9/23/22, 7:57 PM Information Asset Classification

Information Security and Privacy

Home »
Security Plan »
Information Asset Classification

Classifying Institutional Information and IT Resources

At UC, protecting our Institutional Information and IT Resources is critical to our mission of teaching, research, and
public service.

UC's Electronic Information Security Policy (IS-3) defines requirements for the appropriate classification of Institutional
Information and IT Resources to ensure their confidentiality, integrity and availability.

The policy uses a risk-based approach to identify effective controls based on the need to achieve a specific
Protection Level or Availability Level. UC’s investment in security controls is commensurate with the level of need for
protection or availability of the Institutional Information.

Protection Levels:
Designed around protecting the confidentiality and integrity of institutional information and IT resources. Protection
Level Details

Protection Level 1 (P1)

Protection Level 2 (P2)
Protection Level 3 (P3)
Protection Level 4 (P4)
Critical Infrastructure

Availability Levels:
Designed around protecting the availability of campus institutional information and IT resources.  Availability Levels
Details

Availability Level 1 (A1)

Availability Level 2 (A2)
Availability Level 3 (A3)
Availability Level 4 (A4)

Resources:
Classification Decision Tree
Mapping of Old Classification to New Classification

https://security.uci.edu/security-plan/plan-classification.html 1/2
9/23/22, 7:57 PM Information Asset Classification

Roles and Responsibilities

UC Protection Level Classification Guide
UC Availability Level Classification Guide
Classification Levels Workshop - 2020
Classification Training - 2020

Information Security &

Privacy

University of California, Irvine

Irvine, CA 92697

© 2022 UC Regents

https://security.uci.edu/security-plan/plan-classification.html 2/2