Information Technology Policies

1.1 Purpose

Point University maintains an information security program to protect the confidentiality, integrity, availability, and appropriate use of University information and technology resources. The program supports the University mission, manages reasonably foreseeable risk, and establishes a consistent framework for administrative, technical, and physical safeguards.

1.2 Scope

This manual applies to the University Community and to information and technology resources owned, licensed, managed, hosted, or used on behalf of Point University, whether located on University premises, in cloud services, at remote locations, or on authorized personally owned devices. It also applies to third parties when they access University systems or process University information.

1.3 Security Principles

• Access to information and systems must be authorized, appropriate to job or academic need, and limited according to least privilege and need to know.
• University information must be protected according to its sensitivity, regulatory obligations, contractual restrictions, and business value.
• Security controls must address people, process, technology, and physical safeguards and must be reviewed as risk and technology change.
• Availability and recoverability of systems supporting University operations must be considered in system design, maintenance, change management, and vendor selection.
• Security events and suspected incidents must be reported promptly and investigated through established incident-response procedures.
• Applicable legal, regulatory, contractual, and institutional requirements must be incorporated into standards and procedures, including requirements relevant to student records, financial information, payment-card information, privacy, and records management.

1.4 Governance and Responsibilities

University administration provides executive support and appropriate authority for the information security program. The Office of Information Technology (IT) is responsible for maintaining security policies and standards, implementing and monitoring technical controls, coordinating risk management, and serving as the central operational point for technology-security issues.

Human Resources and other administrative offices must promptly communicate employment or role changes that affect access. Data owners and department leaders are responsible for approving access appropriate to business need and for ensuring their personnel follow applicable safeguards. Every member of the University Community is responsible for safe computing practices, protecting credentials and information, and reporting suspicious activity.

1.5 Risk Management and Review

IT will identify and assess reasonably foreseeable internal and external threats and vulnerabilities; evaluate the likelihood and potential impact of those risks; assess the adequacy of existing safeguards; and implement or recommend risk treatment appropriate to the University. Risk assessments will be performed periodically and when material changes to systems, business processes, vendors, or regulatory obligations warrant review.

2.1 Purpose and Authorized Use

Access to Point University technology resources is a privilege provided to authorized users for University-related academic, administrative, research, communication, and other approved purposes. Incidental personal use may be permitted when it is reasonable, does not interfere with University operations, does not create material cost or risk, and does not violate law or University policy.

2.2 User Responsibilities

• Use only accounts, systems, data, networks, software, and services for which the user has authorization.
• Protect passwords, authentication factors, tokens, devices, and other credentials; do not share credentials or approve authentication requests that were not initiated by the user.
• Take reasonable steps to protect confidential, sensitive, regulated, or personally identifiable information from unauthorized disclosure, alteration, loss, or destruction.
• Comply with copyright, intellectual-property, software-license, privacy, and other applicable legal and contractual requirements.
• Respect the privacy, security, and rights of other users and do not attempt to bypass, disable, probe, or defeat security controls except as specifically authorized for legitimate security testing.
• Use University resources in a manner consistent with their intended purpose and the University mission.

2.3 Prohibited Use

• Unauthorized access or attempted access to accounts, systems, data, networks, or facilities.
• Credential sharing, impersonation, unauthorized interception, or concealment of unauthorized activity.
• Introducing malicious code; conducting unauthorized vulnerability scans, penetration tests, denial-of-service activity, or other disruptive testing.
• Using University resources for unlawful activity, harassment, fraud, material personal commercial gain, or personal political campaigning in a manner prohibited by University policy or applicable law.
• Circumventing licensing, security, filtering, monitoring, data-loss-prevention, or access-control mechanisms without authorization.
• Using University systems to store or transmit sensitive information through methods that IT has not approved when an approved secure method is required.

2.4 Privacy and Monitoring

University technology resources are University property or are provided under University contracts. Users should not assume personal privacy when using those resources beyond privacy rights provided by law or University policy. The University may log, monitor, inspect, preserve, or disclose information on its systems when reasonably necessary for security, operations, compliance, legal process, investigations, records obligations, or protection of the University and its community.

3.1 Identification and Unique Accounts

Individuals must be uniquely identified before access to University systems is granted. Individual user accounts must not be shared. Shared, service, application, emergency, or non-person accounts may be used only when there is a documented business or technical need, an accountable owner, appropriate credential protection, and periodic review.

