To improve Luther College’s security posture, ITS is implementing a Data Loss Prevention (DLP) tool. This tool is used to scan file systems and workstations for files containing Personally Identifiable Information (PII).

1. What types of Personally Identifiable Information (PII) is being searched for?
Currently the only data we will look for are Social Security Numbers and Credit Card Numbers. This list of PII will expand as we acclimate offices to this new process.

2. What data is revealed by the tool?
The tool will only report what the actual match is and the location of the file containing the match. No other data from the file is shared or accessible.

3. Why are we running these searches?
There are several reasons, two of which are listed here:
* Information safeguarding is our number one priority. This reduces our exposure risk while helping us achieve compliance with several government regulations.
Discovering the location of sensitive data assists us in adjusting business practices and evaluating how we are using data that can be considered sensitive or personally identifiable. It will also be helpful in assessing the adequacy of how securely we are storing data and whether improvements can be made.

4. What is a Data Steward?
A data steward is a designated office member that will work with ITS to facilitate/lead remediation for the office. They will receive detailed reports about PII locations for the office and work with individuals to clean up data found on the reports.

5. Do scans affect system performance?
In rare cases, we have seen decrease in performance of a workstation while a scan runs but in a vast majority of cases, the scan will run completely unnoticed.

6. How long do scans run?
The first scan will typically be the longest and can last up to an hour but will become faster over time and typically last only minutes.

7. I see a new icon on my system, do I need to manually run scans?
No, you do not. ITS will initiate the scan from a centralized server. If you choose to run a manual scan, the results of that scan will be shared back to that server for processing.