Policies and Procedures

Information Security Office

Barry University Information Security Policies Summary

  • What it governs: Defines how University computers and technology should be used responsibly. Covers acceptable personal use, prohibited activities (like storing University data on personal devices/cloud), and consequences for misuse.

    Target Audience: All University employees, students, contractors, affiliates, visitors, and guests ("users").

  • What it governs: Explains who gets standard access to University technology (like email) based on their role (student, employee, etc.) and the basic security rules accounts must follow.

    Target Audience: Applies broadly to standard access; specific responsibilities lie with departments requesting accounts (HR, Registrar, etc.); implicitly applies to all users with standard access.

  • What it governs: The formal promise individuals make to protect sensitive University information they access during their work or studies. Signing is required for access.

    Target Audience: All current and new Barry University employees, contractors, volunteers, and others granted access to University systems and University Data.

  • What it governs: Sets the rules for safely using outside companies (vendors) that handle University data (e.g., cloud services). Requires vendor review and specific agreements to ensure data protection.

    Target Audience: University personnel choosing or managing relationships with outside vendors; indirectly applies to the vendors themselves.

  • What it governs: Outlines the University's official plan for responding to cyberattacks or data breaches. Details steps for detection, containment, fixing the issue, and learning from incidents.

    Target Audience: All departments and users of IT resources and assets; personnel with specific incident response roles.

  • What it governs: Sets the rules for using your official University email account responsibly. Covers secure handling of sensitive information, official signatures, and reporting suspicious emails (phishing).

    Target Audience: All Barry University email account holders (Faculty, staff, students, alumni, retirees, contractors, guests, vendors, etc.).

  • What it governs: Rules for sending mass marketing emails to people outside the University community, following anti-spam laws. Requires getting permission and providing an easy way to opt-out.

    Target Audience: Faculty, staff, and University departments sending external bulk marketing emails.

  • What it governs: Rules for sending marketing text messages to people outside the University, following relevant laws. Requires getting written permission first and offering an easy opt-out method.

    Target Audience: Anyone sending external marketing text messages on behalf of the University.

  • What it governs: The requirement for all users to complete regular security training to understand cyber threats and protect University information.

    Target Audience: All students, employees, and affiliates using the Barry network or IT resources.

  • What it governs: Rules for securely using smartphones, laptops, and tablets (both University-owned and personal) for University work. Covers passwords/PINs, encryption, updates, and reporting lost or stolen devices.

    Target Audience: All University employees, students, contractors, affiliates, visitors, and guests using mobile devices for University purposes.

  • What it governs: The process and standards for hiring outside companies to create or host University websites, ensuring they meet branding, accessibility, and legal requirements.

    Target Audience: University personnel involved in outsourcing or managing University websites.

  • What it governs: Rules for creating strong passwords and using Multi-Factor Authentication (MFA) for University accounts. Covers complexity, regular changes, and prohibits sharing passwords.

    Target Audience: All individuals accessing University systems (employees, students, contractors, affiliates); System Administrators.

  • What it governs: Extra security rules for special accounts with high-level administrative access to University systems, limiting access and tracking usage.

    Target Audience: Anyone with privileged access to University systems; IT System Administrators.

  • What it governs: How long University records (paper and electronic) must be kept and how to securely destroy them afterward, following legal requirements.

    Target Audience: All University employees, staff, and faculty.

  • What it governs: Rules for securely connecting to the University network from off-campus (e.g., using VPN) and the security requirements for connecting devices.

    Target Audience: All employees, students, contractors, or vendors who connect remotely to the University network or manage remote access systems.

  • What it governs: Guidelines for using Artificial Intelligence (AI) tools safely and ethically for University work (not teaching/learning), requiring approval before using University data with AI.

    Target Audience: All University employees, students, contractors, and affiliates using AI tools for University research, administrative, or operational purposes.

  • What it governs: Rules for using social media sites (like Facebook, Instagram) for official University purposes or when representing Barry personally online. Covers appropriate conduct and procedures for official accounts.

    Target Audience: All University students, faculty, and staff using social media for University purposes or referencing the University personally.

  • What it governs: How University user accounts (like email) are created, managed, and eventually closed based on your relationship with Barry (e.g., student, employee, alumni).

    Target Audience: All holders of Barry University user accounts

  • What it governs: The University's process for finding, assessing, and fixing security weaknesses in its computer systems and software before they can be exploited.

    Target Audience: Primarily IT Department and Information Security Office staff; indirectly applies to all using University IT infrastructure.

  • What it governs: The University's main plan for protecting sensitive information. Outlines key security requirements covering data access, training, physical security, and vendor management.

    Target Audience: All university employees, contractors, interns, student employees, and relevant third-party vendors.

Sign in to use the pins