The university shall follow the NSHE Information Security Plan which applies to any record containing nonpublic financial information about a student, employee, or other third party who has a relationship with the university, whether in paper, electronic or other form, which is handled or maintained by or on behalf of the university.