{"resourceId":"asu-engineering-ai-data-classification-approved-tool-checklist-20261104","versions":[{"version":"external-082f808ac0df64c204bc0d22361cae79195a40bfdd5b76ab33450a20886639cc","resource":{"id":"asu-engineering-ai-data-classification-approved-tool-checklist-20261104","title":"ASU Engineering issues a five-step data check for staff and faculty before using university data in AI tools","organization":"Arizona State University, Ira A. Fulton Schools of Engineering (In the Loop)","sector":"Higher education IT governance and data security","geography":"Arizona, United States","publishedAt":"4 November 2026 (In the Loop, ASU Engineering)","publicationDate":"2026-11-04","eventDate":"2026-11-04","sourceName":"In the Loop (ASU Engineering internal news)","sourceLabel":"Institutional staff guidance","sourceUrl":"https://intheloop.engineering.asu.edu/2026/11/04/safe-ai-usage-five-things-to-check-before-you-prompt/","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["data-security","governance-procurement","knowledge-work"],"finding":"ASU Engineering's 4 November staff and faculty guidance says to classify data with the ASU Data Classification Tool first, use only tools listed at ai.asu.edu that have cleared vendor risk review for general business and FERPA-regulated data, sign in with ASURITE because approval follows the access path (ChatGPT Edu approved, public version not), note that FERPA approval does not cover all regulated data, and follow the Digital Trust Guidelines.","sledRelevance":"Shows a large public university running operations AI on data classification, a vetted tool list and SSO-based approval.","evidence":"Primary institutional guidance; describes controls, not measured compliance or incidents.","architectureImplications":"Approval is tied to the identity path (SSO tenant), so consumer and enterprise versions of the same model are treated differently.","governanceImplications":"Vendor risk review feeds a published approved-tool list; regulated data needs approval for each use.","securityPrivacyImplications":"Data classification determines protection, so FERPA approval does not cover HIPAA or other regulated data.","caveats":"Guidance only; no adoption, compliance or incident data; school-level post restating university rules.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: ASU sets the rule that approval follows the sign-in path, not the brand name, which shows campuses separating enterprise from consumer AI by identity. Interpretation: offices with mixed consumer and enterprise use may need help mapping data classes to approved tools and sign-in routes. The source shows no measured compliance or incident reduction. Treat it as an example of good control design, not proof that the controls work.","engineering":"Engineering framing: the control stack is data classification, a list of tools that passed vendor risk review, and SSO tenant sign-in. Interpretation: technical enforcement could include conditional access that blocks consumer AI domains for managed identities and DLP tied to classification labels. ASU also notes that FERPA approval does not cover all regulated data, so permissions must be set per data class. The source does not describe how connectors or agents are governed.","delivery":"Delivery framing: the rule only works if staff classify data before they prompt. Interpretation: delivery should embed the classification tool in AI onboarding, publish a matrix of data classes against approved tools, and run a regular review of the approved list. Ownership sits with central IT security and privacy, with schools reinforcing the message. Success measures such as attestation rates or DLP alerts would have to be added, because the source reports none."},"roleDetails":{"sales":{"customerProblem":"Staff use the same AI brands through consumer and enterprise accounts with different data permissions.","stakeholders":["CISO","Privacy officer","CIO","School IT leads"],"discoveryQuestions":["Is there a published approved-tool list tied to data classes?","Can consumer AI sign-ins be distinguished from enterprise?","How is regulated non-FERPA data handled?"],"valueHypothesis":"A clear data-class-to-tool map may reduce accidental exposure; ASU reports no measured effect.","potentialEngagement":"A bounded data-class and approved-AI-tool mapping and enforcement review.","unsupportedClaims":["Reduced incidents","Staff compliance rates","Equivalence of FERPA and HIPAA approval"]},"engineering":{"fit":"Institutions with enterprise AI licences alongside consumer use.","architectureIntegration":"Classification tool plus approved-tool catalogue plus SSO tenant sign-in.","prerequisites":["Data classification scheme","Vendor risk review process","Enterprise SSO for AI tools"],"constraints":["FERPA approval does not cover all regulated data","Consumer accounts outside institutional control"],"security":"Enforce tenant sign-in and DLP by label; review connected apps and agents.","proofOfValue":["Measure share of AI traffic via approved tenants","Test DLP blocks for regulated data classes"]},"delivery":{"work":"Operationalize the five-step check across onboarding and tool requests.","dependencies":["Central IT security","Privacy office","School communications"],"ownership":"ASU central IT and information security, with schools reinforcing.","skillsAdoption":"Short training on classification before AI use.","governanceCheckpoints":["Vendor risk review before listing","Per-use approval for regulated data"],"acceptanceCriteria":["Proposed: published data-class-to-tool matrix","Proposed: quarterly approved-list review","Proposed: tracked staff attestation rate"],"risks":["Staff skip classification","Shadow AI via personal accounts","Connected apps exceed tool approval"]}},"retrievedAt":"2026-11-04T21:51:51-06:00","enrichedAt":"2026-11-04T22:05:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Puts the classification step on each employee; training and checking that people follow it are not described.","procurementImplications":"Tools reach the approved list only after vendor risk review, which links procurement to permitted data use.","operatingModelImplications":"Central approved-tools catalogue with local reminders through school communications.","sourceVerification":{"openedUrl":"https://intheloop.engineering.asu.edu/2026/11/04/safe-ai-usage-five-things-to-check-before-you-prompt/","referenceExcerpt":"Approval follows the access path, not the brand name. ChatGPT Edu is approved for ASU data; the public version is not.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}