• Section 1 - Purpose
• Section 2 - Scope
• Section 3 - Principles
• Part A - IT Security and Acceptable Use
• Acceptable Use
• General IT Security
• User Account and Password
• Special Case Data Access
• Email Use
• Privately Owned Devices
• Third Party Contract and Access Security
• IT Physical Security
• Part B - Enterprise Architecture
• Scope
• Design Principles
• Records Management
• Backup Policy
• Section 4 - Responsibilities
• Section 5 - Procedure
• Section 6 - Definitions

Section 1 - Purpose

(1) The purpose of this Manual is to outline the University of Canberra’s (University) principles concerning the use of technology. The two primary areas of focus are IT Security and Acceptable Use, and Enterprise Architecture.

(2) The University’s primary functions depend on the quality of information provided by DITM resources. This Policy Manual will ensure the following:

1. availability and reliability in the provision of DITM services;
2. accuracy and integrity in the management and delivery of information;
3. protection of University’s assets, including information, knowledge, software, hardware and facilities;
4. information privacy and confidentiality is maintained according to legislative requirements;
5. University’s operations are secure from disruption;
6. DITM resources are used in an appropriate manner;
7. protection of the University’s reputation.

Section 2 - Scope

(3) This Manual covers all policies relating to Digital, Information and Technology Management and applies to all staff, students and members of the University community.  

Section 3 - Principles

Part A - IT Security and Acceptable Use

Acceptable Use

Purpose and Scope

(4) This section provides information on the access available to staff, students and other members of the University community to the University’s computer network, and through it to the Internet, and their obligations when using the University network. 

Principles

(5) The University network is provided for use for educational, research and administrative business of the University including related social interactions. Limited personal use is permitted but the University network must not be used for personal gain.

(6) Users must comply with all legislation and University policies relating to access and use of the network and other IT resources.

(7) Users must act in a courteous and responsible manner in all technology-enabled communications and must not use these in a manner which misrepresents the University or brings it into disrepute.

(8) The account owner is responsible for all information access and all changes which are carried out while accessing a system through their account/password combination.

(9) The University’s systems must not be used to harass, abuse or otherwise seek to offend individuals.

(10) The University’s systems must not be used to access, store or transfer illegal material, such as unauthorised copyright material or child pornography.

(11)  It is the responsibility of departing staff or affiliates and their Supervisors to ensure that any required electronic business files, documents and emails are appropriately stored, transferred or otherwise made accessible to the Supervisor well in advance of the departing staff or affiliates’ termination date.

General IT Security

Purpose and Scope

(12) This section covers assets including, but not limited to:

1. Information assets (e.g. databases, files, electronic documents);
2. Software assets (e.g. applications, software tools, licences); and
3. Physical assets (e.g. computers, servers, network infrastructure, information storage media, printers, communications equipment, AV equipment, projectors, telephones and facilities)

(13) Security breaches or any risk of threats arising from:

1. On-campus devices not approved for network connection;
2. On-campus networks not installed or approved by DITM; and
3. Off-campus networks and devices are within the scope of this Policy insofar as taking any necessary action required to mitigate, remove or neutralise any apparent risk or threat to IT security.

(14) All staff, students and users, including affiliates, alumni and tenants, who are given access to the University’s information systems must agree to abide by the University’s information security and privacy policies.

Principles

(15) At any point that University IT resources are being used, all relevant University policies will be applicable; whether on or off campus. The University retains the right to monitor and control DITM systems and their content, including network and system activity, in accordance with the University’s “Charter of Conduct and Values” and Privacy Policy and in a manner which respects the rights and legitimate interests of those concerned.

(16) The authority to inspect machines, servers and files resides with the Director, DITM. Disclosure to an external organisation will only be considered on production of a legal authority or to the University’s vetted and approved vendors covered by contractual obligations (eg, Oracle can do system audits under the agreement we have).

(17) Systems that are deemed to pose a threat to the University network will be disconnected from the network without notice.

(18) The University reserves the right to suspend or terminate access to a user account in cases of suspected security breaches, inappropriate or illegal activity, or unauthorised access. For the avoidance of doubt, this includes staff, student and affiliate accounts.

(19) Security incidents will be handled in accordance with DITM Cyber Security Incident Response Plan. 

(20) All major systems and information assets must be accounted for and have a nominated Custodian who is responsible for the implementation and management of this Policy in relation to those assets. Where no custodian is nominated the senior business manager of the area most responsible for the system is accountable.

