2. Scope This policy addresses all web sites hosted by the central web hosting service.
|
|
|
- Letitia Turner
- 7 years ago
- Views:
Transcription
1 OIT Web Hosting Policy Rev Effective Date: Last Revised: January 3, 2011 January 3, 2011 The following are responsible for the accuracy of the information contained in this document Responsible University Officer: Chief Information Officer (CIO) Responsible Coordinating Office: Georgia Tech Office of Information Technology (OIT) 1. Executive Summary This document is in direct support of the Georgia Institute of Technology Computer and Network Usage and Security Policy (CNUSP). The Office of Information Technology (OIT) provides web- hosting service to academic and administrative units as well as recognized student organizations at Georgia Tech. This service is limited to hosting production and development web sites and does not include technical support associated with web site design, development, or testing. This policy provides the necessary guidance to users of the service on support, content management, and site management. 2. Scope This policy addresses all web sites hosted by the central web hosting service. 3. Definitions Content Management System (CMS) Domain Account Domain Administrator Domain Owner Sensitive Information User Space A web application for managing web site content by multiple authors/editors. This includes packages such as Drupal and Joomla. The actual account in the Plesk system that has the ability to modify a domain and the applications within that domain. Anyone that a domain- owner has given the credentials necessary to login to a Plesk domain- account and make changes to that domain. A domain- owner and all domain- administrator constitute the complete domain- group. The single account holder responsible for one or more Plesk domains and for adding/removing domain- administrators to a domain. This information is considered private and should be guarded from disclosure; disclosure of the information may contribute to financial fraud. Disclosure may also violate state and/or federal law. Processes on a UNIX system that are run under the id and permissions of a particular user and not as one of the various system accounts such as root or nobody. Georgia Institute of Technology Page 1
2 4. Statement of Policy The policy statements below apply to all web sites and customers that are a part of the central web hosting service. 4.1 Web Site Ownership Authorized Requestors Georgia Tech full- time employees can request web- hosting space. Domain Ownership Initial domain ownership will be limited to faculty members and full- time exempt staff. Each web site hosted by OIT must have at least two contacts associated with it, one of whom must be a regular, full- time employee of the Institute. Furthermore, individual web site owners should document processes for approving, publishing and managing content to their production environments. Finally, web site owners should notify OIT when/if contacts for the web site change. Domains may not be owned by contractors, students (e.g. GRAs), or Tech Temps. However, the owner of the domain may delegate management of the domain to anyone with a valid GTED account, including students, faculty, staff, alumni, applicants, retirees, affiliates and guests. All users with management rights using this service will abide by all Georgia Tech policies and procedures, including the Georgia Tech Computer & Network Usage and Security Policy (CNUSP), and agree to the enforcement mechanisms defined by those policies. 4.2 Web Site Content Adhering to Georgia Tech Policies The content of sites hosted on OIT's web hosting service must adhere to Georgia Tech policies. The content of sites hosted on OIT's web hosting service must abide by all necessary Georgia Tech policies, including the campus Computer and Network Usage & Security Policy (CNUSP). These policies may be found at Offensive, illegal, political and/or commercial content is prohibited. Content must abide by copyright and fair use guidelines. Sensitive information, as defined in the Georgia Tech Data Access Policy, may not be stored, accessed, or utilized on the web- hosting servers. Web sites on the hosted service may not receive, store, transmit, or process credit card information. 4.3 Application Hosting & Administration Shared Environment The web hosting service is a shared resource environment, which means that the server resources are shared by all sites. Services that are included and allowed as a part of the web hosting service include: Content Management Systems, wikis, portals, forums, scheduling tools, and surveys. While a customer s site may need to share files (e.g. video Georgia Institute of Technology Page 2
