Body
Purpose
This standard establishes the workload classification model used to determine the governance, security, operational, resiliency, and compliance controls required for University technology solutions.
Workload classification is separate from data classification:
- Data classification identifies the sensitivity of the data.
- Workload classification identifies the operational and governance model under which a workload must operate.
A workload's classification is determined by its data classifications, regulatory and contractual obligations, risk profile, business criticality, operational requirements, and required control baseline.
Scope
This standard applies to University-managed or University-governed:
- Cloud workloads
- On-premises workloads
- Software-as-a-Service solutions
- Applications
- Databases
- Data products
- Platform services
- Infrastructure services
- Integration services
- Shared services
Workload Classifications
The University recognizes three workload classifications:
- Innovation Workloads
- Enterprise Workloads
- Regulated Workloads
Innovation Workloads
Purpose
Innovation Workloads support experimentation, evaluation, proof-of-concept development, emerging technologies, pilot programs, research activities, and exploratory work.
Innovation Workloads are intended to accelerate learning while limiting organizational risk.
Permitted Data Classifications
- Public
- Sensitive/Internal
Data Classifications Not Permitted
- Highly Sensitive
- Restricted
Control Characteristics
- Reduced governance requirements appropriate to experimentation
- Designated ownership
- Basic monitoring capabilities
- Approved hosting environments
- Limited operational commitments
- Accelerated deployment and evaluation processes
Reclassification Requirements
An Innovation Workload must be reviewed and reclassified before Highly Sensitive or Restricted data is introduced.
Reclassification may also be required when an Innovation Workload becomes a production service, supports an institutional business function, or requires a higher control baseline.
Enterprise Workloads
Purpose
Enterprise Workloads support institutional business functions, academic services, administrative services, operational capabilities, and production systems that operate under the standard enterprise control baseline.
Permitted Data Classifications
- Public
- Sensitive/Internal
- Highly Sensitive
- Authorized Restricted data
- FERPA data
Control Characteristics
- Enterprise identity and authentication
- Authorization and access management
- Monitoring and audit capabilities
- Data protection controls
- Recovery capabilities appropriate to business requirements
- Standard governance requirements
- Approved shared service integration
- Risk-based architecture review
Enterprise Workloads must comply with applicable University policies, enterprise standards, platform standards, and approved architecture patterns.
Regulated Workloads
Purpose
Regulated Workloads require enhanced governance, security, monitoring, recovery, auditability, isolation, or compliance controls due to legal, regulatory, contractual, institutional, or research obligations.
A workload is classified as Regulated based on its required control baseline, not solely on its data classification.
Examples
- HIPAA workloads
- CUI workloads
- CJIS workloads
- Export-controlled workloads
- Contractually regulated workloads
- Other workloads determined to require an enhanced control baseline
Permitted Data Classifications
- Public
- Sensitive/Internal
- Highly Sensitive
- Restricted
Enhanced Control Characteristics
- Enhanced governance controls
- Enhanced identity and access management
- Centralized monitoring and auditability
- Security event visibility
- Enhanced recovery and resiliency requirements
- Dedicated workload boundaries when required
- Formal architecture review
- Approved hosting and implementation patterns
- Approved shared service usage
- Enhanced compliance oversight
Regulated Workloads must comply with applicable University policies, enterprise standards, platform standards, regulatory standards, architecture decisions, and approved architecture patterns.
Classification Determination
Workload classification must consider:
- Data classification
- Regulatory requirements
- Contractual obligations
- Research requirements
- Business criticality
- Operational requirements
- Recovery requirements
- Security requirements
- Audit requirements
- Governance requirements
Workload classification must not be determined solely by data classification. Restricted data does not automatically require classification as a Regulated Workload.
When multiple classifications could apply, the workload must use the classification that satisfies the highest applicable control requirements.
Classification Ownership
Each workload must have documented business and technical ownership. Workload owners are responsible for identifying the data, business purpose, operational requirements, and known obligations associated with the workload.
The workload classification must be documented through the applicable governance, onboarding, or architecture review process.
Boundary Requirements
Workloads shall operate within administrative, governance, operational, and security boundaries appropriate to their classification.
- Innovation Workloads may operate within administrative, governance, operational, and security boundaries appropriate to their classification.
- Enterprise Workloads may operate within shared enterprise environments when approved governance, operational, and security requirements are satisfied.
- Regulated Workloads shall operate within approved regulated hosting architectures and approved governance boundaries.
Consumption of shared services does not eliminate workload boundary requirements.
Workload boundaries shall support ownership accountability, governance enforcement, operational management, monitoring, auditability, and applicable regulatory obligations.
Classification Review
Workload classification must be reviewed when:
- A new workload is introduced
- The workload's data classifications change
- New regulatory, contractual, institutional, or research obligations apply
- The workload becomes a production or enterprise service
- Business criticality or recovery requirements materially change
- The hosting model materially changes
- The workload requires controls outside its approved baseline
Architecture Review
Architecture review is required when:
- A workload is classified as Regulated
- A workload is reclassified to a higher control baseline
- A workload introduces data or obligations not supported by its current classification
- A workload deviates from applicable standards or approved architecture patterns
Exceptions
Exceptions to this standard require documented approval through the approved architecture exception process.
Workloads operating outside the requirements of their approved classification are considered exceptions until formally reviewed, approved, or reclassified.