Original Issuance Date: September 14, 2016
Last Revision Date: November 13, 2020
1. Policy Purpose
The purpose of this policy is to establish specific minimum standards for authentication across the University of Wisconsin System. This policy is designed to ensure that the UW System manages authentication in a consistent manner and to appropriately safeguard account-based access to information assets.
2. Responsible UW System Officer
Associate Vice President (AVP) for Information Security
This policy applies to all authentication administered throughout the UW System, whether centrally managed, managed in a distributed fashion, or departmentally managed. This policy applies to all individuals and entities who intend to access the UW System’s information systems and data. To the extent possible, the elements of Section 6. Policy Statement of this policy should be incorporated into contracts with third party providers.
The President of the University of Wisconsin System is empowered to establish information security polices under Regent Policy Document 25-5, Information Technology: Information Security. The UW System is committed to a secure information technology (IT) environment in support of its mission. This policy is designed to help ensure strong and consistent authentication standards throughout the computing environments of the UW System.
Please see SYS 1000, Information Security: General Terms and Definitions, for a list of general terms and definitions. Terms and definitions found within this policy include:
- Multi-Factor Authentication (MFA)
- Low Risk
- Moderate Risk
- High Risk
6. Policy Statement
Authentication methods for moderate and high risk data shall meet the standards outlined in UW System Administrative Procedure 1030.A, Information Security: Authentication Procedure .
Access to view low risk data does not require authentication. However, access to modify low risk data shall use authentication methods that meet the requirements for accessing moderate risk data.
7. Related Documents
Regent Policy Document 25-5, Information Technology: Information Security
UW System Administrative Procedure 1030.A, Information Security: Authentication Procedure
UW System Administrative Policy 1031, Information Security: Data Classification and Protection
UW System Information Security Program
8. Policy History
Revision 4: November 13, 2020
Revision 3: September 17, 2019
Revision 2: January 9, 2019
Revision 1: July 31, 2017
First approved: September 14, 2016
9. Scheduled Review
March 17, 2021