(21) All DITM managed systems will be maintained to a base line of security through best practice security controls such as regular patching and centralised management. 

(22) Network services and software applications which require higher levels of security will only be accessible remotely via the University’s Virtual Private Network (VPN).

(23) Members of the University community who use public access or other non-University IT services to access University resources are obliged to respect the University’s policies as well as the relevant security policies of the remote service.

(24) To ensure that no private or confidential information is exposed, any user accessing a secure system remotely should do so only on trusted networks.

(25) University-owned data or information may not be stored using public cloud services, i.e. Dropbox or similar, except under a University-approved contractual arrangement nor can it be forwarded to separate email accounts outside the University.

(26) Any data breaches, or suspected data breaches, must be reported to the Service Desk immediately upon discovery.

(27) Access to the University’s network services by students will be granted six months prior to their course commencement date, and the network account will be removed thirty days from their discontinuation date, or graduation date. Access to the University’s network services by staff or affiliates, will be removed three days after their termination date.

User Account and Password

Purpose and Scope

(28) This section will define the principles governing the creation, use and ongoing management of user accounts and passwords for any IT system associated with the University.

Principles

(29) Users must activate a password protection method to secure their workstation or devices with University network access or content. All devices should be locked prior to leaving them unattended. Where a Multi-factor Authentication (MFA) is available in a system it must be used.

(30) All mobile devices, including phones, tablets and laptops, that are used to access or store University data or information must be password or passcode protected. This applies whether the device is a University asset or a personal device.

(31) Members of the University will be issued with a University Network Account user ID, which will be based on the University staff, student or affiliate ID number.

(32) All general access to University corporate systems should be configured to utilise the University Network Account and associated password.
Exceptions to this rule are:

1. Systems that do not store or transmit the password in encrypted format. Such systems must NOT use the University Network Account and password.
2. Systems that that are not under the control of the University and which are not operating under a contract or agreement with the University. Such systems must NOT use the University Network Account and password.
3. Systems which require an additional level of security which warrants a separate password due to elevated levels of access in accordance with the Privileged Account Guide.

(33) The onus of protecting the University Network Account password is on each individual. The University password must not be used on other systems, shared or disclosed with anyone, including assistants or family.

(34) The possession of an account and a password that enables access to read or update particular information does not constitute the authority to do so. Such authority must be explicitly granted by a System Custodian. It is the responsibility of the System Custodians to audit key corporate system privileges and ensure they are commensurate with current staff roles.

(35) Password complexity for University account passwords is determined by the strongest accepted rules of our weakest system and subject to change as systems mature or are updated. The strongest password that can be used within the restrictions of that particular facility, system or service shall be used.

(36)  It is recommended that user-level passwords be changed at least every six months. User-level passwords must be changed if the accounts with MFA do not meet the University’s complexity requirements or are known to other individuals.

(37) Passwords for privileged accounts must be changed at intervals as follows:

1. Corporate Systems Group members and System Custodians: Every 8 weeks in addition to the requirements for user-level passwords.
2. System-level passwords (e.g. root, administrator): As per user-level passwords and otherwise changed every 6 months automatically where possible. Where auto changes are not supported, system-level passwords must be changed every time a staff member with access to the password leaves the University.

(38) All passwords must:

1. Contain eight characters or more.
2. Contain lower-case letters, upper-case letters, numbers, and non-alphanumeric characters.

Special Case Data Access

Purpose and Scope

(39) This section covers the access of staff members’ files or data under special circumstances.

Principles

(40) Access to a current staff member’s electronic data, which includes email, and documents stored centrally (e.g. H: drive and Microsoft Office 365) or locally (e.g.  C: drive), is only permitted if accompanied by a business case, approved by the relevant Dean/Director and approved by the Director, DITM. A record of access including the business case and authorising Dean/Director must be created and kept.

(41) Where reasonable grounds exist to justify accessing a former staff member’s email or electronic files, access may be provided to the Supervisor or other nominated staff as approved by the Dean or Director after consideration of a business case by the Director, DITM.

Email Use

Purpose and Scope

(42) This section covers the use of email originating from University email accounts for staff or students.

Principles

(43) University staff will utilise email for University-related communication with staff, students and affiliates.

(44) Email copies of highly sensitive information must be encrypted when transferring to an external entity or recorded to an external data storage device.