3 files) as a core part of its purpose, the service is not intended to be used as a fileserver (replacing a departmental file server, personal file server) or a file sharing service (distributing/sharing files like Dropbox). System- Level Software Restrictions Users may not install any system- level software on the web- hosting servers. Virtual Websites and Hostnames The OIT Web Hosting Service provides virtual web servers with domain names for academic, administrative, research, and official student organizations, as well as joint initiatives involving one or more departments on campus. Software that requires administrative or root access may not be installed by site owners. This restriction does not include extensions to system software that are explicitly allowed by that software and which run in user space. OIT may suggest alternatives in situations where the requested virtual host name isn't allowed under this policy or wouldn't be advisable for technical reasons. OIT recommends contacting the webhosting team about the availability of gatech.edu domain names before attempting to register for the name/service. Use of Non-.gatech.edu Domains The webhosting service does accommodate the use of.com,.net,.org, and other non-.edu domain names. Accounts & Passwords Site administrators are responsible for the security of their site administration credentials. Access to the webhosting service for the purposes of administration and management must be through a secure channel. Webhosting domain names in domains other than.gatech.edu are allowed as long as they adhere to Institute policies and guidelines. OIT strongly recommends that the customer contact OIT about hosting these domains instead of hosting them with an outside registrar. If you do host with an outside domain name registrar, you will be responsible for the support of the domain. Access to the Web Hosting control panel is via the individual s standard Georgia Tech account credentials, and must be over a secure protocol such as SSL or SSH. Due to existing limitations with the service, each hosted web site will be assigned one site- specific ID and password for administrative management and is limited to the hosting environment only. This credential can be shared among the delegated administrators of the same web site, until such a time when the underlying technology is capable of leveraging existing GT credentials. This account/credential represents critical access to a critical service (yours) and must be protected. Site administrators MUST maintain these credentials in a secure fashion and not make them available unless absolutely necessary. Secure Hosting & SSL Content that should be encrypted when presented on the web must utilize the secure virtual host option available within the Web Hosting control panel. This option utilizes a wildcard certificate which allows all sites to utilize the same certificate. OIT does not support provisioning of alternate certificates or certificate authorities at this time. Please contact the webhosting team at XXX for help with alternatives if needed. Georgia Institute of Technology Page 3
4 4.4 Accessibility Guidelines Accessibility to Web Content Web content must adhere to Federal (Section 508) accessibility guidelines. The coding of the content should also comply with current Internet standards. Organizations such as W3C and Bobby Online Free Portal offer tools to test accessibility and standards compliance. Information and guidelines pertaining to accessibility can be found at: Information pertaining to Georgia Tech's web guidelines can be found at: Monitoring & Security Measures Security Vulnerabilities The hosted environment will be subject to periodic vulnerability scans for protection against known or potential information security threats, and site administrators will be notified if any changes or updates are required. OIT reserves the right to access system logs, account directories, site content, and other records to investigate and/or resolve system problems. Patching Domain owners are expected to install or upgrade applications within their domain in an acceptable and timely fashion. Resolving Incidents If a site is found to be causing problems for other users, presenting a security threat, or enabling illegal activity, the site administrators will be notified and expected to take corrective action immediately. Failure to apply security patches in a timely manner could result in service being temporarily disabled should it present risks to other users or the Institute s integrity. If any such urgent issues with a hosted web domain (as described above) cannot be resolved in a timely manner, OIT may take one or more of the following actions, in consultation with the domain owner, unit leadership, and campus leadership (as appropriate), depending on the nature and severity of the problem, as well as the time estimated for the site administrators to correct it: Restrict the public's access to the web site Disable dangerous files by altering permissions, moving, or renaming them Terminate processes Disable the web site Remove the site administrator s access to the site (e.g. when compromise is suspected) In cases where the compromise could impact the reputation of Georgia Tech, the incident will be remanded to the GT Incident Response team. Georgia Institute of Technology Page 4
