CPHS Questionnaire Guide for Electronic Safeguards

A knowledge base article about CPHS Questionnaire Guide for Electronic Safeguards provided by the UC Berkeley IT Service Hub - Knowledge Portal

The objective of the CPHS assessment is to ensure that covered devices (e.g., workstations, laptops, servers) comply with the data security requirements issued by the California Health and Human Services Agency (CHHSA) Committee for the Protection of Human Subjects (CPHS).

This guide will walk you through the questions in the Electronic Safeguards section and provide tips and instructions to help you understand the compliance requirements and how to fulfill them.

Technical Details 

ISO recommends the Secure Research Data & Compute (SRDC) platform or another approved server environment for handling PID. If you would like to use the SRDC link is external) platform you can contact Research IT to set up a consulting appointment.

Approved server environments:

The FIPS-140-2 standard is referred to by many of the requirements. It is the Federal Information Processing Standard specified security requirements for cryptographic modules.

Before beginning the questionnaire

Fill out the CPHS Researchers and Covered Devices Google document. 

    1. When you are finished filling out the document, give ciso-mssei-ssp@calgroups.berkeley.edu commenter access.

    2. Keep the URL of the document handy as you will provide it to us in the questionnaire. 

    3. Please also keep this document updated for your own records/inventory.

Additional Resources

ISO recommends that your research project review the following resources: 

ELEC-01 Do workstations or laptops that handle PID have full disk encryption that uses FIPS 140-2 compliant encryption? If yes, please describe the type of encryption in use.

  • BitLocker for Windows and FileVault2 for MacOS fulfill this requirement.

Recommendation:

  • Follow the instructions below to enable full disk encryption:

ELEC-02 Do removable media devices (e.g., USB thumb drives, CD/DVDs, smartphones, backup tapes) that handle PID have full disk encryption that uses FIPS 140-2 compliant encryption? If yes, please describe the type of encryption in use.

FIPS 140-2 compliant USB flash drives can be purchased to fulfill this requirement. Encryption and decryption is done on the drive, with no trace left on the host system.

ELEC-03 Do you apply security patches to all systems handling PID (e.g., servers, laptops, workstations, mobile devices)?

  • Approved server environments fulfill this requirement. 
  • Enabling Automatic Windows Updates or Mac Software Updates fulfills this requirement. 
  • Campus-owned laptops and/or workstations that are managed by Berkeley Desktop fulfill this requirement. However, it is important to regularly log out or manually reboot the machine periodically so that it receives security updates in a timely fashion. The device will not auto-reboot if a user is logged into a Berkeley Desktop machine.

Recommendation:

  • Application software must also have security updates applied.
  • Non-Berkeley researchers or researchers with personally-managed devices can follow the Patching and Updates Steps or can consult with their local IT administrator to confirm that system updates are installed automatically.

ELEC-04 Do all systems and media handling PID enforce strong passphrase controls consistent with campus passphrase requirements?

Ensure that all passphrases in the PID computing environment adhere to campus MSSND 5: Passphrase Guidelines. All users should be aware and trained on campus passphrase requirements and systems should enforce passphrase policies whenever feasible.

These requirements apply to passphrases for:

  • Local user, single sign-on, default, and service accounts
  • Applications
  • Encrypted removable media or other electronic storage that handle PID

ELEC-05 Do all users handling PID utilize a password manager such as LastPass to store account passwords, encryption keys, and other credentials? If not, please describe how passwords are securely stored.

ISO recommends that you utilize a password manager such as LastPass to generate and manage unique passphrases that exceed the campus complexity requirements. UC Berkeley is offering Free LastPass Premium to all Students, Staff, and Faculty.

ELEC-06 Is the automatic screen lock out on workstations and laptops handling PID set to 15 minutes or less?

  • Campus-owned laptops and/or workstations that are managed by Berkeley Desktop fulfill this requirement.

Recommendation:

  • Non-Berkeley researchers or researchers with personally-managed devices can follow Device Lock-out Steps or can consult with their local IT administrator to enable screen lockout.
  • See the MSSND Device Lock-Out requirement.

ELEC-07 Is anti-virus software used on devices (e.g., servers, laptops, and workstations) handling PID? What anti-virus software do you use (e.g., Windows Defender)? Is the anti-virus software configured to automatically download and install updates on a periodic basis?

  • Approved server environments fulfill this requirement.
  • Campus-owned laptops and/or workstations that are managed by Berkeley Desktop fulfill this requirement.
  • Windows devices with Windows Defender enabled fulfill this requirement. 
  • Mac devices running a supported version of MacOS fulfill this requirement.

Recommendation:

  • Non-Berkeley researchers or researchers with personally-managed devices can follow Anti-malware Software Steps or can consult with their local IT administrator to confirm that anti-virus software is configured correctly.

ELEC-08 Are your servers registered in Socreg to take advantage of campus intrusion detection and prevention services?

  • Approved server environments fulfill this requirement.
  • All other server environments must be registered in Socreg, please see our Socreg Documentation.

ELEC-09 Are your servers participating in the campus log correlation service (ArcSight)?

  • Approved server environments fulfill this requirement.
  • All other server environments can enroll in the Log Correlation Program.

ELEC-10 Are automated audit trails enabled on devices (e.g., servers, laptops, and workstations) with PID? Are logon events, account management, policy change, privilege escalation, and system events logged? Please describe.

  • Approved server environments fulfill this requirement.
  • Describe the logging capabilities enabled on all devices that will be handling PID.

ELEC-11 Is electronic PID transmitted outside the secure internal network (e.g., emails, website access, and file transfer)? Describe all use cases where PID will be transmitted outside of the secure research environment (e.g., off a researcher’s laptop or workstation or the research project server). Include the type of software used to transmit PID, encryption method/cipher employed, and source and destination information.

Please see the Data Encryption in Transit Guideline.

ELEC-12 Are the systems storing and accessing electronic PID inaccessible from the Internet? Please describe any remote access methods used to access systems handling PID, the business justifications, and firewall ruleset.

  • Approved server environments fulfill this requirement.
  • Systems storing PID should generally not be accessible from the Internet. If remote access is necessary, systems must comply with MSSND #8: Remote Access Services.

ELEC-13 Will electronic PID (e.g., hard drives in servers, laptops, workstations, or external hard drives) be securely disposed of at the end of the research project using secure wiping, hard disk degaussing, and/or physical destruction? Please describe the method(s) you will use to securely dispose of PID at the conclusion of the project.

  • Approved server environments fulfill this requirement.
  • Use the campus Secure Deletion Guideline to determine the PID disposal method that works best for your research project.

ELEC-14 Do all devices handling PID meet campus Minimum Security Standards for Networked Devices (MSSND)? Please describe any MSSND requirements not currently being met.

  • Approved server environments fulfill this requirement.
  • Campus-owned laptops and/or workstations that are managed by Berkeley Desktop fulfill this requirement.
  • Non-Berkeley researchers or researchers with personally-managed devices can follow the MSSND: How to Secure Devices guide or can consult with their local IT administrator to confirm that MSSND requirements are met.