MUSC Policy: Information Security Documentation

1. RATIONALE

Please refer to MUSC Information Security Rationale: The Need for Safeguards for an overview of the legal and ethical considerations that have motivated the development of this policy. The following laws and regulations have particular relevance:

HIPAA Security: 164.316(b)(1) Standard: Documentation

FTC Safeguards Rule: 314.3(a)

2. POLICY

Information security management processes at MUSC must be documented. The types of processes that must be documented include: risk assessments, risk management actions, and changes to security policies and procedures.

3. PROCEDURES

3.1. Definitions

Refer to MUSC Policy: Information Security: Appendix A.

3.2. Assigned Responsibilities

• System Owners are responsible for documenting their risk assessments.
• Management is required to document its risk management actions.
• The maintainer of a security policy or procedure is required to document changes to the policy or procedure.

In each case, the person responsible for the documentation must ensure that the documentation is (a) made available as needed to all authorized personnel, (b) periodically reviewed, (c) updated as needed in response to environmental or operational changes, and (d) retained for a minimum of six years.

3.3. Sanctions

Refer to MUSC Policy: Information Security: Sanctions.

3.4. See Also

MUSC Policy: Information Security

MUSC Policy: Information Security - Risk Management

MUSC Policy: Information Security - Evaluation

4. ACCESS

This policy will be maintained and published electronically by the Information Security Office. This policy is a public document and there are no restrictions on its distribution.