New to Stanford?

If you're new to Stanford, welcome!

Below is an outline of the security measures for all School of Medicine community members to meet Stanford's minimum security requirements for handling University data. You'll need to bring your laptops, desktops, and mobile devices into compliance with security policy.

1. Minimum Security Standards and Risk Classifications

2. Data & Device Attestation

Everyone at the School of Medicine will be asked to complete a Data & Device Attestation to identify whether or not you are exposed to High Risk data. If it is likely that you could access or receive High Risk data, you will also need to indicate the type and number of individual devices you will use to. Please only report the Stanford- and personally-owned devices that you use for Stanford business. You do not need to report devices owned by SHC or LPCH.

Go to Data & Device Attestation Survey »

3. Mobile Device Management

4. Computer Encryption

All computers and laptops used for Stanford business or on the Stanford network, must be encrypted using Stanford's sanctioned whole disk encryption solutions. This includes all computers used to access the hospitals' EPIC systems*. The encryption requirement also applies to all Stanford-owned computers, and also to any personally-owned devices used on the Stanford network (on campus) or any device you use to access Stanford information from anywhere, even if it's just via email.

_{* Computers owned by SHC or SCH will need to meet the hospitals' security requirements and not included in University systems.}

Go to Encryption at Stanford »

5. Computer Security Management Tool (BigFix)

BigFix, Stanford's computer and security management tool, must be installed on all Stanford- and personally-owned laptops and desktops (and VMs) that may be used by individuals who have access to High Risk data. Any device you use to access the hospitals' EPIC systems are subject to the University Data Security policy and must be fully compliant with all University security requirements. BigFix, however, should not be installed on computers owned by SHC or LPCH.

BigFix is automatically included when using the University's encryption tool SWDE (pronounced "suede").

Individuals who will never access High Risk data are not required to use BigFix, but are still required to be verifiably encrypted — the University tool VLRE (pronounced "velour") can provide acceptable encryption verification without using BigFix. However, the VLRE tool will require users to independently keep up software updates and patches, as opposed to the automatic updating provided by the centrally-managed BigFix.

Go to BigFix Installation guide »

6. Check Your Compliance (AMIE or My Devices)

After you've completed the necessary security steps, you can keep track of your compliance status online. The system that manages your compliance will depend on your Attestation (see #2 above). If any of your devices is reported to be out of compliance, these systems will suggest the necessary steps to take next.

If you attest Yes, you will be managed by the AMIE reporting system

If you attest No, you will be managed by the University's My Devices reporting system.

Need More Help?

If you have questions or need assistance, call 650-725-8000 (M-F 7a-6p) or

Submit a Help Desk Request

Find a doctor

Clinics & Services

Research Resources

Professional Training

Education Resources

New to Stanford?

All mobile devices used for Stanford work or on the Stanford network must be enrolled in Stanford's Mobile Device Management service.

Need More Help?