South Plains College

Information Services (SPC-IS)

 

Acceptable Use Policy: I-B

 

PURPOSE:

The information technology resources at South Plains College (SPC) support the college's educational, instructional, research, and administrative activities. Members of the SPC community are privileged to use these resources. Users of these services and facilities might have access to valuable College resources, sensitive data, and internal and external networks. Consequently, it is important to behave responsibly, ethically, and legally.

 

In general, acceptable use means respecting other computer users' rights, the integrity of physical facilities, and all pertinent license and contractual agreements. If an individual is found to violate the Acceptable Use Policy, the College will take disciplinary action, up to and including suspension or termination of employment. Individuals are also subject to federal, state, and local laws governing interactions on SPC information technology resources.

 

This document establishes specific requirements for using all computing and network resources at South Plains College. (See Texas Administrative Code, Title 1, Part 10, Chapter 202, Subchapter C (TAC§202), Texas Higher Education Coordinating Board, and NIST 800-53 standards)

 

SCOPE:

The SPC Acceptable Use policy applies equally to all individuals utilizing SPC information technology resources (e.g., full-time and part-time employees, students, retirees, agents, consultants, contractors, volunteers, vendors, temps, guests, etc.).

 

Information technology resources include all college-owned, licensed, or managed hardware and software and the use of the college network via a physical or wireless connection, regardless of the ownership of the computer or device connected to the network.

 

RIGHTS AND RESPONSIBILITIES:

As college community members, users are provided with scholarly or work-related tools, including access to the library, specific computer systems, servers, software, databases, campus telephone and voice mail systems, electronic mail resources, and the Internet. There is a reasonable expectation of unobstructed use of these tools, certain degrees of privacy (which may vary depending on whether the user is a College employee or a registered student), and protection from abuse and intrusion by others sharing these resources.

 

In turn, users are responsible for knowing the college's regulations and policies regarding the appropriate use of its technologies and resources and exercising good judgment in using its technological and information resources. Just because an action is technically possible does not mean it is appropriate to perform it.

 

Users are representatives of the SPC community and are expected to respect the College's good name in electronic dealings with those outside the College.

 

PRIVACY:

All users of College networks and systems should remember that all usage of information technology resources can be recorded and is the property of SPC. Such information is subject to the Texas Public Information Act and the laws applicable to college records retention. Employees have no right to privacy concerning the use of college-owned resources. SPC management has the ability and right to view employees’ usage patterns and take action to ensure that College resources are devoted to authorized activities.

 

Electronic files created, sent, received, or stored on SPC information technology resources that are owned, leased, administered, or otherwise under the custody and control of SPC are not private. They may be accessed by authorized personnel following the provisions and safeguards provided in the Texas Administrative Code 1 TAC§202 (Information Security Standards).

 

ACCEPTABLE USE:

The SPC network supports research, education, and administrative activities by providing access to computing resources and collaborative work opportunities.

Primary use of the SPC network must be consistent with this purpose.

 

Access to the SPC network from any device must adhere to all the same policies that apply to use from within SPC facilities.

 

1. Users may use only SPC information technology resources for which they are authorized.
2. Users are individually responsible for the appropriate use of all resources assigned to them, including the computer, the network address or port, software, and hardware, and are accountable to the College for all such use.
3. Authorized users of South Plains College resources may not enable unauthorized users to access the network. The College is bound by its contractual and license agreements respecting specific third-party resources; users must comply with all such agreements when using SPC information technology resources.
4. Users should secure resources against unauthorized use or access, including SPC accounts, passwords, Personal Identification Numbers (PIN), Security Tokens (e.g., Smartcard), or similar information or devices used for identification and authorization purposes.
5. Users must report shareware or freeware installed on SPC-owned equipment unless it is on the approved software list on MySPC. When installed, software must be reported to the SPC-IS Service Desk via email.
6. Users must not attempt to access SPC information technology resources without appropriate authorization from the system owner or administrator.

 

 

 

 

RESTRICTIONS:

All individuals are accountable for their actions relating to SPC information technology resources.  Direct violations include the following:

 

1. Interfering or altering the integrity of SPC information technology resources by:
   1. Impersonating other individuals in communication.
   2. Attempting to capture or crack passwords or encryption.
   3. Unauthorized access, destruction, or alteration of data or programs belonging to other users.
   4. Excessive use for personal purposes, meaning use that exceeds incidental use as determined by supervisor; or,
   5. Use for illegal purposes, including but not necessarily limited to violation of federal or state criminal laws.
2. Allowing family members or other unauthorized persons to access SPC information technology resources.
3. Activities that would jeopardize the College's tax-exempt status.
4. Using SPC information technology resources for political gain.
5. Using SPC information technology resources to threaten or harass others in violation of College policies.
6. Intentionally accessing, creating, storing, or transmitting material that SPC may deem to be offensive, indecent, or obscene (other than in the course of academic research or authorized administrative duties where this aspect of the study or work has the explicit approval of the SPC official processes for dealing with academic ethical issues).
7. Not reporting any weaknesses in SPC information technology resources security or any incidents of possible misuse or violation of this agreement by contacting the Information Security Officer.
8. Attempting to access any data or programs on SPC information technology resources for which authorization has not been given.
9. Making unauthorized copies of copyrighted material.
10. Degrading the performance of SPC information technology services; depriving an authorized SPC user access to an SPC information technology resource; obtaining extra information technology resources beyond those allocated; or circumventing SPC security measures.
11. Downloading, installing, or running security programs or utilities that reveal or exploit system security weaknesses. For example, SPC users must not run password-cracking programs, packet sniffers, port scanners, or other non-approved programs on SPC information technology services.
12. Engaging in acts against the aims and purposes of SPC as specified in its governing documents or in rules, regulations, and procedures as adopted by SPC.