3.2 Authentication

University systems must use authentication methods appropriate to the sensitivity and risk of the system. Multi-factor authentication (MFA) is required for privileged or administrative access, remote access where supported, and other systems designated by IT based on risk or regulatory requirements. IT may require phishing-resistant or stronger authentication methods for higher-risk functions.

3.3 Passwords and Credentials

• Passwords and authentication secrets must not be shared, reused in a manner that creates unreasonable risk, stored in unapproved locations, or transmitted insecurely.
• Password length, complexity, prohibited-password screening, lockout, expiration, and reset requirements will be defined in an IT authentication standard and adjusted as technology and recognized security guidance evolve.
• Routine forced password changes are not required solely because a fixed time period has elapsed unless a system, law, contract, or risk determination requires them. Passwords must be changed promptly when compromise is suspected or confirmed.
• Temporary credentials and recovery methods must be time-limited or otherwise controlled and must verify the identity of the requester before access is restored.

3.4 Privileged Access

Administrative privileges must be limited to authorized personnel and used only for approved duties. Where practical, privileged administration must use separate administrative accounts, MFA, enhanced logging, and least privilege. Privileged access must be reviewed periodically and removed promptly when no longer required.

3.5 Provisioning and Role Changes

Accounts and access must be created from an authoritative request or data source and must reflect the user’s current relationship and role with the University. Access beyond standard role-based entitlements requires approval from the appropriate system or data owner. Changes in employment, academic status, department, duties, or vendor relationship must trigger timely review and adjustment of access.

3.6 Offboarding and Termination

Upon separation or loss of authorization, access must be disabled or otherwise blocked at the time directed by the authoritative University office or contract owner. IT and the responsible department will address account access, MFA methods, email disposition, shared resources, application access, building or device access where integrated with IT processes, and return of University equipment. Access must not remain active merely to preserve email or files; approved delegation, retention, forwarding, or preservation methods must be used instead.

3.7 Student and Other Lifecycle Accounts

Student, alumni, adjunct, contractor, guest, and other non-employee accounts will be disabled, retained, or removed according to documented lifecycle standards based on institutional status, legitimate business need, licensing, records requirements, and security risk. The specific grace periods and product workflows are maintained as procedures rather than fixed in this policy.

3.8 Dormant Accounts and Review

IT will identify dormant, inactive, orphaned, or otherwise unnecessary accounts and disable or remediate them according to risk-based standards. Access reviews will be performed periodically for privileged accounts, sensitive systems, and other systems designated by IT or data owners.

4.1 Official University Email

University-provided email is an official communication method for University business. Users are responsible for monitoring their University account and using it in accordance with this manual. Official University business should be conducted through University-managed accounts and approved services when practical, especially when sensitive or regulated information is involved.

4.2 Email Ownership, Retention, and Access

Messages and data created, received, or stored in University-managed email systems may constitute University records and are subject to applicable retention, legal hold, discovery, privacy, security, and business-continuity requirements. IT may preserve, access, or disclose University email when authorized for legitimate University purposes and consistent with law and institutional policy.

4.3 Email Security and Misuse

• Users must exercise caution with links, attachments, unexpected authentication requests, financial requests, and messages requesting sensitive information.
• Sensitive information must be transmitted using approved protections such as encryption, secure file transfer, protected portals, or other methods designated by IT.
• Automatic forwarding of University email to external personal accounts may be restricted or prohibited when it creates security, privacy, retention, or compliance risk.
• Email may not be used for unlawful activity, harassment, impersonation, unauthorized bulk messaging, credential collection, malware distribution, or other activity prohibited by the Acceptable Use section.

4.4 Mass Email and Text Messaging

Mass communications must have a legitimate official University purpose, use approved platforms, and follow communication, privacy, consent, and emergency-notification requirements. Departments must use audience targeting and data sources appropriate to the message and should avoid unnecessary disclosure of recipient information.

Emergency communications may be sent through designated emergency-notification systems under the authority of the University offices responsible for emergency management and communications. Non-emergency mass texts and bulk messages require appropriate authorization and must follow approved branding, content, scheduling, opt-out, and audience-management procedures where applicable.

4.5 Personal and Confidential Information

Mass messaging and ordinary email should not contain highly sensitive personal, financial, authentication, health, or student-record information unless the communication method and disclosure are specifically authorized and appropriately protected. Secure portals or approved file-transfer methods should be used when direct messaging is not appropriate.

