����

 1. Background & Purpose

1. 1.1 The goals of this policy and any supporting policies is to ensure that our digital information is:
2. 1.  
   2. 1.1.1  Available: assurance that authorized individuals have both timely and reliable access to data and other resources when needed.
3. 1.  
   2. 1.1.2  Accurate: assurance that information is not intentionally or accidentally modified in such a way as to call into question its reliability.
4. 1.  
   2. 1.1.3 Confidential: assurance that sensitive information is not intentionally or accidentally disclosed to unauthorized individuals.
   3.  
5. 1.2 This policy and any supporting policies and procedures constitute ��ñ����’s Information Security Program to ensure all necessary measures are in place to achieve the goals in paragraph 1.1.
6.  
7. 1.3 This policy is intended to outline the responsibilities of those who have access to University electronic information and the services, devices and systems that store or transmit this information.
8.  
9. 1.4 Any supporting policies and procedures are to provide further clarity and detail on various aspects of information security required under this policy.
10.  
11. 1.5 Definitions of Roles and Responsibilities are described in Appendix 1.
12.  
13. 1.6 The Vice-President, Finance and Administration may adopt standards and procedures consistent with this policy for the University while departments may adopt implementation procedures that reflect departmental circumstances, provided they too are consistent with this policy.

1. 1.7 Nothing in this policy shall derogate from any right any staff or faculty member has under a collective agreement or any responsibility the University has under law or regulations.

1. 1.8 The university is committed to the principle of academic freedom. This policy should be interpreted in that context.

2. General

1. 2.1 All Users of ���� Electronic Information and Systems are responsible for using them responsibly and for maintaining their security.

1. 2.2 Users who breach this policy may be subject to disciplinary actions subject to any applicable collective agreement. In addition to any other sanctions that the University may impose in the event of a violation, the Director of Information Technology, or their designate, may restrict or withdraw access to ���� Electronic Information and Systems, including computing privileges and network access.

1. 2.3 The Director of Information Technology or delegate shall perform a coordinating role in the implementation, administration, and support of this policy by:

1. 1. 2.3.1 providing guidance on compliance with the policy;

1. 1. 2.3.2 providing an ongoing security awareness program; and

1. 1. 2.3.3 assisting, where appropriate, in the investigation of breaches and potential breaches of the policy.

1. 2.4 If a User becomes aware that Electronic Information and Systems are not being used appropriately, the User should bring this to the attention of the relevant administrative department head or to the Director of Information Technology so that appropriate action can be taken to address the situation.

1. 2.5 This policy applies to all ���� Electronic Information, except as otherwise provided by paragraph 2.6.

1. 2.6 Where a ���� System is not intended to be used for University Business, the Director of Information Technology must, in consultation with the Vice President Finance and Administration approve separate terms of use that govern the use of such system. Upon such approval, this policy will not apply to such system.

3. Definitions

1. 3.1 “Academic Freedom” is defined in the collective agreements with ��ñ���� Faculty Association.
2.  
3. 3.2 “Information Security Program” includes this policy and all supporting policies and procedures describing the steps required to ensure the safety and security of ��ñ���� electronic information and systems.
4.  
5. 3.3 “��ñ���� Electronic Information” is electronic data needed and created to conduct University Business.
6.  
7. 3.4 “��ñ���� Electronic Information and Systems” includes ��ñ���� Electronic Information and ��ñ���� Systems both on campus and hosted elsewhere off campus.
8.  
9. 3.5 “��ñ���� Systems” are services, devices, and facilities that are owned, leased or provided to the University, and that are used to store, process or transmit electronic information. These include, but are not limited to:
10. 1.  
    2. 3.5.1 computers and computer facilities;
    3.  
11. 1. 3.5.2 computing hardware and equipment;
    2.  
12. 1. 3.5.3 mobile computing devices such as laptop computers, smartphones, and tablet computers;
    2.  
13. 1. 3.5.4 electronic storage media such as CDs, USB memory sticks, and portable hard drives;
    2.  
14. 1. 3.5.5 communications gateways and networks;
    2.  
15. 1. 3.5.6 email systems;
16. 1.  
    2. 3.5.7 telephone and other voice systems; and
    3.  
17. 1. 3.5.8 software.
    2.  
18. 3.6 “University Business” means activities in support of the administrative, academic, and research mandates of the University.
19.  
20. 3.7 “U�������” are faculty, staff, students, and any other individuals who use ��ñ���� Electronic Information and Systems.

