{"id":1165,"date":"2026-08-04T12:52:29","date_gmt":"2026-08-04T17:52:29","guid":{"rendered":"https:\/\/it.rutgers.edu\/cybersecurity-compliance-program\/?page_id=1165"},"modified":"2026-08-04T13:39:14","modified_gmt":"2026-08-04T18:39:14","slug":"endpoint-security-standards-for-data-protection","status":"publish","type":"page","link":"https:\/\/it.rutgers.edu\/cybersecurity-compliance-program\/endpoint-security-standards-for-data-protection\/","title":{"rendered":"Endpoint security standards for data protection"},"content":{"rendered":"
\n\n
\n
\n \n

Endpoint security standards for data protection<\/h2>\n

The purpose of the Rutgers Endpoint Security Standards is to provide the minimum information security standards necessary to comply with the Rutgers Information Classification Policy<\/a>. These standards are mandatory requirements<\/strong> and establish an effective baseline of appropriate system, administrative, and physical controls to apply to data and\/or the systems that process data based upon its classification<\/strong>.<\/p>\n

Scope<\/strong><\/h4>\n

This standard applies to all University data, including but not limited to: HIPAA\/PHI, student record data, personnel data, financial data (budget and payroll), student life data, departmental administrative data, police records and legal files, and all other data that pertains to, or supports the mission and\/or administration of the University or any of its functions.<\/p>\n

Classification levels<\/strong><\/h4>\n

The Information Classification Policy identifies four (4) categories of data: Critical, Restricted, Internal, and Public.\u00a0 For more information on these classification levels and the major responsibilities of the parties involved (i.e. Vice Presidents, Chancellors, Deans, Information Owners Data Custodians, Information Managers and Information Users) please\u00a0review the policy<\/strong><\/a>\u00a0(PDF).<\/p>\n

Standard<\/strong><\/h4>\n

The following security standards outline the minimum level of protection and controls that must be adhered to based on the information classification of the data.<\/p>\n

* Endpoint Security Standards<\/em>, as it relates to the Palo Alto Perimeter Project, for the \u201cvpn-admin-internal\u201d zone.<\/p>\n

Network<\/strong><\/p>\n

\n \n \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n \n \n \n
Control Standard<\/th>Critical<\/th>Restricted<\/th>*Internal<\/th>Public<\/th><\/tr>\n<\/thead>\n
A network-based Firewall (or functional equivalent) shall be implemented that denies traffic from networks and hosts that are not secured at this level.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Network traffic shall be limited to only those services and ports considered essential for departmental business practices.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Networks and devices shall be scanned for vulnerabilities on a regular schedule. Those that contain Restricted data should be scanned more frequently. Vulnerabilities detected shall be remediated in a timely manner.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Suggested<\/td> <\/tr>\n
Security detection and prevention tools (Intrusion Prevention Systems) (IPS) and Endpoint Detection & Response (EDR) shall be implemented.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Suggested<\/td> <\/tr>\n
Devices processing or storing data shall log all significant security event information. Logs should be reviewed on a daily basis (Monday-Friday) and retained according to its data classification and\/or regulatory mandates.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Suggested<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n\n

 <\/p>\n

Servers<\/strong><\/p>\n

\n \n \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n
Control Standard<\/th>Critical<\/th>Restricted<\/th>Internal<\/th>Public<\/th><\/tr>\n<\/thead>\n
Devices hosting Rutgers services, applications and restricted data (as defined by Policy 70.1.2) shall be housed in a physically secure location, accessible to only those with a business purpose.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Security updates and patches shall be applied as soon as practical, or automatically when possible.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Computer system support staff must monitor for announced vulnerabilities in their hardware and software.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Enable university-approved Endpoint Protection to guard against viruses, malware, and other cyber-threats.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Where available, a host-based firewall shall be implemented.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
The principle of least privilege shall be applied when deploying services and applications.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
Passwords shall be changed from the vendor defaults. (Default credentials shall be prohibited)<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Systems shall be configured to comply with industry standards. (e.g. Center for Internet Security (CIS) Workbench)<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
Individual access to data shall be limited to only those needing access for legitimate purposes.<\/td>Required<\/td>Required<\/td>Required<\/td>Not Applicable<\/td> <\/tr>\n
The amount of restricted information collected and stored shall be the minimum amount required for the efficient and effective conduct of business functions.<\/td>Required<\/td>Required<\/td>Not Applicable<\/td>Not Applicable<\/td> <\/tr>\n
Only secure (encrypted) transmission shall be allowed. In absence of mitigating controls (e.g. a physically secured area), encrypted storage of Restricted information is required.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Files shall be backed up and tested on a regular schedule and stored in a secured location both on and off-site (following the 3-2-1 backup strategy).<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
Hardware, Software and data shall be securely disposed of at the termination of business need in accordance with Rutgers records management policy, 30.4.5.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Required<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n\n

