University Policies

• Information, applications and equipment are provided for business purposes only: Purdue University IT Resource Acceptable Use Policy.
   
  
• Each user is required to maintain the confidentiality of the data and use it only in the conduct of University business: Purdue University Data Security and Access Policy.

User Account and Workstation Responsibilities

• Users are expected to use strong passwords for your Purdue network accounts and applications. A short video on creating strong passwords that are easier to remember may be found at: http://www.purdue.edu/securePurdue/training/ Click on Strong Password Streaming Video.
   
• Passwords must be changed at least as frequently as required in the university password policy (currently every 30 days). Create a password that is easy to remember, but difficult for anyone else to guess. Do not write your password down.
• Password guidelines may be found at:
  http://www.itap.purdue.edu/security/procedures/passGuidelines.cfm
   
• Never share any Purdue Account password with any person. SSTA-WT staff will never ask for your password. Individuals requesting any of your passwords should be reported immediately to the Manager of Workstation Technology.
   
• It is expected that users will activate a password protected screen saver prior to leaving the machine unattended. Follow your department’s specific guidelines for screen saver activation.
   
• At the end of your workday, you must log out of the network by selecting Start/Shutdown/Restart.
   
• All Users are required to follow the Purdue University Electronic Mail Policy.
   
• A standard hardware and software configuration has been installed on each workstation to allow for consistent, timely, and cost-effective maintenance and troubleshooting.
   
• SSTA-WT installs on your workstation those applications required for business purposes. For all applications that require a license, the license must be owned by the University.
   
• Your workstation and its content is the property of the University and is provided to you for University business purposes. You will not knowingly engage in activities that could permit your workstation and the Purdue network to be compromised by computer viruses or malware. Some examples include but are not limited to:
   
• Continuing to visit web sites once known vulnerabilities have been identified
• Opening email attachments from unknown sources
• Downloading computer games, music, video, or non-business related file transfers (e.g., screen savers or pictures for screen savers)
  

Data Handling Expectations

• ITaP provides data storage on ITaP supported servers, where back-up services are provided.
• No data is ever to be stored on the local workstation (the C: drive).
• Your H: personal network drive folder is provided to store business documents that can only be accessed by you and by support personnel for specific situations as required by Security or Human Resources.
• The S: departmental folder is provided to store shared departmental business documents.
   
• Only business-related information is allowed to be stored on the network drives. Refer to SSTA Executive Steering Committee approved Policies relating to network drive storage and housekeeping: Network Drive Space Management. Auditing for specific file types is performed as needed.
   
• All administrative data and information are University resources. They are owned by the University and are shared as appropriate to meet the needs of the University and its various constituencies. Users are granted access to those data and information resources required to carry out the responsibilities of their position. No University employee will knowingly damage or misuse computing resources or data.
   
• Users are expected to be knowledgeable and compliant with restricted or sensitive data as defined by applicable privacy regulations such as FERPA, GLBA, and HIPAA.
   
• Restricted or sensitive data about employees, students, alumni, customers, or anyone otherwise affiliated with Purdue should only be stored on secure university servers. Personal or sensitive data include but are not limited to SSN, credit card information, and other personal identification information like birth dates, maiden names, etc.
   
• Restricted or sensitive data may not be transmitted in email messages, email attachments. Any restricted or sensitive data received via email should be immediately removed from the email folder on the server.

If any User is found in violation of these expectations or found abusing the equipment’s intended use, disciplinary action may be taken by the employing department.

Each SSTA-supported user is required to sign the Acknowledgement of Responsibility form associated with these expectations which verifies that these expectations are understood.