5.1 Network and Boundary Protection

IT will design and operate network protections appropriate to University risk, including boundary controls, firewalls, secure routing, segmentation, monitoring, and other safeguards. Security rules must follow least privilege, be documented to a level appropriate for administration and audit, and be reviewed periodically.

5.2 Segmentation and External Connections

Systems with materially different trust levels, administrative functions, regulatory obligations, or exposure should be segmented where practical. Connections to external organizations, cloud services, vendor networks, public networks, and specialized devices must be authorized and protected according to risk. Unnecessary inbound and outbound services, ports, protocols, and pathways must be restricted.

5.3 Encryption and Secure Communications

Sensitive University information must be protected in transit using encryption or other approved safeguards appropriate to the risk. Administrative interfaces and remote-management channels must use secure protocols. Deprecated or insecure protocols and cryptographic methods must be disabled or replaced when practical and risk warrants.

5.4 Wireless and Remote Access

University wireless networks must use centrally managed security appropriate to their purpose. Guest or untrusted access should be logically separated from protected institutional resources. Remote access to internal or administrative resources must use University-approved methods, strong authentication, and logging appropriate to risk.

5.5 Endpoint, Server, Cloud, and Specialized Device Protection

University-managed endpoints, servers, network devices, cloud services, voice systems, Internet-connected devices, and other specialized technology must be configured and maintained using safeguards appropriate to their function. Controls may include endpoint protection, system hardening, secure configuration, restricted administrative access, malware protection, logging, backup, and network isolation.

5.6 Monitoring and Logging

IT may collect and review security, authentication, network, system, cloud, and application logs to detect misuse, malicious activity, policy violations, availability problems, and other security events. Logging must be protected from unauthorized alteration and retained according to applicable operational, legal, and security requirements.

5.7 Availability and Denial-of-Service Protection

Critical services should be designed and operated with reasonable protections against disruption, including capacity planning, redundancy, backup, monitoring, vendor resilience, and denial-of-service protections appropriate to the service’s importance and risk.

6.1 Secure Configuration Baselines

IT will establish and maintain secure configuration baselines or equivalent documented standards for managed systems. Baselines should address operating systems, applications, services, ports and protocols, authentication, encryption, logging, administrative access, network connectivity, and other relevant security settings.

6.2 Configuration Control and Inventory

Material configuration changes must be authorized, documented, tested when practical, and implemented in a controlled manner. IT will maintain inventories or other records sufficient to identify managed systems, responsible owners, key configurations, and lifecycle status appropriate to operational and security needs.

6.3 Change Management

Changes that could materially affect availability, security, privacy, interoperability, or business operations must follow a documented change process. The process will consider risk, testing, approval, scheduling, communication, rollback, and post-change validation. Emergency changes may use expedited approval but must be documented and reviewed after implementation.

6.4 Routine and Planned Maintenance

Systems must receive routine maintenance needed for reliable and secure operation. Planned maintenance should be scheduled to reduce business impact, communicated to affected users when appropriate, and performed by authorized personnel using approved tools and methods.

6.5 Remote and Third-Party Maintenance

Remote maintenance must use approved secure access methods and authentication. Third-party maintenance access must be limited to the required scope and duration, monitored or logged when practical, and removed or disabled when the work is complete. Vendors must not retain persistent administrative access unless specifically approved and controlled.

6.6 Maintenance Media and Tools

Maintenance tools, removable media, diagnostic utilities, and portable devices must be controlled to reduce the risk of malware, unauthorized software, data exposure, or configuration changes. Sensitive data copied for troubleshooting must be minimized, protected, and removed when no longer required.

6.7 Unsupported Systems

Systems and software that are no longer supported by the vendor or cannot receive necessary security updates must be upgraded, replaced, isolated, removed, or covered by documented compensating controls and risk acceptance. Unsupported systems must not remain in production by default.

7.1 Vulnerability Management

IT will maintain a risk-based vulnerability-management program covering University-managed applications, systems, network devices, endpoints, cloud services, and other relevant technology. Vulnerabilities may be identified through vendor notices, security advisories, automated scanning, configuration assessment, penetration testing, monitoring, or other credible sources.

7.2 Risk Rating and Prioritization

Vulnerabilities will be prioritized using factors such as severity, exploitability, known active exploitation, Internet exposure, system criticality, compensating controls, vendor guidance, and the sensitivity of information processed. IT standards may define remediation targets by severity and may require accelerated action for actively exploited or otherwise exceptional vulnerabilities.

