Step 5a: Determine the File's Origin

For each file that contains PII, consider these points: 

IMPORTANT NOTE: If you are under a litigation hold, contact University Counsel before making any changes. 

• Where did the file come from?
  
  • Is it your personal file? 
    
  • A file from someone who previously used or owned the computer?
    
  • A file from Carnegie Mellon business or academic operations?
    
  • Do you have no idea where it originated?
    
• If the file was left from the previous owner or if you have no idea where it originated:
  • If the machine was provided by Carnegie Mellon for business or academic operations consult your supervisor/advisor to learn what to do with the file.
  • If your supervisor/advisor does not believe the file was part of Carnegie Mellon business or academic operations AND you share your computer with family, friends or co-workers, please consult the people you share your computer with to determine the source of the file and whether it needs to be retained.
  • If you still do not know where the file originated after consulting your supervisor/advisor and the people who share your computer, shred the file.
• Carnegie Mellon Business/Academic Operations Or Personal Data
  • If you are unsure whether you need to retain a file containing PII related to Carnegie Mellon business or academic operations, please consult your supervisor/advisor.
    
  • If the file does not need to be retained, shred the file.
  • If the file does need to be retained, ask yourself if you need the sensitive PII portions.
    • If no, then redact (i.e., replace sensitive PII numbers with XXX while leaving the rest of the file unchanged).
    • If yes, then ask yourself if you need it on this computer?
      • Yes, then encrypt the file.
        
      • No, then quarantine the file.

Step 5b: Actions & The Password Vault

Last updated: 1/7/08