4. Use of ���� Electronic Information and Systems

1. 4.1 ���� Electronic Information and Systems may only be used in a manner that is consistent with:

1. 1. 4.1.1 applicable laws, and;

1. 1. 4.1.2 this and other applicable policies, and;

1. 1. 4.1.3 collective agreements with faculty and staff; and

1. 1. 4.1.4 the terms of employment applicable to non-unionized staff.

1. 4.2 Incidental personal use of ��ñ���� Electronic Information and Systems is acceptable provided that such use does not interfere with the User’s job performance and is not a prohibited use as per paragraph 4.3 of this policy.

1. 4.3 Prohibited uses of ���� Electronic Information and Systems are any uses that disrupt or interfere with the use of the resources for their intended purpose.

The following are examples of prohibited uses:

1. 1. 4.3.1 breaching applicable laws or university policies;

1. 1. 4.3.2 sending threatening, harassing or discriminatory messages;

1. 1. 4.3.3 misrepresenting the User’s identity as sender of messages;

1. 1. 4.3.4 intercepting or examining the content of messages, files, or communications without authorization;

1. 1. 4.3.5 infringing upon the copyright of computer programs, data compilations and all other works (literary, dramatic, artistic or musical);

1. 1. 4.3.6 infringing upon the legal protection provided by trademark law and the common law for names, marks, logos, and other representations that serve to distinguish the goods or services of one person from another;

1. 1. 4.3.7 making unauthorized copies of proprietary software, or offering unauthorized copies of proprietary software to others;

1. 1. 4.3.8 failing to maintain the confidentiality of passwords, access codes or identification numbers used to access ���� Electronic Information and Systems;

1. 1. 4.3.9 seeking information on passwords or information belonging to another User without authorization;

1. 1. 4.3.10 accessing or examining other accounts, files, programs, communications or information without authorization;

1. 1. 4.3.11 destroying, altering, dismantling, disfiguring or disabling ���� Electronic Information and Systems without authorization;

1. 1. 4.3.12 damaging or altering the hardware or physical components of ���� Systems without authorization;

1. 1. 4.3.13 attempting to circumvent security controls on ���� Electronic Information and Systems without authorization;

1. 1. 4.3.14 knowingly introducing malware; and

1. 1. 4.3.15 engaging in any uses that result in the loss of another User’s information without authorization.

1. 4.4 Nothing in paragraph 4.3 shall be construed as preventing or restricting duly authorized system administrators or other technical personnel from carrying out their duties.

5. Security of ���� Electronic Information and Systems

1. 5.1 All Users must comply with the Information Security Standards established under this policy regarding the security of ���� Electronic Information and Information Systems.
2.  
3. 5.2 The Vice President Finance and Administration is responsible for:
4. 1.  
   2. 5.2.1 developing and issuing any supporting Information Security Policies and Procedures, which must be consistent with this policy;
   3.  
5. 1. 5.2.2 publishing the Information Security Policies and Procedures on the ���� web site for access by all Users; and
   2.  
6. 1. 5.2.3 reviewing the Information Security Policies and Procedures on a bi-annual basis or at such other interval as the Vice President Finance and Administration determines.
   2.  
7. 5.3 Individuals who wish to deviate from the Information Security Policies and Procedures are required to request the authorization of the Vice President Finance and Administration before proceeding.
8.  
9. 5.4 Where the Information Security Policies and Procedures do not address the reasonable requirements of an individual’s use of and access to ��ñ���� Electronic Information or Systems, the Vice President Finance and Administration may authorize a variance or update the Information Security Policies and Procedures as appropriate.

6. Use of Non-University Systems for University Business

1. 6.1 To maintain the security of ���� Electronic Information, Users intending to conduct University Business using systems other than ���� provided systems must do so in accordance with the Information Security Standards.