5 5. Responsibilities & Support 5.1 Responsibilities & Support OIT- Provided Support OIT is responsible for providing support of the web hosting service servers and related applications. OIT does not offer design, development, or testing services associated with web hosting. Please refer to Communications & Marketing's Communications Toolbox at for website templates and production resources, design and style guides, and information pertaining to accessibility and coding standards. Centralized support for a particular Content Management System (CMS) in the form of themes, plugins, and image repository is also not currently offered. Most CMS packages will be available, but only one package per class of application is supported. Application Availability OIT will provide one package per class of application. The current list of provided packages includes: Class Package CMS Drupal Blog Wordpress Forums phpbb Image Gallery Gallery Wiki Mediawiki Domain Owner Best- Practices Departments are encouraged to develop and test in a local environment before securely transferring content to the web server. Web Site Scripts If domain owners choose to run scripts on OIT's web hosting server, they are responsible for making sure those scripts do not represent a security risk. Backups It is strongly recommended that each domain owner maintain a current copy of all content for backup purposes. In addition, domain owners may request a separate OIT hosted development environment. OIT hosted development sites shall be accessible via HTTP only from the GT campus network. This requires domain owners to: Know what the scripts do and how they work Keep them up to date with patches, etc. Watch for vulnerabilities in the scripts to be announced (by keeping an eye on and similar sites) Watch your site's log files for unusual activity Although OIT does create periodic system backups, OIT is not responsible for site content other than recovery resulting from catastrophic loss of the system. Backups are available via the self- service restore process for up to four (4) weeks. Recovery is the responsibility of the domain- owner through the built- in backup management systems. Georgia Institute of Technology Page 5
6 6. Compliance Any person (or unit) who uses the Web Hosting Service consents to all of the provisions of this policy and agrees to comply with all of its terms and conditions, and with all applicable state and federal laws and regulations. Users have a responsibility to use these resources in an efficient, effective, ethical, and lawful manner. Violations of the policy may result in loss of usage privileges, administrative sanctions (including termination or expulsion) as outlined in applicable Georgia Tech disciplinary procedures, as well as personal civil and/or criminal liability. 7. Policy Modifications This policy may be changed by directive from the responsible university officer. The Computer & Network Security Procedures may be changed by directive from the Georgia Tech Associate Vice President and Associate Vice- Provost for Information Technology. Any changes to the policy or procedures must be promptly communicated to the individuals and offices noted in Section Communication Upon approval, this policy shall be published on the Georgia Tech website. The following offices and individuals shall be notified via and/or in writing upon approval of the policy and upon any subsequent revisions or amendments made to the original document: Web Hosting Customers OIT Georgia Tech IT Directors Georgia Tech CSR Mail List Internal Audit Office of Legal Affairs Communications & Marketing 9. References Resource Georgia Tech IT Policy Website Georgia Tech Data Access Policy Georgia Tech Computer & Network Security Procedures Georgia Tech Copyright Infringement Complaint Response Procedures Link AP.pdf _Procedures.pdf infringement- complaint- response- procedures 10. Revision History Revision Number Author Description 2.0 Richard Biever Updated to Standard Format Georgia Institute of Technology Page 6
7 Georgia Institute of Technology Page 7
Information Security Policy
Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems
NORTH CAROLINA AGRICULTURAL AND TECHNICAL STATE UNIVERSITY
Student Email Use page 1 NORTH CAROLINA AGRICULTURAL AND TECHNICAL STATE UNIVERSITY SEC. VII E-MAIL 3.0 STUDENT EMAIL USE University Policy I. Scope The purpose of this policy is to ensure the proper use
Network Security Policy
Network Security Policy I. PURPOSE Attacks and security incidents constitute a risk to the University's academic mission. The loss or corruption of data or unauthorized disclosure of information on campus
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
Indiana University of Pennsylvania Information Assurance Guidelines. Approved by the Technology Utilities Council 27-SEP-2002
Indiana University of Pennsylvania Information Assurance Guidelines Approved by the Technology Utilities Council 27-SEP-2002 1 Purpose... 2 1.1 Introduction... 2 1.1.1 General Information...2 1.1.2 Objectives...
Information Technology Acceptable Use Policy
Information Technology Acceptable Use Policy Overview The information technology resources of Providence College are owned and maintained by Providence College. Use of this technology is a privilege, not
R345, Information Technology Resource Security 1
R345, Information Technology Resource Security 1 R345-1. Purpose: To provide policy to secure the private sensitive information of faculty, staff, patients, students, and others affiliated with USHE institutions,
BOBCAT COMPUTING POLICY
BOBCAT COMPUTING POLICY The overarching policy governing computing and networking at Jones is the Policy on Acceptable Use of Electronic Resources. The policy is reprinted in its entirety below. Faculty,
COMPUTER AND NETWORK USAGE POLICY
COMPUTER AND NETWORK USAGE POLICY Respect for intellectual labor and creativity is vital to academic discourse and enterprise. This principle applies to works of all authors and publishers in all media.
