Info orm matio on Tecchno olog gy Acccepttablee Usse Po olicyy Februaary 20118
Policy Name: INFORMATION TECHNOLOGY ACCEPTABLE USE POLICY Policy Number: 9.57 Policy Owner: Vice President, Academic
Policy Lead: Director, Information Technology
Policy Approval Authority and Date:
Leadership Committee: June 8, 2017
A. Policy Statement The purpose of this policy is to outline the acceptable use of computer resources at Lakeland College and to ensure Lakeland College diligently protects all information. This policy is in place to protect all members of our community and Lakeland College. Inappropriate use exposes Lakeland College to risks including virus attacks, compromise of computer systems and/or theft of sensitive data.
B. Scope The Acceptable Use Policy applies to the use of information, college electronic assets and network resources to conduct Lakeland College business. All users are responsible to exercise good judgment regarding appropriate use and must act in accordance with Lakeland College policies and procedures.
C. Definitions College Community Users – Refers to staff, faculty, students, board members, contractors and guests. Information Technology Resources - Refers to all hardware, software and infrastructure owned by the college. Encryption – The process of encoding a message or information in such a way that only authorized parties can access it.
D. Policy Details 1.
General Use and Ownership 1.1 All users must use their authorized account information (username/password) to access the Lakeland College network (wired/wireless). The user is responsible for the security of the account and the actions performed under the account. Wireless access for students and guests are restricted to ‘Internet only’ connectivity. 1.2 All data stored on Lakeland College systems is the property of Lakeland College. Users should be aware that the college cannot guarantee the confidentiality of
ACCEPTABLE USE POLICY
Page 1 of 6
information stored on any Lakeland College system except where required to do so by local laws or regulatory requirements. 1.3 Lakeland College systems exist to support and enable the business. A small amount of personal use (i.e. use not related to the mission of the college) is permitted provided it complies with this policy. However, it must not be detrimental to their own or any colleague’s productivity. 1.4 Lakeland College trusts its users to be fair and sensible when judging what constitutes an acceptable level of personal use of the college’s information technology systems. If users are uncertain about what is allowed they should consult their manager or the Information Technology Help Desk. 1.5 Lakeland College monitors the use of its information technology systems and the data. This may include (except where precluded by local privacy laws) examination of the content stored within the email, data files and access history of any user. 1.6 Lakeland College reserves the right to regularly audit networks and systems to ensure compliance with this policy. It is possible that security can be breached through actions or causes beyond Information Technology’s reasonable control. It is recommended that users do not store any personal information on Lakeland College electronic assets. 1.7 Users are responsible to promptly report the theft, loss or unauthorized disclosure of Lakeland College proprietary information. 1.8 Users may access, use or share Lakeland College proprietary information only to the extent it is authorized and necessary to fulfill their assigned job duties. 1.9 Postings by employees from a Lakeland College email address to newsgroups or social media feeds should contain a disclaimer stating that the opinions expressed are strictly their own and not necessarily those of Lakeland College, unless posting is in the course of business duties. 1.10 E-mail attachments or hyperlinks received from unknown senders can contain malware and should not be opened. 2.
Screen Saver and Printing Practice In order to reduce the risk of unauthorized access or loss of information, Lakeland College suggests the following: 2.1 Care must be taken to not leave confidential material unattended on printers, desks or photocopiers. 2.2 Computers must be logged off/locked or protected with a screen locking mechanism controlled by a password when unattended. Failure to take this reasonable precaution can result in user’s access being used inappropriately by others. If the computer was not locked then all activity under a user’s login will be deemed to be the responsibility of that user. 2.3 All business-related printed matter must be disposed of using recycling bins or shredders.
3.
Working Off-Site When laptops and mobile devices are taken off-site the following controls must be applied: 3.1 Equipment and media must not be left unattended in public places or in view in a vehicle. 3.2 Laptops must be carried as hand luggage when travelling where permitted.
ACCEPTABLE USE POLICY
Page 2 of 6
3.3 Information should be protected against loss or compromise when working remotely (for example at home or in public places). Laptop encryption should be used when available. 3.4 Particular care should be taken with the use of mobile devices such as laptops, mobile phones, smartphones and tablets. They must be protected at least by a password or a PIN and, when available, encryption. 4.
Software Employees must use only software that is authorized by Lakeland College on Lakeland College’s computers. Authorized software should be used in accordance with the software supplier's licensing agreements. All software on Lakeland College computers must be approved by the Lakeland College Information Technology department.
5.
Portable Storage Devices Mobile devices such as memory sticks, CDs, DVDs and removable hard drives must be used only in situations when network connectivity is unavailable or there is no other secure method of transferring data. When transferring sensitive or confidential data only Lakeland College authorized portable storage devices with encryption enabled should be used.
6.
Social Media Lakeland College recognizes that social media is a very effective form of communication and encourages employees to have an online presence. To help employees avoid any problems when communicating about Lakeland College through social media channels, the following guidelines have been developed: 6.1 In the bio section of a social media channel, employees should include a disclaimer indicating that the opinions they express are their own. 6.2 Employees, contractors, and all other workers of Lakeland College are prohibited from revealing any Lakeland College confidential or proprietary information when engaging in social media activity. 6.3 Employees shall not engage in any social media activity that may harm or tarnish the image, reputation and/or goodwill of Lakeland College and/or any of its employees. Employees are also prohibited from making any discriminatory, disparaging, defamatory or harassing comments on social media. 6.4 Employees may also not attribute personal statements, opinions or beliefs on Lakeland College when engaged in social media activity. If an employee is expressing his or her beliefs and/or opinions in social media, the employee may not, expressly or implicitly, represent themselves as an employee or representative of Lakeland College. 6.5 Employee statements in social media forums should not be deemed to be private by employees. Breaching this policy by making unacceptable statements on social media can result in disciplinary action being taken. 6.6 Apart from following all laws pertaining to the handling and disclosure of copyrighted materials, Lakeland College’s trademarks, logos and any other Lakeland College intellectual property may also not be used in connection with any social media activity.
