Explain various security measures to handle protected data.

Following are the various security measures required to handle protected data: (a) Access control: Access to protected data must be on a least-privilege basis, granted only when required by business processes and approved by the Data Steward. All accounts with access must be password-protected according to specified rules, with strict system-enforced protocols. (b) Sharing: Protected data may be shared among University employees based on well-defined business processes approved by the Data Steward. Public release is only permitted under well-defined business processes and with the Data Steward's permission. (c) Retention: Protected data should only be stored for the duration necessary to accomplish the documented business process. (d) Incident Notification: Any potential security incident that risks unauthorized access to protected data must be reported to ITS Technology Security Services. (e) Enable System Logging and Auditing: All data access activities must be logged and recorded. Facilities for automatic generation, retention, and expiration of system logs must be enabled.