RESPONSIBLE COMPUTER USE POLICY (ADOPTED AUGUST 3, 2006)
RESPONSIBLE COMPUTER USE POLICY (ADOPTED AUGUST 3, 2006) on-line at www.ccc.edu I. INTRODUCTION All users shall abide by the following provisions contained herein, or otherwise may be subject to disciplinary
Responsible Administrative Unit: Computing, Communications & Information Technologies. Information Technology Appropriate Use Policy
1.0 BACKGROUND AND PURPOSE Information Technology ( IT ) includes a vast and growing array of computing, electronic and voice communications facilities and services. At the Colorado School of Mines ( Mines
Policy for the Acceptable Use of Information Technology Resources
Policy for the Acceptable Use of Information Technology Resources Purpose... 1 Scope... 1 Definitions... 1 Compliance... 2 Limitations... 2 User Accounts... 3 Ownership... 3 Privacy... 3 Data Security...
Information Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
Acceptable Use of Computing and Information Technology Resources
Acceptable Use of Computing and Information Technology Resources Version 1.0, February2, 2010 General Statement As part of its educational mission, Hocking College acquires, develops, and maintains computers,
Bates Technical College. Information Technology Acceptable Use Policy
Bates Technical College Information Technology Acceptable Use Policy Consistent with policy adopted by the Board of Trustees, Bates Technical College, hereinafter referred to as the College, has a commitment
2.5.1 Policy on Responsible Use of University Computing Resources Introduction This policy governs the proper use and management of all University of
2.5.1 Policy on Responsible Use of University Computing Resources Introduction This policy governs the proper use and management of all University of San Diego computing and network resources. This policy
Georgia Tech Active Directory Policy
Georgia Tech Active Directory Policy Policy No: None Rev 1.1 Last Revised: April 18, 2005 Effective Date: 02/27/2004 Last Review Date: April 2005 Next Review Date: April 2006 Status Draft Under Review
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
TYPE: INFORMATIONAL & INSTRUCTIONAL TECHNOLOGY. POLICY TITLE: Technology Use Policy
TYPE: INFORMATIONAL & INSTRUCTIONAL TECHNOLOGY POLICY TITLE: Technology Use Policy The technology resources at Northeast Wisconsin Technical College support the instructional, research and administrative
The following are responsible for the accuracy of the information contained in this document:
AskUGA 1 of 5 Credit/Debit Cards Responsible administrator: Senior Vice President for Finance and Administration Related Procedure: The Credit/Debit Card Processing Procedures Responsible department: Bursar's
Payment Card Industry Data Security Standard
Payment Card Industry Data Security Standard Introduction Purpose Audience Implications Sensitive Digital Data Management In an effort to protect credit card information from unauthorized access, disclosure
UNIVERSITY GUIDEBOOK. Title of Policy: Acceptable Use of University Technology Resources
PAGE 1 of 6 UNIVERSITY GUIDEBOOK Title of Policy: Acceptable Use of University Technology Resources Responsible Division/Office: Information Technology Approving Officer: Vice President for Finance and
COMPUTER USE POLICY. 1.0 Purpose and Summary
COMPUTER USE POLICY 1.0 Purpose and Summary 1. This document provides guidelines for appropriate use of the wide variety of computing and network resources at Methodist University. It is not an all-inclusive
Computer Use Policy Approved by the Ohio Wesleyan University Faculty: March 24, 2014
I. Introduction Computer Use Policy Approved by the Ohio Wesleyan University Faculty: March 24, 2014 Ohio Wesleyan University (OWU) provides computing resources to support the educational mission and administration
The Internet and e-mail 2 Acceptable use 2 Unacceptable use 2 Downloads 3 Copyrights 3 Monitoring 3. Computer Viruses 3
Table of Contents 1 Acceptable use 1 Violations 1 Administration 1 Director and Supervisor Responsibilities 1 MIS Director Responsibilities 1 The Internet and e-mail 2 Acceptable use 2 Unacceptable use
Effective Date: Oct. 27, 2009... 1
Policy Title: Office of Information Technology Email Usage and Retention Policy Policy No.: 7010 Rev.: 0 Effective Date: Oct. 27, 2009 Last Revision: Oct. 27, 2009 Responsible Office: Responsible Official:
Information Resources Security Guidelines
Information Resources Security Guidelines 1. General These guidelines, under the authority of South Texas College Policy #4712- Information Resources Security, set forth the framework for a comprehensive
Document Title: System Administrator Policy
