Authorized Access to Electronic Information Policy

Purpose

The purpose of this policy is to inform an individual or proxy how to temporarily gain access to another user’s Electronic Information stored on University IT Resources, which they may not be authorized to access in their standard business operations.

Scope

This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.

Policy Statement

• Electronic Information access should only occur for legitimate University purposes.
• The Chief Information Security Officer (CISO), Chief Information Officer (CIO), or the President can authorize access to Electronic Information without approval from other entities.
• Requests for temporary access must document the requester, the legitimate University purpose, the scope of Electronic Information requested, the required duration, and any applicable approvals in the University's IT ticketing system.
• A requester must not approve their own access request. Approval and technical provisioning responsibilities must be separated where practicable.
• Authorized access must be limited to the minimum Electronic Information and duration necessary to accomplish the approved University purpose.
• Authorization decisions must consider the requester's role and the applicable security and privacy attributes associated with the Electronic Information.
• Temporary access must be removed when the approved purpose or duration ends. Continued access must be reauthorized through the applicable approval process.
• The University may access Users' Electronic Information in connection with investigations of misconduct or violation of the Acceptable Use of IT Infrastructure and Resources Policy. The University reserves the right to monitor IT Resources, but is under no obligation to do so.
• It is not standard practice for the Office of Information Technology to monitor activities on IT Resources or Standard Software unless a cybersecurity event is triggered, as outlined in the Information Security Breach Response Policy, the Wireless Use Policy, or any other activities that violate IT security or privacy policies.
• NB. The Privacy section in the Acceptable Use of IT Infrastructure and Resources Policy states the following:
  • The University may exercise these rights for various reasons, including but not limited to:
    • Ascertaining whether Users are using the systems per the IT policies and other University guidelines;
    • Preventing, investigating, or detecting unauthorized use of the University's IT Resources; and
    • Ensuring compliance with applicable laws and regulations.

• Electronic Information may be accessed to obtain Business-Critical Data when a User who typically has access to the IT Resources is unable or unavailable to provide consent due to:
  • An absence where the User is unreachable/unresponsive,
  • An illness,
  • A vacation, or
  • A separation from the University.
• Users' Electronic Information access may be necessary to preserve and provide Electronic Information in connection with legal proceedings. Any legal or litigation requests involving a User's Electronic Information must go through the Office of Legal Counsel (OLC) and the Senior Director of IT Security and Assurance for processing.
• The University may access Users' Electronic Information to address urgent situations that threaten personal safety or well-being.
• University interim posts or proxies may approve with written consent from the approvers noted in this policy.
• If the Electronic Information belongs to the Faculty, then the CISO, in conjunction with one of the following appropriate roles: the OLC, Provost, VP of Human Resources, or Associate VP of Public Safety, must approve access.
• If the Electronic Information belongs to a Student, then the CISO, in conjunction with one of the following appropriate roles: the OLC, area VP/Dean, or Associate VP of Public Safety, must approve access.
• If the Electronic Information belongs to a Staff member, then the CISO, in conjunction with one of the following appropriate roles: the OLC, area VP, VP of Human Resources, or Associate VP of Public Safety, must approve access.
• If the Electronic Information belongs to Alumni, then the CISO and the OLC, area VP, or Associate VP of Public Safety must approve access.
• If the Electronic Information belongs to a Consultant/Guest, then the CISO and the OLC, area VP/Dean, Associate VP of Public Safety, or Sponsor must approve access.
• If the Electronic Information belongs to a Corporate Account/Department, then the CISO and the OLC, the area VP/Dean, the Associate VP of Public Safety, or the Sponsor must approve access.
• A User may be given notice when their Electronic Information is accessed, except when it is not possible under instructions from the OLC.
• Records must be kept in the University's IT ticketing system to enable an appropriate review of compliance with this policy. Detailed instructions are in the Authorized Access to Electronic Information Procedure.
• Information Security and Assurance monthly reports the number of requests fulfilled by class (e.g., employee, staff, student) to the Information Risk Management Board (IRMB). A department head should contact their IRMB representative for additional information.

Definitions

Business-Critical Data is data that is essential for the continued operation of the University. Each department should identify its business-critical data (e.g., student grades, contracts).

Electronic Information refers to documents and communications, including email, voice mail, and text messages, and their associated metadata, located in files and accounts associated with a particular User. Electronic Information includes information stored on licensed cloud servers, such as Blackboard^®, Google Drive™, and Panopto™.

IT Resources include computing, networking, communications, applications, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and related materials and services.

NIST SP 800-53 Rev. 5 Alignment

Access Control: AC-2 Account Management; AC-5 Separation of Duties; AC-6 Least Privilege; AC-16 Security and Privacy Attributes.

Related Policies and Procedures

• Acceptable Use of IT Infrastructure and Resources Policy
• Authorized Access to Electronic Information Procedure
• Provisioning and Deprovisioning Policy

Implementation Information

Revision History

Policy Disclaimer Statement

Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.