Number 550
Subject: Appropriate Use of Computing, Networking and Information Resources
Effective Date: February, 1 ,2008
This policy is intended to be consistent with Utah State University’s established culture of academic freedom, intellectual curiosity, openness, and integrity by defining the requirements and limits of appropriate use of information technology resources and services including computers, digital networks, and information resources at Utah State University. These rules are in place to protect faculty, staff, students and the University. Inappropriate use exposes Utah State University to risks including compromise of network systems and services, loss of confidential data, loss of the resource for legitimate use, and legal liability.
USU Computing, Networking and Information Resources are provided as a service for use by faculty, staff, students and guests in a responsible manner that is within the capacity of the Resource and consistent with the mission of the University.
Authentication credentials (e.g. ID/password) are assigned as an access privilege for restricted Resources that may be relevant to the role of the user as faculty, staff, student or visitor. Users must maintain a strong password. Credentials must be protected from use by anyone other than the assigned individuals. Credentials may be revoked to protect the Resources.
Users of Resources must obey relevant federal, state and local laws, with special attention to intellectual property laws (copyright), communications laws (libel, harassment, obscenity, child pornography, privacy, etc) and government property laws (non-commercial use, etc.). The University will cooperate with law enforcement agencies when allegations of violation are made.
Users of Resources must protect the integrity of the Resource and the confidentiality of stored and transmitted data by following directions specific to the Resource being used and the data being accessed. Those directions will be provided by IT or other administrators of the Resource or data. This requirement guards against "social engineering" attempts by outsiders to mislead users in ways that allow the outsider to gain access to the Resource or data. (e.g. viruses, phishing, hidden malware, etc.)
User-owned equipment connected to the University network must be properly registered and managed in compliance with the separate Computer Management Policy to protect against technical vulnerabilities which will allow outsiders to gain access to the Resource or data.
University-owned equipment must comply with the separate Computer Management Policy, however users of that equipment should be alert for any indications of deficiencies in compliance that may result in compromise to the security of the Resource or data.
Users are expected to recognize that the Resources being provided are subject to compromise and other failure at any time in spite of professional efforts in compliance with industry best practices.
Users should take extra precautions to protect their own privacy, to insure the confidentiality of their own personal identifying information, and to guard against the loss or destruction of their own intellectual property as a result of any compromise or failure.
While the University respects the user's privacy, information stored on or transmitted through the Resource is subject to exposure by technical, legal and extra-legal means beyond the control of the University.
USU Information Technology is directed to interpret this policy and other relevant University policies as they apply to the changing deployment of Resources and provide Appropriate Use Procedures and Standards that specify in greater detail the required, recommended or prohibited uses of specific Resources. Those procedures and standards will clarify, but not limit or change, the scope of approved Policies; and will be approved by the IT Users Advisory Committee.
Disciplinary action or sanctions for violations of this policy will be in accordance with Section 311 of USU Policies for professional and classified employees;Section 407 of USU Policies for faculty, and Article VI of the Student Code for students.
This is temporary reference information used in development of this document. Colorado State and Cornell each have (as noted below) short AUP documents and separate guidelines that interpret the general policy statements in light of current technology and risks. I advocate and have attempted to take that approach in this draft document, while incorporating all the policy-level issues in all of the documents reviewed below. Some AUPs have non-policy info in them, and some have policy info that doesn't really apply to end users. I have tried to weed that info out, while keeping it in mind for other policy/procedure/standards/guideline consideration. Our draft policy also includes reference to some other policies that are in various draft stages now but deserve to be cross linked with the AUP.
Links to the AUPs of our Peer institutions and others:
Here's a comparison spreadsheet from those institutions