7. Privacy of Users

1. 7.1 Since paragraph 4.2 of this policy authorizes the incidental personal use of ��ñ���� Electronic Information and Systems, the University recognizes that these resources may contain records relating to this personal use, e.g. personal emails, documents, voicemails, text messages, and records of internet and social media use (the “Personal Use Records”).
2.  
3. 7.2 While the University takes reasonable measures to back up information and protect it from loss, the University cannot guarantee that Personal Use Records will be retained in the ���� Systems or remain confidential. To protect their Personal Use Records from inadvertent access, disclosure or destruction, Users are encouraged to store them separately from ���� Electronic Information and back them up on a regular basis. Personal Use Records may be subject to Requests under the New Brunswick Request to Information and Protection of Privacy Act (RTIPPA).
4.  
5. 7.3 Users should understand that the University routinely monitors network transmission patterns such as source/destination, address/port, flags, packet size, packet rate, and other indicia of traffic on ���� Systems. University system administrators and other technical personnel also perform routine maintenance of ���� Systems. This routine monitoring and maintenance may unintentionally reveal Personal Use Records.
6.  
7. 7.4 The University will not intentionally access, use or disclose Personal Use Records unless it has the consent of the User, or:
8. 1.  
   2. 7.4.1 securing the User’s consent would compromise (a) the health or safety of an individual or a group of people, (b) the availability or accuracy of the information, or (c) an investigation or a proceeding related to a breach of law or policy or the employment of the User;

1. 1. 7.4.2 the University is legally authorized to do so.

8. Administrative Responsibilities

1. 8.1 Vice Presidents, Deans and Directors are responsible for establishing and maintaining ���� Electronic Information and Information Systems within their areas of responsibility. These responsibilities include:
2.  
3. 1. 8.1.1 ensuring that ���� Electronic Information and Information Systems are secured with adequate controls, with particular care concerning User identification and validation measures;
   2.  
4. 1. 8.1.2 ensuring, as appropriate or required, that ���� Electronic Information within their area of responsibility is maintained, transmitted, and stored in a secure and consistent manner that adheres to all relevant University policies and standards;
   2.  
5. 1. 8.1.3 authorizing access for individuals to ���� Electronic Information and Information Systems within their area of responsibility;
   2.  
6. 1. 8.1.4 renewing, retiring, and revoking User authorizations within their area of responsibility;
   2.  
7. 1. 8.1.5 ensuring that a contingency plan, including appropriate data back-up systems and recovery systems, is being used within their department;
   2.  
8. 1. 8.1.6 ensuring that breaches and potential breaches of this policy occurring within their department are resolved and/or referred to the Director of Information Technology, as appropriate, and that where they are so referred, continuing to assist in the investigation, preserving evidence where required;
   2.  
9. 1. 8.1.7 ensuring that technical staff within their department are aware of and adhere to this policy, and that they support University standards in the design, installation, maintenance, training, and use of ���� Electronic Information and Systems;
   2.  
10. 1. 8.1.8 working with ���� Computing Services to make training and other information and resources necessary to support this policy available to Users in their department; and
    2.  
11. 1. 8.1.9 taking immediate and appropriate action when they become aware of violations of this policy or its procedures.

Security and Classification of ���� Electronic Information Procedure

1. Introduction

���� Electronic Information used by Users, has varying degrees of sensitivity which have corresponding levels of risk and protection requirements; therefore, it is necessary to classify this information to ensure it is given the appropriate level of care and custody.

This explains how ��ñ���� Electronic Information is classified using ��ñ����’s three-level Information Security Classification Model.

This has been issued under the authority of the Use and Security of ���� Electronic Information and Systems Policy. Questions may be referred to helpdesk@mta.ca

2. Information Security Classification Model

���� Electronic Information is classified as follows:

3. Responsibility for Classifying and Caring for Information

The Data Steward/Owner is responsible for determining the information security classification based on the definitions and examples in the table above. Based on other relevant factors, information may be classified at a higher level than indicated above, but not at a lower level.

The Vice President’s, Deans and Directors are responsible for knowing the types of ��ñ���� Electronic Information under their control, its information security classification and where it is stored. This responsibility may be delegated to the Information Steward/Owner.

All users are required to provide the corresponding levels of care and custody of University information while in their possession and control.

Related Documents
6300 – Archives Policy

Related Documents
Password Policy and Procedures - 7002