Information Systems and Electronic Resources Acceptable Use Policy

1. Electronic libeling or defamation
2. Sending/Posting/Broadcasting messages that incite hate or violence
3. Transmitting repeated unwanted personal advances
4. Falsifying information or impersonation
5. Unauthorized use of, providing, or copying of protected intellectual or copyrighted property

1. Posting or transmission of confidential information
2. Use of offensive or discriminatory language
3. Transmission or display of graphic images, sounds or text that is sexual or offensive in nature
4. Unauthorized use of other's passwords or accounts
5. Use of the Systems for personal profit or gain
6. Use of the Systems to harass, threaten, or otherwise invade the privacy of others
7. The installation or use of any servers on the network not expressly approved by the Office of Technology Services (hereafter "OTS")
8. Deliberate attempts to cause breaches of the network, servers, telecommunications systems or security or to examine network traffic
9. Initiation of activities which unduly consume computing or network resources such as downloading of files or steaming media for personal use that disproportionally burdens network or server resources.
10. Use of applications, for example P2P, to receive and/or distribute copyrighted materials, such as movies, music, and video
11. Tampering with computer files, software, or knowingly introducing a virus or malicious code to the to the CSN systems
12. Unauthorized changes to the CSN web pages
13. Playing games in CSN computer labs for entertainment
14. Excessive use of network bandwidth, storage, and any computer resources for purposes unrelated to CSN activities

1. Password Protection: A password authenticates the holder as an authorized user of CSN’s computer system that uses the school’s Active Directory for authentication, authorization and auditing and must be protected from disclosure to others.
   1. Each user is responsible for the security of their password(s).
   2. A password must not to be shared with others or posted in a location where others may see it and may only be used by the person for whom the password was created.
   3. User accounts that have system-level privileges granted through group memberships must have a unique password from all other accounts held by that user.
   4. Group passwords are allowed only in the case of the highest level administrator passwords for servers.
   5. Passwords must not be inserted into email messages or other forms of electronic communication.
   6. Pre-validated Active Directory accounts that are not validated and activated within three calendar days will be disabled.
2. Password construction and changes: OTS will monitor password requirements to ensure they are state of the art for protecting the CSN network. OTS will notify system users of new requirements for passwords. These guidelines will be updated and displayed on https://www.csn.edu/passwordreset.

Violations

1. Any suspicion of a password being compromised on a system that uses CSN’s Active Directory for authentication, authorization and auditing must be reported to OTS. Active Directory accounts suspected of being compromised or misused will be disabled by OTS. OTS will disable Active Directory accounts promptly at notice of termination by HR or the employee’s department.
2. CSN may also impose restrictions pertaining to computer use, including a loss of computing privileges on a temporary or permanent basis, a decrease of disk quota, and the removal of files in the System's temporary or scratch area.
3. In addition to liability and penalties that may be imposed under federal, state or local laws, users of the Systems who fail to fulfill their responsibilities and engage in prohibited conduct may be subject to disciplinary action. CSN may restrict or suspend user privileges while the alleged violation(s) are being investigated and disciplinary action pursued. Disciplinary action shall be taken by the Vice President of Student Affairs relative to student violations, and by the appropriate CSN officer relative to faculty, staff, and/or CSN affiliate violations. A violation may also result in a referral to law enforcement authorities.
4. In accordance with CSN and NSHE policies and state and federal laws, OTS may monitor the CSN Network for activity that violates this Acceptable Use Policy.

E-mail Acceptable Use Policy

In promoting communication and distance learning initiatives, CSN has established a student, faculty and staff email system, a learning management system, along with other communication tools. These systems serve as CSN’s official modes of communication. All communication directly linked to the purposes and mission of CSN will be conducted using the tools provided by CSN. This includes information communicated by students, faculty, staff and CSN’s administrative offices.

CSN email users will not be permitted to set up automatic forwarding options on CSN email accounts to forward CSN emails to other personal email systems such as Gmail, Yahoo, Outlook.com, etc.

Acceptable Use - The use of student email accounts, must be in support of educational and academic activities or research and consistent with the educational objectives of the CSN. Transmission of any material in violation of any United States, Nevada, or other pertinent jurisdiction's law, regulation, or rule, or any Nevada System of Higher Education Board of Regents policy or CSN policy, is prohibited. This includes, but is not limited to, threatening or obscene material or material protected by trade secret. Illegal acts are strictly prohibited. Using Intranet accounts to play games is not acceptable use.

Privileges - The use of CSN's Intranet is a privilege, not a right, and inappropriate use can result in a cancellation of those privileges.

Netiquette - Users are expected to use e-mail in a manner abiding by all applicable guidelines and laws.