7.
Actions Upon Termination of Employment or Contract All Lakeland College equipment and data, for example laptops and mobile devices including telephones, smartphones, USB memory devices and CDs/DVDs, must be returned to Lakeland College upon termination of employment or contract.
ACCEPTABLE USE POLICY
Page 3 of 6
All Lakeland College data or intellectual property developed or gained during the period of employment that is not protected by terms in a Collective Agreement remains the property of Lakeland College and must not be retained beyond termination or reused for any other purpose.
8. Unacceptable Use
All users should use their own judgment regarding what is unacceptable use of Lakeland College’s systems. The activities below are provided as examples of unacceptable use, however it is not exhaustive.
8.1 Computer Access Control – Individual’s Responsibility Users must not: 8.1.1. Allow anyone else to use their user ID/token and password on any Lakeland College Information Technology system. 8.1.1 Leave their user accounts logged in when the device is unattended. 8.1.2 Use someone else’s user ID and password to access Lakeland College Information Technology systems. 8.1.3 Leave their password unprotected (for example writing it down). 8.1.4 Perform any unauthorized changes to Lakeland College’s Information Technology systems or information. 8.1.5 Attempt to access data that they are not authorized to use or access. 8.1.6 Connect any devices not authorized by Lakeland College to the Lakeland College production network. 8.1.7 Store Lakeland College data on any devices not authorized by Lakeland College. 8.1.8 Give or transfer Lakeland College data or software to any person or organization outside Lakeland College without the authority of Lakeland College. 8.2 Internet and Email Condition of Use Users must not: 8.2.1 Use the Internet or email for the purposes of harassment or abuse. 8.2.2 Use profanity, obscenities, or derogatory remarks in communications. 8.2.3 Access, download, send or receive any data (including images), which Lakeland College considers offensive in any way, including sexually explicit, discriminatory, defamatory or libelous material. 8.2.4 Use the Internet or email to make personal gains or conduct a personal business. 8.2.5 Use the Internet or email to gamble. 8.2.6 Use the email systems in a way that could affect its reliability or effectiveness, for example distributing chain letters or spam. 8.2.7 Place any information on the Internet that relates to Lakeland College, alter any information about it, or express any opinion about Lakeland College, unless they are specifically authorized to do this. 8.2.8 Send unprotected sensitive or confidential information externally. 8.2.9 Forward Lakeland College email to personal (non-Lakeland College) email accounts (for example a personal Hotmail account). 8.2.10 Make official commitments through the Internet or email on behalf of Lakeland College unless authorized to do so. ACCEPTABLE USE POLICY
Page 4 of 6
8.2.11 Download copyrighted material such as music media files, film and video files without appropriate approval. 8.2.12 In any way infringe any copyright, database rights, trademarks or other intellectual property. 8.2.13 Download any unlicensed or unauthorized software from the Internet without prior approval of the Information Technology department. 8.2.14 Send communication or emails that may violate Canada’s Anti-Spam Legislation. 8.3 Telephony (Voice) Equipment Conditions of Use Users must not: 8.3.1 Use Lakeland College’s voice equipment for conducting private business within the limits of their personal authorization use. 8.3.2 Make hoax or threatening calls to internal or external destinations. 8.3.3 Accept reverse charge calls from domestic or International operators, unless it is for business use.
9. Compliance and Further Information 9.1 Lakeland College will verify compliance to this policy through various methods, including but not limited to security and networking monitoring and reporting, internal and external audits. Any exception to this policy must be approved in writing by your manager in advance. 9.2 Non-compliance with this policy constitutes misconduct and may be subject to disciplinary action being taken under the applicable Collective Agreements, Lakeland policies, or the law. 9.3 For further information, the Information Technology’s Help Desk staff are available to assist, advise, and consult with users on the proper use of Lakeland College computer resources and the interpretation of this procedure.
E. Related Policies and Procedures This policy replaces the following procedures: • 9.55 Acceptable Use of Campus Wireless Networks (Last revised: December 10, 2009) • 9.57 Computer Facilities and Information Resources Client Code of Ethics (Last revised: October 1,2013) Information Technology’s related policies and procedures: • 9.50 Security Policy • 9.58 Password Guidelines • 9.60 Physical Access to Server Rooms • 9.61 Network Access Management Lakeland’s related policies and procedures: • 2.04-1 Code of Conduct • Student policies and procedures • Access to Information and Freedom of Privacy ACCEPTABLE USE POLICY
Page 5 of 6
F. Relevant Legislation Lakeland College is required to abide by all relevant legislation. The requirement to comply with legislation shall be devolved to staff, students, contractors and third party vendors of Lakeland College, who may be held personally accountable for any breaches of information security for which they may be held responsible. Lakeland College shall comply with the following legislation and other legislation as appropriate: • Post-Secondary Learning Act • Protecting Canadians from Online Crime Act • PCI (Payment Card Industry) Security Standards • Canadian Copyright Act • Canada Anti-Spam Law • Freedom of Information and Protection of Privacy Act
ACCEPTABLE USE POLICY
Page 6 of 6