Document Title: System REVISION HISTORY Effective Date:15-Nov-2015 Page 1 of 5 Revision No. Revision Date Author Description of Changes 01 15-Oct-2015 Terry Butcher Populate into Standard Template Updated
Internet Use Policy and Code of Conduct
Internet Use Policy and Code of Conduct UNIQUE REF NUMBER: AC/IG/023/V1.1 DOCUMENT STATUS: Agreed by Audit Committee 18 July 2013 DATE ISSUED: July 2013 DATE TO BE REVIEWED: July 2014 1 P age AMENDMENT
Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
The Use of Information Technology Policies and Policies
Information Technology Management Procedure June 1, 2015 Information Technology Management, page 1 of 7 Contents Responsibility for Local Information Technology Policies 3 Responsibility to Maintain Functionality
Information Security Operational Procedures
College Of Coastal Georgia Information Security Operational Procedures Banner Student Information System Security Policy INTRODUCTION This document provides a general framework of the policy utilized by
Network & Information Security Policy
Policy Version: 2.1 Approved: 02/20/2015 Effective: 03/02/2015 Table of Contents I. Purpose................... 1 II. Scope.................... 1 III. Roles and Responsibilities............. 1 IV. Risk
C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer)
I. Title A. Name: Information Systems Security Incident Response Policy B. Number: 20070103-secincidentresp C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer)
SUBJECT: INFORMATION TECHNOLOGY RESOURCES I. PURPOSE
Page 1 of 8 I. PURPOSE To outline the University's policies for students, faculty, staff and others, concerning the use of the University's computing and communication resources, including those dealing
North Clackamas School District 12
North Clackamas School District 12 Code: IIBGA-AR Revised/Reviewed: 3/06/08; 6/21/12 Orig. Code(s): SP IIBGA Guidelines for the Use of the District s Electronic Communication System Definitions 1. Technology
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
Acceptable Use of Information Technology
Acceptable Use of Information Technology No.: 3501 Category: Information Technology Services Approving Body: Leadership Team Executive Division: Learning and Technology Services Department Responsible:
UNIVERSITY OF ROCHESTER INFORMATION TECHNOLOGY POLICY
PURPOSE The University of Rochester recognizes the vital role information technology plays in the University s missions and related administrative activities as well as the importance in an academic environment
information systems security policy...
sales assessment.com information systems security policy... Approved: 2nd February 2010 Last updated: 2nd February 2010 sales assessment.com 2 index... 1. Policy Statement 2. IT Governance 3. IT Management
Autodesk PLM 360 Security Whitepaper
Autodesk PLM 360 Autodesk PLM 360 Security Whitepaper May 1, 2015 trust.autodesk.com Contents Introduction... 1 Document Purpose... 1 Cloud Operations... 1 High Availability... 1 Physical Infrastructure
Network and Workstation Acceptable Use Policy
CONTENT: Introduction Purpose Policy / Procedure References INTRODUCTION Information Technology services including, staff, workstations, peripherals and network infrastructures are an integral part of
University of Maryland Baltimore Information Technology Acceptable Use Policy
The UMB School of Nursing follows and adheres to the UMB Campus Information Technology Acceptable Use Policy. The UMSON further defines Authorized User to also include any person who receives a password
APHIS INTERNET USE AND SECURITY POLICY
United States Department of Agriculture Marketing and Regulatory Programs Animal and Plant Health Inspection Service Directive APHIS 3140.3 5/26/2000 APHIS INTERNET USE AND SECURITY POLICY 1. PURPOSE This
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL Title: Computer and Network Security Policy Policy Number: 04.72.12 Effective Date: November 4, 2003 Issuing Authority: Office of the Vice President for
Southern Law Center Law Center Policy #IT0014. Title: Privacy Expectations for SULC Computing Resources
Southern Law Center Law Center Policy #IT0014 Title: Privacy Expectations for SULC Computing Resources Authority: Department Original Adoption: 5/7/2007 Effective Date: 5/7/2007 Last Revision: 9/17/2012
Appropriate Use Policy for Information Technology
Appropriate Use Policy for Information Technology Amarillo College Faculty, Staff, Students, Friends and Guests Amarillo College reserves the right to amend or otherwise revise this document as may be
Privacy Policy. What is Covered in This Privacy Policy. What Information Do We Collect, and How is it Used?
