750); no encryption needed
  • Use /bigdata for large public datasets; /rhome is acceptable for small files
  • No audit logging or special retention required for Public data
  • Still verify data was approved for public release before sharing

Handling PROPRIETARY Data

  • Proprietary data: Group-readable (750) or owner-only (600); optional encryption for sensitive assets
  • Access control is enforced through file permissions, not trust
  • External sharing requires collaboration agreement + secure transfer + time-limited access
  • Retention varies by use case; reclassify to Public after publication

Handling RESTRICTED Data

  • Restricted data: Owner-only (700) PLUS mandatory encryption (AES-256-GCM via gocryptfs); audit logging required
  • Every access to Restricted data must be logged for compliance
  • Create explicit access authorization lists; review annually
  • Retention and secure deletion are required by regulation; use shred not rm
  • Never transfer Restricted data unencrypted; use SSH/SCP or institutional channels

Storage and Encryption

  • Use /rhome for encrypted Restricted data (smaller, backed up); /bigdata for large encrypted data
  • /rhome and /bigdata share 1 TB quota on BeeGFS
  • gocryptfs provides AES-256-GCM encryption without root access
  • Create encrypted container once, mount/unmount as needed
  • Always unmount when not actively using Restricted data
  • Back up the encrypted container, not the unencrypted contents
  • Passphrase must be 14+ characters (NIST SP 800-63B); store securely, never share

Sharing and Collaboration

  • Public data can be shared freely with anyone
  • Proprietary data requires collaboration agreement + secure transfer
  • Restricted data cannot be shared directly; must be de-identified first
  • Use institutional Box/OneDrive; avoid personal cloud storage (Google Drive, Dropbox)
  • Export-controlled research requires ORSP approval before international sharing
  • Publish data with DOI for reproducibility and impact

De-identification and Best Practices

  • De-identification removes identifiers while preserving research value
  • Four techniques: removal, aggregation, generalization, perturbation
  • Keep mapping files encrypted and separate from de-identified data
  • Publish data with DOI for reproducibility and impact
  • Data use agreements formalize access and protection obligations
  • Proper data classification protects your research, your community, and Pomona College