 

 

Occasional and Incidental Personal Use

Occasional, incidental, and necessary personal use of IT resources is permitted, provided such use is otherwise consistent with this policy, is limited in amount and duration, and does not impede the ability of the individual or other users to fulfill the SPC’s responsibilities and duties, including but not limited to extensive bandwidth, resource, or storage utilization. Exercising good judgment regarding occasional and incidental personal use is essential.  SPC may revoke or restrict this privilege at any time.

 

Individual Accountability

Individual accountability is required when accessing all IT resources and SPC information.  All faculty, staff, and students are responsible for protecting against unauthorized activities performed under their user ID.  This includes locking your computer screen when you walk away and safeguarding your credentials (e.g., passwords, tokens, or similar technology) from unauthorized disclosure.  Credentials must be treated as confidential and not disclosed or shared.

 

Restrictions on Off-Site Transmission and Storage of Information

Users must not transmit restricted SPC, non-public, personal, private, sensitive, or confidential information to or from personal email accounts (e.g., Gmail, Hotmail, Yahoo) or use a personal email account to conduct the SPC business unless explicitly authorized. Users must not store restricted SPC, non-public, personal, private, sensitive, or confidential information on a non-SPC-issued device or with a third-party file storage service that the SPC-IS has not approved for such storage. 

Devices containing SPC information must always be attended to or physically secured and must not be checked in transportation carrier luggage systems.

 

User Responsibility for IT Equipment

Users are routinely assigned or given access to IT equipment in connection with their official duties.  This equipment belongs to SPC and must be immediately returned upon request or when an employee is separated from the organization.  Users may be financially responsible for the value of equipment assigned to their care if it is not returned to the organization.  Should IT equipment be lost, stolen, or destroyed, users must provide a written report of the incident's circumstances.  Users may be subject to disciplinary action, which may include repayment of the replacement value of the equipment. SPC cannot issue or re-issue IT devices and equipment to users who repeatedly lose or damage IT equipment.

 

Use of Social Media

The use of public social media sites to promote organizational activities requires written pre-approval from the Public Information Office (PIO). Approval is at the PIO's discretion and may be granted upon demonstration of a business need and review and approval of service agreement terms by SPC’s Counsel’s Office. Final approval by the PIO should define the scope of the approved activity, including, but not limited to, identifying approved users.

Unless expressly authorized, using SPC email addresses on public social media sites is prohibited. In instances where users access social media sites on their own time utilizing personal resources, they must remain sensitive to expectations that they will conduct themselves responsibly, professionally, and securely regarding references to SPC and staff. These expectations are outlined below.

1. Use of Social Media within the Scope of Official Duties

The PIO, or designee, must review and approve the content of any posting of public information, such as blog comments, tweets, video files, or streams, to social media sites on behalf of the organization. However, PIO approval is not required for postings to public forums for technical support if participation in such forums is within the scope of the user’s official duties, has been previously approved by his or her supervisor, and does not include the posting of any sensitive information, including specifics of the IT infrastructure. In addition, PIO approval is not required for postings to private, SPC-approved social media collaboration sites (e.g., Yammer).  Blanket approvals may be granted as appropriate.

Accounts used to manage the SPC social media presence are privileged and must be treated as such. They are for official use only and must not be used for personal use. Passwords for privileged accounts must follow information security standards, be unique on each site, and not be the same as passwords used to access other IT resources.

1. Guidelines for Personal Use of Social Media

Staff should be sensitive to the fact that information posted on social media sites clearly reflects on the individual and may also reflect on the individual’s professional life. Consequently, faculty and staff should use discretion when posting information on these sites and be conscious of the potential perceptions of and responses to the information. It is important to remember that once information is posted on a social media site, it can be captured and used in ways not originally intended. It is nearly impossible to retract, as it often lives on in copies, archives, backups, and memory cache.

Users should respect the privacy of the SPC staff, faculty, and students and not post any identifying information without permission (including, but not limited to, names, addresses, photos, videos, email addresses, and phone numbers). Users may be held liable for comments posted on social media sites. The Federal Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) applies to student information disclosure, including on social media.

A disclaimer is strongly recommended if a personal email, posting, or other electronic message could be construed as an official communication. A disclaimer might be: “The views and opinions expressed are those of the author and do not necessarily reflect those of South Plains College.”

Users should not use their personal social media accounts for official business unless authorized explicitly by the SPC PIO. Users are strongly discouraged from using the same passwords for social media sites as those used on SPC devices and IT resources to prevent unauthorized access to resources if the password is compromised.

 

 

 

 

 

Compliance

This policy shall take effect upon publication. Compliance with all enterprise policies and standards is expected, and policies and standards may be amended at any time.

If compliance with this standard is not feasible or technically possible, or if a deviation from this policy is necessary to support a business function, entities shall request an exception through the Information Security Officer’s exception process.

 

Related Documents:

1 TAC § 202.75

 

Internal Revenue Service Publication 1075: Tax Information Security Guidelines for Federal, State and Local Agencies

An index of approved SPC-IS policies can be found on the SPC Policies website at http://www.southplainscollege.edu/human_resources/policy_procedure/?%20.  The SPC Information Security Program and SPC Information Security User Guide are also available on the Information Technology Services Policies website.

 

Texas Security Controls Standards Catalog Control Group: PL4, PM3, PM10, PS6

 

NIST Function Groups: ID.AM-1, ID.AM-2. ID.