7.3 Patches and Security Updates

Security patches and updates must be obtained from trusted sources, assessed for applicability and risk, tested when practical, and deployed within timeframes appropriate to the vulnerability and system criticality. Emergency patching may be performed when the risk of delay exceeds the operational risk of expedited deployment.

7.4 Scanning and Security Testing

IT will conduct vulnerability scanning and other security testing at a frequency appropriate to risk and applicable obligations. External, Internet-facing, regulated, and high-value systems may require more frequent testing. Significant changes may trigger additional assessment. Penetration testing and specialized assessments will be performed periodically or when required by risk, contract, or compliance obligations.

7.5 Exceptions and Compensating Controls

When a vulnerability cannot be remediated within the expected timeframe, the responsible system owner and IT must document the reason, risk, compensating controls, target resolution date, and any required approval. Exceptions must be reviewed periodically and closed when the underlying condition is resolved.

8.1 Protection of Media and Stored Information

University information stored on electronic media, cloud storage, backup media, removable media, paper, or equipment must be protected according to its sensitivity and business value. Access must be limited to authorized individuals, and storage locations must provide safeguards appropriate to the information.

8.2 Removable Media

Use of removable media for sensitive information should be minimized. When required, removable media must be University-approved or otherwise authorized, protected from loss and malware, and encrypted when the sensitivity or risk warrants. Unknown or untrusted removable media must not be connected to University systems.

8.3 Encryption at Rest

Sensitive information stored on portable devices, removable media, or other locations with elevated risk of loss must be encrypted using University-approved methods where technically practical. IT may require device encryption for University-managed endpoints and other systems based on risk.

8.4 Storage, Transport, and Cloud Services

Sensitive information may be stored or transported only through approved methods that provide appropriate access control and protection. Cloud and external storage services must be approved for the type of information involved. Physical transport of sensitive media must use reasonable safeguards against loss, theft, or unauthorized access.

8.5 Sanitization and Disposal

Before media or equipment is reused, transferred, returned, recycled, sold, donated, or disposed of, University information must be removed using a sanitization method appropriate to the media and sensitivity of the data. When reliable sanitization is not possible or risk requires it, media must be physically destroyed through an approved process. Paper containing sensitive information must be securely destroyed when retention is no longer required.

8.6 Lost or Stolen Media and Equipment

Loss or theft of devices, removable media, paper records, or other media that may contain University information must be reported promptly to IT and other designated University offices so that containment, access revocation, remote actions, investigation, and notification obligations can be evaluated.

8.7 Backup Media

Backups containing University information must be protected from unauthorized access, alteration, and destruction. Backup practices should support recovery objectives, include appropriate separation or resilience from production systems, and be tested periodically for recoverability.

9.1 Purpose

Point University maintains a written information security program for covered financial and other protected information subject to the Gramm-Leach-Bliley Act (GLBA) and other applicable requirements. The program is intended to protect against reasonably foreseeable threats and unauthorized access that could result in substantial harm, fraud, identity theft, or compromise of covered information.

9.2 Program Coordination and Risk Assessment

The University will designate a qualified responsible individual or role to coordinate the information security program. The program will identify where covered information is collected, processed, transmitted, and stored; identify reasonably foreseeable internal and external risks; assess existing safeguards; and document additional safeguards or risk treatment as appropriate.

9.3 Administrative Safeguards

• Collect and retain covered information only to the extent reasonably necessary for legitimate University purposes and applicable records requirements.
• Limit access according to job responsibilities and need to know.
• Provide security awareness and role-appropriate training to personnel who handle covered information.
• Review safeguards after material changes and after significant security incidents involving covered information.
• Maintain incident-response and escalation procedures for events that could affect covered information.
• Periodically evaluate the effectiveness of the information security program and report material risks and program status to appropriate University leadership.

9.4 Technical and Physical Safeguards

• Use access controls, MFA where appropriate, encryption, secure transmission, system hardening, logging, malware protection, vulnerability management, patching, and other controls proportionate to risk.
• Protect paper and physical records containing covered information in controlled locations and securely destroy them when retention is no longer required.
• Disable access promptly when personnel separate or no longer require access and recover University devices, credentials, keys, badges, and other access mechanisms as applicable.
• Use approved secure methods for exchanging covered information and apply data-protection controls where technically and operationally appropriate.

9.5 Service Providers

Service providers that receive, maintain, process, transmit, or can access covered information must undergo appropriate security review. Contracts or other binding arrangements should require safeguards appropriate to the information and service, and providers should be monitored or reassessed based on risk and applicable requirements.

