Information Classification Policy

Overview and Purpose

The University of Oklahoma Foundation, Inc. (the Foundation) creates, receives, and maintains information of varying sensitivity related to its mission, which is to facilitate and manage philanthropic gifts to support the University of Oklahoma (OU.) The Foundation operates with the upmost integrity to receive, administer, invest and expend donors’ gifts solely for the benefit of OU and is the steward of all information related to its mission.

This policy requires that all Foundation information be classified according to its sensitivity and the risk associated with its disclosure, so that it receives protection, access restriction, and handling appropriate to that classification according to the standards set forth in the Information Security Policy and the retention rates set forth in the Document Retention Policy.

Scope

This policy applies to all information created, received, owned, managed, processed, transmitted, stored, or disposed of by the Foundation, regardless of format (electronic or physical), and to all individuals and entities granted access to the Foundation’s information systems or data, including employees, contractors, volunteers, and third‑party service providers.

Classification Requirement

All Foundation information must be classified.

The Foundation's official information classification categories, the types of information assigned to each, and the minimum handling expectations for each are established in the Information Classification Definitions. That document is the authoritative source for the Foundation's current classification categories.

Information that has not been explicitly classified is to be treated as Confidential until it is classified by the appropriate Data Owner.

Information must be labeled or otherwise identified with its classification where practicable, and as directed by the Foundation's supporting documents.

Information must be accessed, used, shared, stored, transmitted, and disposed of in accordance with the handling expectations for its classification.

Classification must be reviewed and adjusted when the sensitivity or regulatory treatment of the information changes.

Governance

This Information Classification Policy is issued under the authority of the Foundation's Information Security Policy. The detailed implementation of this policy is defined through formally approved supporting documents, including but not limited to:

• Information Classification Definitions
  Defines the Foundation’s official information classification categories and provides guidance and examples for classifying data based on sensitivity and risk.
• Information Security Framework
  Describes the operational and technical processes used to implement, manage, and maintain information security controls in support of this policy.
• Document Retention Policy
  Defines retention of corporate records such as Fund Documents, Financial Information and Legal Files.

Compliance with these supporting documents is mandatory for all individuals and entities within the scope of this policy whenever the documents apply to their responsibilities or activities.

Roles and Responsibilities

Senior Leadership
Provide executive sponsorship for the information classification program, approve this policy, allocate appropriate resources, and support enforcement throughout the Foundation.

All Users
Responsible for complying with this policy and associated supporting documents, for the purpose of safeguarding Foundation information to which they are granted access and for reporting any observed security weakness or incident.

Data Stewards and Data Owners
Responsible for ensuring information under their authority is classified appropriately and handled in accordance with Foundation requirements.

Data Custodians (IT Department)
Responsible for implementing and maintaining security controls, standards, and procedures that support this policy.

Compliance

Compliance with this policy and its supporting documents is mandatory. Foundation IT, in coordination with Human Resources, Legal Counsel, or executive leadership, as appropriate, will investigate suspected violations. Violations may also lead to legal consequences in the case of negligence or intentional misuse. Employees are required to report any suspected violations of this policy to their supervisor or appropriate leadership and the Foundation’s IT Department.

Amendments

This policy may be amended from time to time. Any amendments to this policy will be communicated to employees as soon as practical.

Review Change

This policy will be reviewed on as needed basis to be determined by the Senior AVP, Chief Information Officer. The Chief Operating Officer and/or the Senior AVP, Chief Information Officer should review policy changes with the President and Chief Executive Officer and if approved, present any proposed changes to the Board for subsequent approval.

Last updated: 9/18/26