(45) The content of email sent by University staff and students must not be offensive, harassing, discriminatory or illegal. In addition, University email accounts must not be used for personal gain or commercial purposes.

(46) While the University will make every endeavour to ensure that email delivered to University accounts is free from spam and malware, it takes no responsibility for any damage caused by the failure to detect spam or malware or the inadvertent blocking of a legitimate email.

(47) Students are required to use their student email when contacting the University via email for pastoral, administrative, or academic matters. 

(48) Staff are expected to use the University-provided email account for all University email correspondence and may not automatically forward their email to private addresses unless authorised by the Director, DITM.

(49) All staff members are required to include a signature on all emails sent externally, which should be aligned with the University’s standardised signature block.

Privately Owned Devices

Purpose and Scope

(50) This section defines University policy with respect to privately owned devices which are brought onto the University campus, connected to the University network and/or used for University business.

Principles

(51) Privately owned devices may be connected to the University network (wired or wireless) provided that these meet basic levels of security as determined by the University.

(52) The University reserves the right to inspect all privately owned devices which are connected to the University network to investigate suspected security breaches, inappropriate or illegal activity, or unauthorised access.

(53) Privately owned devices that are deemed to pose a threat to the University network will be disconnected from the network without notice.

(54) The University accepts no responsibility for any loss or damage to either the physical device or data contained within it as a result of bringing the device onto the University campus, connecting it to the University network and/or using it for University business.

(55) The University accepts no responsibility for the support and maintenance of privately owned devices whether or not they are used for University business. This includes privately owned data storage media connected to staff or student workstations.

(56) University-owned data or information must not be stored on privately owned equipment.

Third Party Contract and Access Security

Purpose and Scope

(57) This section sets out the conditions that are required to maintain the security of the University’s IT resources when contractors, outsourced providers, service suppliers or any other third-party providers are involved in the University’s operations. This may include, but is not limited to, the following circumstances:

1. third-party system design, development or operation of University services;
2. access granted from remote locations where computer and network facilities may not be under the control of the University; or
3. when authorised third-party providers are given access to information or information systems.

Principles

(58) All third-party providers who require access to the University’s information systems must agree to comply with all relevant University policies at the time of contract signing. Should the said policies change within the contract period, a deed of variation will be drawn up and third-party providers must agree to comply.

(59) Due to the confidentiality, sensitivity or value of the information that may be accessed, the University may require third-party providers to sign a confidentiality agreement to protect its information assets.

(60) All contracts with third-party providers for the supply of services to the University must be monitored and regularly reviewed to ensure that information security requirements are being satisfied.

(61) Authorised third-party providers must be given minimum access privileges to meet their contractual requirements. They are not permitted to copy or store any University information for any reason other than that required to complete the terms of their contract.

(62) All third-party providers must report any instance, including physical, of unauthorised access, transmission, or loss (or suspected loss) of University data by a third-party. In addition, third-party providers must report IT security incidents that may impact systems connected to the University’s systems.

IT Physical Security

Purpose and Scope

(63) This section sets out the minimum standards for implementing physical control measures to protect the University’s IT architecture. IT assets are generally associated with the physical devices on which information resides and includes, but is not limited to, workstations, servers and the physical network infrastructure.

Principles

(64) Physical access controls around computing locations are to be applied in a manner that reflects the business value and criticality of IT services hosted in the location and the value of the data stored.

(65) Computer laboratories and other locations that house DITM assets must employ physical access controls such as electronic or physical locks.

(66) No computer equipment is to be removed from any office, work area or computer laboratory unless specific authorisation has been received from DITM. 

(67) Persons who are issued with portable information technology assets, such as laptops, must agree to bear personal responsibility of the equipment. When not in use, all portable information technology assets must be adequately secured.

Part B - Enterprise Architecture

Scope

(68) This section of the Policy Manual outlines the Universities principles for the design and implementation of technology. 

Design Principles

Principles

(69) DITM offers support for re-designing of University’s systems and assesses new technologies to ensure cohesive and effective alignment of business, information, process and technology.

(70) Cloud services will be adopted first, as long as they are fit for purpose, provide better value for money, provide appropriate security and risk measures and have adequate back-out and Disaster Recovery measures.

(71) Where appropriate, the University will utilise cloud services to enable testing and development of IT systems.

(72) Out of the box solutions for both cloud and in-house systems should be adopted in favour of systems that aren’t quite fit for purpose which then require further customisation.