9.6 Program Review

The written information security program will be reviewed at least annually and when material changes in operations, technology, threats, vendors, or legal obligations warrant. Product names and individual employee contact details will be maintained in procedures or administrative records rather than embedded in this policy manual.

10.1 Technology Review

New or materially changed technology solutions that will connect to University systems, process University information, provide critical services, or create material security or privacy risk must undergo an appropriate IT and security review before use. This applies regardless of whether the solution is purchased, donated, free, open source, grant-funded, research-related, or obtained by another method.

10.2 Due Diligence

Reviews should consider information sensitivity, access model, authentication, encryption, data location, data ownership, retention and deletion, incident notification, subcontractors, business continuity, accessibility, integration, support, compliance obligations, and known security concerns. The depth of review will be proportionate to risk.

10.3 Contractual and Ongoing Controls

Where appropriate, contracts must address confidentiality, security safeguards, incident notification, data return or destruction, availability, audit or assurance information, and responsibilities at termination. Vendor access must be limited to what is necessary. Critical or high-risk vendors should be reassessed periodically and when material service changes or security events occur.

11.1 Security Awareness

The University will provide information-security awareness and training appropriate to users’ roles and risks. Personnel with access to sensitive, regulated, financial, administrative, or privileged information may receive additional role-based training. Completion requirements may be tracked and enforced by the responsible University offices.

11.2 Reporting

Actual or suspected security incidents, credential compromise, phishing, malware, unauthorized disclosure, lost or stolen devices or media, suspicious authentication requests, or other material security concerns must be reported promptly through the University’s designated IT or security reporting channel. Users should preserve relevant information and avoid actions that could unnecessarily destroy evidence.

11.3 Response and Investigation

IT and designated University officials may isolate systems, disable accounts, reset credentials, preserve logs or data, engage vendors or external specialists, and take other reasonable actions to contain and investigate an incident. Notification to affected individuals, regulators, law enforcement, insurers, or other parties will be coordinated with appropriate University leadership and legal/compliance personnel when required.

11.4 Enforcement

Violations of this manual or related standards may result in restriction or loss of technology access, removal of content, disciplinary action under applicable student or employee processes, contractual remedies, or civil or criminal referral as appropriate. IT may take immediate protective action when necessary to reduce a material security or operational risk.

12.1 Exceptions

Exceptions must be based on legitimate business, academic, technical, or accessibility need; must identify the risk and any compensating controls; and must be approved by the authority designated by IT and University administration. Exceptions should have an expiration or review date unless the approving authority determines otherwise.

12.2 Standards and Procedures

IT may issue standards, procedures, baselines, and guidelines to implement this manual. Such documents may establish technical requirements, remediation timeframes, approved products, maintenance windows, account grace periods, data-handling methods, or other operational details consistent with these policies.

12.3 Review and Revision

This manual will be reviewed at least annually. Material revisions should be documented through version control and approved through the University’s policy-governance process. Superseded copies should be retained or disposed of according to institutional records requirements.

Computing Resources: All University-owned, licensed, managed, or authorized information-processing resources, including hardware, software, networks, cloud services, applications, accounts, and connected devices.

Institutional Data: Information owned, licensed, maintained, created, received, or processed by Point University in support of its mission and operations.

Sensitive Information: Information requiring protection because of law, regulation, contract, institutional policy, privacy expectations, security risk, or potential harm from unauthorized access or disclosure.

University Community: Faculty, administrators, staff, students, student workers, contractors, interns, alumni where applicable, guests, agents, external organizations, and other authorized users of University resources.

MFA: Multi-factor authentication: authentication using two or more distinct factors, such as something known, possessed, or inherent to the user.

Privileged Account: An account with elevated rights capable of administering systems, security settings, users, data, networks, or other protected resources.

System Owner / Data Owner: The University role accountable for the business use of a system or information set and for approving appropriate access and protection requirements.

Standard: A mandatory technical or operational requirement that implements policy and establishes a minimum baseline.

Procedure: Documented steps used to carry out a policy or standard.

Guideline: Recommended practice that supports policy but allows discretion based on context.

Security Incident: An actual or suspected event that threatens the confidentiality, integrity, availability, privacy, or authorized use of University information or technology resources.

Service Provider: A third party that provides technology or related services and may access, host, transmit, maintain, or process University information or systems.

Back to Top