Secure Purdue Information Technology

Recent Policy Changes

S-14 Biometric Technologies

Standard Updated: September 1, 2026

Requirements for deploying Biometric Technologies updated. Added sections in the Statement of Standard on consent, disclosure, storage and retention. Added definitions for Biometric Hashes and End User Devices.

Three key updates have been made to the deployment requirements.

  • No Biometric Data in image formats may be stored on University IT Resources.
  • Biometrics may not be used for authentication alone. An additional factor is required, such as a PIN, password or other user credential unless approved by PSS.
  • Biometric Technologies may be used as single-factor authentication to unlock an End User Device that was previously authenticated via non-biometric means. The Biometric Data may only be stored locally on an End User Device with industry accepted encryption.

Consent Subsection Key Information

  • An individual’s Biometric Data may not be collected or otherwise obtained by Purdue University without prior written explicit consent of the individual.

Disclosure Subsection Key Information

  • Disclosure or dissemination of any Biometric Data is not done outside of identified groups unless:
    • Disclosure is required by state or federal law or municipal ordinance;
    • Disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction;
    • The disclosed data completes a financial transaction requested or authorized by the individual to whom the Biometric Data pertains; or
    • The individual to whom the Biometric Data pertains has consented to such disclosure or dissemination.

Storage Subsection Key Information

  • The University uses a reasonable standard of care to store, transmit and protect from disclosure any Biometric Data collected or retained.

Retention Subsection Key Information

  • In circumstances where Purdue retains Biometric Data, the University permanently destroys the Biometric Data within 12 months of when the initial purpose for collecting or obtaining it has been satisfied.
  • If any University’s vendors and/or licensors require access to Biometric Data in order to fulfill the purpose of collecting such information, the University requires that they follow the identified destruction schedule.

Definitions Added

  • Biometric Hash(es)- A numeric value produced by running Biometric Data through a mathematical algorithm. The numeric value is representative of the Biometric Data.
  • End User Device(s)- A physical or virtual Device (e.g., cellphones, tablets, laptops, etc.) equipped with an operating system that can be leveraged by a user to establish a local or network connection to Purdue IT Resources.

Application of the Artificial Intelligence (AI) Use Policy

Supplemental Document Published: April 13, 2026

This document helps explain the relationship between the AI Use Policy and other university policies and standards. It clarifies the two key limitations applicable to other policies and standards that are identified​ within the document.

  • Sensitive and Restricted Data must not be entered into unauthorized AI tools​.
  • AI must not be the sole factor used in making personnel, award or disciplinary decisions.

The other related policies identified in the document have specific limitations listed below.

High Performance Computing (HPC) Security (S-33)

Standard Published: March 25, 2026

This standard covers the security of High-Performance Computing (HPC) resources to safeguard and maintain the integrity of research. Securing HPC systems presents unique challenges due to their size, performance requirements, diverse and complex hardware, software and applications, varying security needs, shared resource nature, and their continuous evolution. The security topics, unique to an HPC environment, are identified and enforced within the standard.

Controlled Unclassified Information in Research (S-32)

Standard Published: November 1, 2025

The standard aligns Purdue University policy, federal requirements for protecting CUI, NIST SP 800-171 (as updated or amended), and CMMC Level 2 controls. The development of Purdue’s CMMC Compliance Program promotes adherence to these standards. Compliance ensures the University maintains the necessary security posture to protect CUI, supports federal contract requirements, and fosters a secure research environment.

Artificial Intelligence Use (VII.A.5)

Policy Published: November 1, 2025

The policy covers the responsible use of Generative Artificial Intelligence (GenAI) and Large Language Models (LLM), collectively referred to as AI in this policy, is essential to the University’s ongoing mission.

 

Thank you for your attention to these changes, and please send any questions to itpolicyanswers@purdue.edu

Contact Us