Privacy Policy The Friends of the Public Garden ("FoPG" or "We") is a non-profit corporation and the owner and operator of www.friendsof thepblicgarden.org (the "Website"), which is intended to supply
III. RESPONSIBILITIES
Issued by: Calvin O. Butts, III, President Effective Date: September 23, 2013 Page 1 of 5 I. POLICY & SCOPE This is the SUNY College at Old Westbury policy on College-provided access to electronic information
Certification Practice Statement
FernUniversität in Hagen: Certification Authority (CA) Certification Practice Statement VERSION 1.1 Ralph Knoche 18.12.2009 Contents 1. Introduction... 4 1.1. Overview... 4 1.2. Scope of the Certification
13.19 ETHICS REPORTING POLICY AND PROCEDURE
13.13 SOFTWARE AND COMPUTER USAGE Temple University has adopted an extensive software policy and an extensive computer usage policy that govern the usage of software, hardware, computer related equipment
Responsible Access and Use of Information Technology Resources and Services Policy
Responsible Access and Use of Information Technology Resources and Services Policy Functional Area: Information Technology Services (IT Services) Applies To: All users and service providers of Armstrong
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050
BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security
STRATEGIC POLICY REQUIRED HARDWARE, SOFTWARE AND CONFIGURATION STANDARDS
Policy: Title: Status: ISP-S9 Use of Computers Policy Revised Information Security Policy Documentation STRATEGIC POLICY 1. Introduction 1.1. This information security policy document contains high-level
Data Security Incident Response Plan. [Insert Organization Name]
![Data Security Incident Response Plan. [Insert Organization Name]](/thumbs/34/17160420.jpg "Data Security Incident Response Plan. [Insert Organization Name]")
Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security
APPROVED BY: DATE: NUMBER: PAGE: 1 of 9
1 of 9 PURPOSE: To define standards for appropriate and secure use of MCG Health electronic systems, specifically e-mail systems, Internet access, phones (static or mobile; including voice mail) wireless
Information Security and Electronic Communications Acceptable Use Policy (AUP)
Policy No.: AUP v2.0 Effective Date: August 16, 2004 Revision Date: January 17, 2013 Revision No.: 1 Approval jwv / mkb Information Security and Electronic Communications (AUP) 1. INTRODUCTION Southwestern
Executive Memorandum No. 16
OFFICE OF THE PRESIDENT Policy for Responsible Use of University Computers and Information Systems 1. Purpose It is the purpose of this Executive Memorandum to set forth the University's administrative
Information Security Operational Procedures Banner Student Information System Security Policy
Policy No: 803 Area: Information Technology Services Adopted: 8/6/2012 Information Security Operational Procedures Banner Student Information System Security Policy INTRODUCTION This document provides
NORTHEAST COMMUNITY COLLEGE ADMINISTRATIVE PROCEDURE NUMBER: AP-5250.0 FOR POLICY NUMBER: BP 5250 ACCEPTABLE USE PROCEDURES ELECTRONIC RESOURCES
NORTHEAST COMMUNITY COLLEGE ADMINISTRATIVE PROCEDURE NUMBER: AP-5250.0 FOR POLICY NUMBER: BP 5250 ACCEPTABLE USE PROCEDURES ELECTRONIC RESOURCES 1. PROCEDURE SUMMARY STATEMENT To establish procedures relating
Network Service Policy
Network Service Policy TABLE OF CONTENTS PURPOSE... 3 SCOPE... 3 AUDIENCE... 3 COMPLIANCE & ENFORCEMENT... 3 POLICY STATEMENTS... 4 1. General... 4 2. Administrative Standards... 4 3. Network Use... 5
Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4
WHITEPAPER Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4 An in-depth look at Payment Card Industry Data Security Standard Requirements 10, 11,
Acceptable Use Policy