1. For students, these guidelines are included in the Rules of Conduct and Procedures for Students of the Nevada System of Higher Education (Title 2, Chapter 10).
2. For faculty and staff, professional codes of conduct apply. These guidelines are included in the NSHE Code (Title 2, Chapter 6).

Additional Prohibitions - Behavior that is subject to interruption or revocation of user privileges and disciplinary action under this Code are violations of federal, State, and local law, and include conduct that threatens the safety or well-being of the campus community and any other behavior that adversely affects the CSN or its educational mission.

No Guarantee of Privacy - As noted previously, CSN electronic mail (email) is not guaranteed to be private. This is because system administrators who operate the system do have access to all email, and compliance with applicable law and implementation of CSN policies, including this policy, may result in monitoring. Messages relating to, or in support of illegal activities, may be reported to the authorities.

Reliability - CSN makes no warranties of any kind, whether expressed or implied, for the reliability of the electronic services. CSN will not be responsible for any damages employees or students suffer from use of the electronic resources. This includes loss resulting from delays, non·deliveries, misdeliveries, or service interruptions.

Security - Security on any computer system is a high priority, especially when the system involves many users. If a student or employee believes that he or she can identify a security problem, he or she should notify a system administrator to help identify and resolve any associated problems. Students and employees should not give their passwords to any other individual. Attempts to log into the system by any other user may result in cancellation of user privileges. Attempts by non·system administrators to log in to the system as a system administrator or other system staff will result in cancel lation of user privileges. Any user identified as a security risk or having a history of problems with computer systems may be denied access to the system and subject to other disciplinary actions that could include termination of employment or expulsion of a student.

Wireless Network Acceptable Use Policy

Users of CSN’s Wireless Network Services agree to the following:

Compliance: Use of CSN's wireless network is subject to this Policy. All wireless users, to include faculty, staff, students, guests, outside contractors, vendors, etc., must comply with the Policy. By your use of the CSN wireless network, you acknowledge your compliance obligations with the Policy. No user shall use the wireless network so as to interfere with the ability of others to access network resources. No user will attempt to penetrate the security of any CSN communications network or computer system. No technology resource will be used for an unsanctioned commercial purpose.

Service Expectations: The CSN wireless network is intended as a supplement to the wired network and for use with portable electronic devices; it is not intended to be a user's sole connection to CSN’s network or IT Resources. The wireless network should not be expected to provide the same quality of service as CSN’s wired network infrastructure. When reliability and performance are critical, CSN’s wired network infrastructure should be used. Stationary computing devices, such as PC/Mac towers, printers, servers, and other critical IT Resources must be connected to CSN’s wired network infrastructure where reasonably possible.

Data Security: Data transmitted over a wireless network can be easily intercepted, and it is critically important to implement security measures in conjunction with any use of wireless network access. These security measures should include authentication and strong data. Users are encouraged to use an encrypted VPN connection to access personal data.

Sharing Files and Accessing Information of the World Wide Web: CSN supports the free exchange of information and ideas facilitated by sharing authorized or otherwise appropriate computer files. However, any copyrighted material must only be used with permission. Without the appropriate permission, the account owner or wireless user can experience the following: be asked to immediately remove the material; material removed by CSN personnel; civil liability, and/or criminal prosecution, and denial of access to the CSN network. Using CSN’s network to download or share copyrighted music, movies, television shows or games without the appropriate permission may result in legal sanctions, network termination or both.

• BitTorrent, Limewire, Gnutella, eDonkey, and other filesharing programs can transmit files on your computer to others in violation of copyright laws, with or without your knowledge. If these programs are on your computer, you will be held responsible for any copyright violations that may result.

Privacy: Many software systems are designed to collect usage information and to log user activity. CSN routinely aggregates the data stored in these log files for analytical purposes. In general, CSN makes no attempt to extract from the logs data regarding the activity of individual users. CSN does, however, reserve the right to do so in order to maintain a functioning network. (For example, CSN may extract logs if an automated IT security systems report displayed that a user’s computer/account is infected or compromised.)

Other: CSN reserves the right to restrict the use of or permanently disconnect any wireless device from the campus network if that wireless device or wireless access point disrupts or interferes with services provided by CSN, or behaves in such a way that the service or security of IT Resources is impacted.

Any departments requiring wireless service in contravention of this standard when CSN’s wired network option is not feasible must file the formal Security Policy/Procedure Exception Form with the Chief Information Officer and their Vice President prior to use of wireless service in contravention of this standard.

1. Scope and Purpose

   NSHE adopted on July 1, 2016, a comprehensive Records Retention and Disposition Schedule (“Schedule”) that was developed specifically to address the universities’ and colleges’ particularized records, documents, etc. The Schedule can be found in the Regent’s Procedures and Guidelines Manual, Chapter 18.

   The retention and destruction of all messages, documents, records, etc. at CSN should follow the Schedule. Many or most of such messages, documents, or records now are electronically created and maintained; the Schedule applies to both paper and electronic versions.