 <\/p>\n

User Accounts\u00a0<\/strong><\/p>\n

\n \n \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n
Control Standard<\/th>Critical<\/th>Restricted<\/th>Internal<\/th>Public<\/th><\/tr>\n<\/thead>\n
A process shall be established to create and assign, maintain, and verify a unique system identifier (e.g. NetID, UserID) for each user.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
Authentication to a system identifier shall be controlled by a mechanism implemented based upon the sensitivity of the data.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n\n

 <\/p>\n

Desktop<\/strong><\/p>\n

\n \n \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n \n \n \n \n \n \n \n \n
Control Standard<\/th>Critical<\/th>Restricted<\/th>Internal<\/th>Public<\/th><\/tr>\n<\/thead>\n
Services and applications should be the minimum necessary to accomplish the required business functions.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
Passwords shall be changed from the vendor defaults.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Systems shall be configured to a recognized standard. (e.g. Center for Internet Security (CIS) Workbench) <\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n
Security updates and patches shall be applied as soon as practical, or automatically when possible.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Computer system support staff must monitor for announced vulnerabilities in their hardware and software.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Enable university-approved Endpoint Protection to guard against viruses, malware, and other cyber-threats. <\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
The amount of restricted information collected and stored shall be the minimum amount required for the efficient and effective conduct of business functions<\/td>Required<\/td>Required<\/td>Not Applicable<\/td>Not Applicable<\/td> <\/tr>\n
Hardware, Software and data shall be securely disposed of at the termination of business need in accordance with Rutgers records management policy, 30.4.5.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Required<\/td> <\/tr>\n
Only secure (encrypted) transmission shall be allowed. In absence of mitigating controls (e.g. a physically secured area), encrypted storage of Restricted information is required.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Automatic screen lock must be enabled after 15 minutes of inactivity and set to require a password to unlock.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n\n

 <\/p>\n

Portable devices (laptops, cell phones, tablets, etc.), removable media and non-Rutgers owned machines\/equipment<\/strong><\/p>\n

\n \n \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n \n \n \n \n \n
Control Standard<\/th>Critical<\/th>Restricted<\/th>Internal<\/th>Public<\/th><\/tr>\n<\/thead>\n
Hardware, software and data must be securely disposed of at the termination of business need in accordance with Rutgers records management policy. Hardware not capable of being digitally wiped must be physically destroyed.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Required<\/td> <\/tr>\n
Devices used for Rutgers business should utilize secure storage (full disk\/device encryption) whenever possible. Encrypted storage of Restricted information is required. Exceptions to this standard must be vetted by the Risk Management team.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Automatic screen lock must be enabled after 15 minutes of inactivity and set to require a password to unlock.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Security standards for desktops are followed.<\/td>Required<\/td>Required<\/td>Required<\/td>Recommended<\/td> <\/tr>\n
Devices used for Rutgers business should be remotely traceable, lockable and wipeable.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Devices used for Rutgers business should have a \u201cstrong password\u201d enabled and should lock (or wipe) after 10 failed attempts to login.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Not Applicable<\/td> <\/tr>\n
Use of personal devices (non-Rutgers-owned equipment -BYOD) for conducting Rutgers business.<\/td>Not permiteed<\/td>Not permitted<\/td>Allowed (*with prior authorization)<\/td>Allowed<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n
\n*Note: BYOD (Bring Your Own Device) is generally permitted with prior review and authorization by the user\u2019s management and OIT leadership. While the use of personal devices for university business is generally authorized under specific conditions, there may be exceptions that require additional review and approval. These exceptions will be considered in collaboration with management, local IT, the Office of General Counsel (OGC), the University Ethics Committee (UEC), and other relevant stakeholder groups as applicable and commensurate with risk. The need for additional review is based on the type of data classification, which can be found in the Information Classification Policy<\/a>, the ability to enforce appropriate security controls on the device, and the susceptibility of the device to cyber threats.<\/em><\/p>\n

Computing devices acquired through a grant or research contract authorized by the University, and\/or those that utilize the University’s computing infrastructure, are classified as university assets.<\/strong><\/em><\/p>\n

Software Development<\/strong><\/p>\n

\n \n \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n
Control Standard<\/th>Critical<\/th>Restricted<\/th>Internal<\/th>Public<\/th><\/tr>\n<\/thead>\n
Internally developed software shall be based on secure coding guidelines and reviewed regularly for common coding vulnerabilities.<\/td>Required<\/td>Required<\/td>Recommended<\/td>Recommended<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n\n<\/div>\n\n <\/div>\n