Acceptable Use Policy 1. General Interoute reserves the right to modify the Acceptable Use Policy ( AUP ) from time to time. Changes to this Acceptable Use Policy will be notified to Customer in accordance
LEEDS BECKETT UNIVERSITY. Information Security Policy. 1.0 Introduction
LEEDS BECKETT UNIVERSITY Information Security Policy 1.0 Introduction 1.1 Information in all of its forms is crucial to the effective functioning and good governance of our University. We are committed
Plesk Panel HEAnet Customer Guide
Plesk Panel HEAnet Customer Guide Version 1.7 September 2013 HEAnet has migrated its Webhosting Service from the old Linux/Apache/MySQL/PHP (LAMP) set up to a control panel environment based on Parallel
HIPAA PRIVACY OVERVIEW
HIPAA PRIVACY OVERVIEW OBJECTIVES At the completion of this course, the learner will be able to: Define the Purpose of HIPAA Define Business Associate Identify Patients Rights Understand the Consequences
CHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
CITY OF BOULDER *** POLICIES AND PROCEDURES
CITY OF BOULDER *** POLICIES AND PROCEDURES CONNECTED PARTNER EFFECTIVE DATE: SECURITY POLICY LAST REVISED: 12/2006 CHRISS PUCCIO, CITY IT DIRECTOR CONNECTED PARTNER SECURITY POLICY PAGE 1 OF 9 Table of
Chicago State University Computer Usage Policy
Chicago State University Computer Usage Policy Introduction This document provides guidelines for appropriate use by students, faculty and staff of computers, and other technological facilities and services
Wake County Social Media Guidelines
Wake County Social Media Guidelines SUMMARY Wake County uses social media as a way to communicate with stakeholders, media, employees and our residents. These guidelines outline how Wake County will use
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
How To Protect Research Data From Being Compromised
University of Northern Colorado Data Security Policy for Research Projects Contents 1.0 Overview... 1 2.0 Purpose... 1 3.0 Scope... 1 4.0 Definitions, Roles, and Requirements... 1 5.0 Sources of Data...
SAMPLE TEMPLATE. Massachusetts Written Information Security Plan
SAMPLE TEMPLATE Massachusetts Written Information Security Plan Developed by: Jamy B. Madeja, Esq. Erik Rexford 617-227-8410 jmadeja@buchananassociates.com Each business is required by Massachusetts law
Neutralus Certification Practices Statement
Neutralus Certification Practices Statement Version 2.8 April, 2013 INDEX INDEX...1 1.0 INTRODUCTION...3 1.1 Overview...3 1.2 Policy Identification...3 1.3 Community & Applicability...3 1.4 Contact Details...3
Authorized. User Agreement
Authorized User Agreement CareAccord Health Information Exchange (HIE) Table of Contents Authorized User Agreement... 3 CareAccord Health Information Exchange (HIE) Polices and Procedures... 5 SECTION
Covered California. Terms and Conditions of Use
Terms and Conditions of Use Contents: Purpose Of This Agreement Privacy Policy Modification Of This Agreement Permission To Act On Your Behalf How We Identify You Registration Additional Terms For Products
Caldwell Community College and Technical Institute
Caldwell Community College and Technical Institute Student Computer Usage Policies and Procedures I. Campus Computer Usage Overview: The purpose of this document is to define the policies and procedures
AUBnet (email) Accounts Policies
(email) s Policies Reference: CNS-P-Acct Revision: B Supersedes: Purpose: Source: CNS-P-EMAIL-A This policy and related policies provide the framework in which all accounts and email and intranet are provided
Caldwell Community College and Technical Institute
Caldwell Community College and Technical Institute Employee Computer Usage Policies and Procedures I. PURPOSE: The purpose of this section is to define the policies and procedures for using the administrative
3. Electronic Mail (E-mail)