(73) The fundamental concepts of least privilege, default to deny and defence-in-depth must be applied to all devices connected to the University network.

(74) In support of the use of privately owned devices on campus, the University is committed to providing ubiquitous power and WiFi access campus-wide within the constraints dictated by budget and resources.

(75) Unless specifically required, all new services and applications must be designed to be accessible for users regardless of the network being used, resulting in the same experience whether on campus or off.

(76) The University will design infrastructure that is flexible and scalable, future-proofed to allow for migration to other platforms (including cloud) and capable of future orchestration. Where hardware must be purchased, it should be reusable and efficient.

(77) Modifications to any system or network are only permitted where authorised by DITM.

(78) The addition of any new technology systems must be reviewed by the University’s Legal team and by completing the New Product Questionnaire prior to procurement. Any new technology systems must also be approved by the Change Advisory Board (CAB), prior to implementation, to ensure these systems do not conflict with the University’s environment.

Records Management

Purpose and Scope

(79) The purpose of this section is to provide direction to all staff on the management of University records and applies to all records created and/or captured during the conducting of University business.

(80) The University is obliged to comply with all requirements of relevant legislation. Therefore, adherence to the requirements in this Policy and the accompanying Records and Archives Management Procedures is mandatory for all staff.

(81) All staff employed by the University in any capacity are responsible for recordkeeping.

Principles

(82) The Records Management Program is to conform to the Territory Records Act 2002, as well as the Territory Recordkeeping Standards for Records Management. In cases where recordkeeping issues arise which are not covered by this Policy, the University will follow advice from the Territory Records Office and be guided by the Australian Standard on Records Management, AS ISO 15489.

(83) Recordkeeping will be a routine part of conducting business and will be closely aligned to the University’s business processes. An analysis of these processes within the context of business needs, legal and regulatory obligations, as well as meeting broader community expectations is to be used as the basis of design for a recordkeeping system. These needs and obligations will be reviewed on an annual rolling review plan or as the result of significant change.

(84) All records created or captured by the University Community are corporate assets that are owned by the University and managed accordingly. 

(85) No records are to be destroyed without an approved Records Disposal Schedule.

(86) The University is to use a controlled language system to title its records. The business classification system (thesaurus) is to be based on the functions and activities that it carries out. This includes using the Territory Records Administrative Disposal Schedule terms for common administrative functions such as Financial Management, Personnel and Occupational Health & Safety.

(87) Everyone employed by or contracted to the University is to make and keep full and accurate records that are incorporated into the University’s recordkeeping system. That is, the University’s recordkeeping practices will ensure that its records are adequate for:

1. facilitating action by employees at any level, and their successors;
2. making possible a proper scrutiny of the conduct of business by anyone authorised to undertake such a scrutiny; and
3. protecting the financial, legal and other rights of the University, its clients and any other people affected by its actions and decisions

(88) Records management methods and recordkeeping systems are to be reviewed every 24 months to ensure their continuing suitability and effectiveness. The Director, DITM may initiate an earlier review when significant functional or other changes affecting recordkeeping occur. Records of these reviews are to be maintained by the Records Management unit.

(89) Records and Archives Management Procedures are to be designed to detail the way all staff will make, modify, use, handle and care for records, as well as how and for how long records will be kept. The procedures are also to describe how to identify, search for and retrieve records as well as gain access to them.

Backup Policy

Purpose and Scope

(90) This section mandates and communicates the University’s principles relating to the backing up and retention of corporate data assets.

(91) Any non-corporate data assets are considered out of scope of this backup policy.

Principles

(92) All corporate data is to be stored on University managed facilities, which are regularly backed up.

(93) A full backup from each year is retained for a minimum of seven years.

(94) Where a data custodian has identified or requested a different set of backup requirements, some data sets may be backed up outside of the standard practice described above.

(95) The physical and logical security of the backup media must be at least equivalent to the security required for the access to the data on the server itself, as dictated by the Records Management section of this document.

(96) The backup medium must be of a type that will remain readable and be accessible for the length of time for which the backups are to be retained.

(97) Backups of corporate data assets are distinct from the University’s records management system and are purely a disaster recovery mechanism.

Section 4 - Responsibilities

(98) Information security of each system/application will primarily be the responsibility of its custodian.

Section 5 - Procedure

(99) Nil.

Section 6 - Definitions