Protection Level Classification Guide

Risk bands and their protection levels
Band	Protection levels	What happens
Low risk	P1, P2	Public or internal-use information. SocIT can review and provide low risk approval. An OIT Security Review is not required.
High risk	P3, P4	Sensitive or legally protected data. An OIT Security Review is required before use.

AcroForm field inspector

Reading ssrq-blank.pdf with pdf-lib and listing every form field, its type, and (for radios / checkboxes / dropdowns) its valid export values and widget coordinates.

Back to the form

Loading…

Step 1: Tell us what you are reviewing

Name of the supplier, data set, system, or service (required)

Examples: “Qualtrics”, “Otter.ai”, “NIH Study 1234 interview transcripts”.

Your full name (required)

Your UCInetID (required)

Department or unit (optional)

Brief description of the project and/or data (required)

Data types, data sources, sponsor or contract, approximate number of records, who will have access, and how the supplier will be used. This text is copied into the SSRQ.

Does this involve personally identifiable information (PII) about people?

Yes No

Does this involve an outside supplier, vendor, or a software / service purchase?

Yes No — internal data or systems only

An SSRQ is only generated when this is Yes.

Step 2: Classification questions

Your answers so far

No questions answered yet.

Step 3: A few more details for the security review

Your answers indicate this may be higher risk, so we need to know which specific categories of data are involved. Answer Yes, Unsure, or No for each. If you are not certain, choose Unsure and SocIT will help you confirm.

Result

Optional: click here for the exact protection level (P1–P4), definitions, and examples

Protection level reference with examples
Level	Definition	Examples
P1	Public. Already released or approved for public release.	Course catalog, published research findings, public web content, press releases.
P2	Internal use. Minor or no harm if disclosed.	Internal procedures, non-sensitive meeting notes, de-identified aggregate data, routine correspondence.
P3	Sensitive. Moderate damage, moderate fines, or moderate privacy impact.	Student records under FERPA, most identifiable human-subjects research data, personnel files, non-public financial or donor data.
P4	Highly sensitive / legally protected, or Critical IT Infrastructure.	PHI under HIPAA, SSNs, bank or payment card numbers, export-controlled or CUI research data, passport or driver license numbers, authentication and network core systems.

When in doubt between two levels, choose the higher one. A security review will determine the correct level.

Answers that produced this result

Anything else we should know? (included in the downloaded files)

Protection Level & Risk Classification Guide

AcroForm field inspector

Step 1: Tell us what you are reviewing

Step 2: Classification questions

Your answers so far

Step 3: A few more details for the security review

Result

Answers that produced this result

Download and submit to SocIT