- Title of Agency - Internet Acceptable Use Policy The Following Internet Acceptable Use Policy Applies to the (AGENCY NAME) Staff 1. Introduction The (AGENCY NAME) provides its staff and (other entity(s)
MOREHOUSE COLLEGE. Standards of Conduct Guide
MOREHOUSE COLLEGE Standards of Conduct Guide Purpose Compliance Risk Management Program 1. Ethical Standards TABLE OF CONTENTS 2. Contacts with the media, government and outside investigators 3. Records
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account
Delphi Information 3 rd Party Security Requirements Summary. Classified: Public 5/17/2012. Page 1 of 11
Delphi Information 3 rd Party Security Requirements Summary Classified: Public 5/17/2012 Page 1 of 11 Contents Introduction... 3 Summary for All Users... 4 Vendor Assessment Considerations... 7 Page 2
The Security Rule of The Health Insurance Portability and Accountability Act (HIPAA) Security Training
The Security Rule of The Health Insurance Portability and Accountability Act (HIPAA) Security Training Introduction The HIPAA Security Rule specifically requires training of all members of the workforce.
RUTGERS POLICY. Section Title: Legacy UMDNJ policies associated with Information Technology
RUTGERS POLICY Section: 70.2.22 Section Title: Legacy UMDNJ policies associated with Information Technology Policy Name: Information Security: Electronic Information and Information Systems Access Control
FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security
Boston Public Schools. Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and. Technology Resources
Boston Public Schools Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and Scope of Policy Technology Resources ACCEPTABLE USE POLICY AND GUIDELINES Boston
Internet usage Policy
Internet usage Policy Free Use Disclaimer: This policy was created by or for the SANS Institute for the Internet community. All or parts of this policy can be freely used for your organization. There is
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.
micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security State Fair Community College shall provide a central administrative system for use in data collection and extraction. Any system user
Policy # 5.58 SOUTHERN UTAH UNIVERSITY Date Approved: 01/13/12
Page 1 of 6 I. PURPOSE Electronic mail (e-mail) has become an essential service greatly enhancing communication both within the Southern Utah University community and to external users, including prospective
APPROPRIATE USE OF INFORMATION TECHNOLOGY SYSTEMS INFRASTRUCTURE RESOURCES
APPROPRIATE USE OF INFORMATION TECHNOLOGY SYSTEMS (INCLUDING INTERNET & E-MAIL) EMC CORPORATE POLICY COPYRIGHT 2007 EMC CORPORATION. ALL RIGHTS RESERVED. NO PORTION OF THIS MATERIAL MAY BE REPRODUCED,
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
PRIVACY POLICY. Mil y Un Consejos Network. Mil y Un Consejos Network ( Company or we or us or our ) respects the privacy of
PRIVACY POLICY Mil y Un Consejos Network Version Date: April 15th 2010 GENERAL Mil y Un Consejos Network ( Company or we or us or our ) respects the privacy of its users ( user or you ) whether they use
Marist College. Information Security Policy
Marist College Information Security Policy February 2005 INTRODUCTION... 3 PURPOSE OF INFORMATION SECURITY POLICY... 3 INFORMATION SECURITY - DEFINITION... 4 APPLICABILITY... 4 ROLES AND RESPONSIBILITIES...
Valdosta State University. Information Resources Acceptable Use Policy
Valdosta State University Information Resources Acceptable Use Policy Date: December 10, 2010 1. OVERVIEW... 3 2. SCOPE... 3 3. DESIGNATION OF REPRESENTATIVES... 3 3.1 UNIVERSITY PRESIDENT... 3 3.2 VICE
Computer Security Incident Reporting and Response Policy
SECTION: 3.8 SUBJECT: Computer Security Incident Reporting and Response Policy AUTHORITY: Executive Director; Chapter 282.318, Florida Statutes - Security of Data and Information Technology Resources;