   All CSN email account holders, and CSN network personal (“H”- drive) and shared departmental file storage (“J”-drive) account holders must understand how CSN is applying the Schedule as it applies to the mechanics of the retention and backup of CSN emails and files, records, documents, etc. stored on the CSN network drive and email server infrastructure.

   NSHE’s Schedule specifically addresses the management and retention of emails. In part, it notes:

   “What is Email? Email is not a record type, but is a means of conveying information similar to the United States Postal Service. Its retention is based upon the content of the email message, not the fact that it is an email message.

   An email (electronic mail) message is comprised of the following components:

   • textual message
   • metadata (To, From, Subject, Time, Date, System, etc.)
   • attachments

   Each component is part of the record or non-record, as the case may be. In many instances, email has taken over the role of “general correspondence” and memoranda, as well as the telephone message. If an email message meets the criteria of a record, it must be managed in accordance with the Schedule.

   Email Management: The key to effectively managing email is to get rid of the non-records and any transient/transitory records that have outlived their administrative/legal/fiscal value as quick as possible so that one is left with only those e-mails that need to be managed on an on-going basis. One should approach the management of email in a manner similar to how they handle processing their "snail mail" at work and home:

   • Open the email and review the document’s content; this may mean thoroughly reading the document, but more often than not, one is able to judge just by a cursory look at the document, the subject line, and/or the sender to determine whether:
   • It is a non-record and should be deleted immediately, just as one would discard the “snail mail” non-record into the trash can or recycle bin.
   • It is a transient/transitory record which should be disposed of as soon as the information is no longer of administrative, legal or fiscal value. One might create a “Transient/Transitory” folder or create sub-folders of record type/series or projects for the transient/transitory messages.
   • It is a record and therefore, should be placed in an appropriate folder by record type/series, project, retention time, or other filing schema that works for one’s office/organization and allows that unit to effectively manage the life cycle of the record.”

   Each CSN account user must manage their email and electronic file storage so that they are efficient tools which do not place an undue burden on the finite capacity of computer system resources, while complying with the Schedule. Retention and storage of emails and other files are costly and must be undertaken in order to take advantage of system capabilities in a cost effective manner.

2. Electronic Storage

   1. E-mail

      Email communications are an integral part of communications that occur at CSN. As noted in the Schedule, emails are in some ways similar to paper mail that must be sorted and managed, and in other ways closer attention must be paid to avoid large quantities of emails simply building up. Some emails comprise information that the user will want or be required to maintain for a lengthy period of time, and many emails are the opposite and once read can be discarded.

      E-mail is not a storage system, it is a communication tool. As such, CSN cannot provide an email system that has unlimited capacity and we must use the available capacity in a prudent manner to be efficient in our job performance. In addition, it is imperative that records kept pursuant to the Schedule be appropriately stored. E-mail for all users will be backed up daily. E-mails will be available for a period of seven years after which they will be permanently deleted, on a continuous basis, with no opportunity for recovery. This applies to both active and inactive e-mail accounts and backups.

      Any e-mail attachments related to official communications that must be saved can be saved to the user’s CSN “H” network drive for storage beyond seven (7) years.

      Whenever a user completely deletes e-mails from their mailbox, they can be recovered for fourteen (14) days. After fourteen (14) days, the deleted e-mails will not be recoverable.

   2. File Systems

      Network storage space is provided for the storage of files, records, documents, messages, etc. that are related to CSN business. Each CSN computer user is typically assigned access to both an individual storage drive, “H” drive, and a departmental shared drive, “J” drive. The “H” drive is for the employee’s work files and the “J” drive is for the storage of shared work-group files. Records that must be kept pursuant to the Schedule will be appropriately stored in “J” drives, not “H” drives.

      To ensure there is adequate storage space for each employee, the “H: drive” has been allotted a storage max size of ten (10) gigabytes for faculty and staff, only after the on-line (on Cloud) storage of at least 1-Terrabyte per individual is provided. This storage may not be used for personal movies, music, games, photos, etc. Nor should the storage be used for copyrighted materials without proper permission or licenses as this is a violation of federal law.

      “H” drive folders are backed up on a daily basis. The backups of “H” files will be purged after two (2) years, on a continuous basis. This means that deleted files will be unrecoverable after a two (2) year period.

      “J” drive folders are backed up on a daily basis. “J” drives will not be purged or overwritten on any set schedule. The “J” drive should be used to store department related records, documents, files, messages, etc. in compliance with the Schedule. However, destruction dates should be added to or noted on files so that after the appropriate retention period has passed, they can be discarded and not build up over decades utilizing storage capacity unnecessarily.

      In order to provide CSN faculty and staff with a tool for sharing files, CSN will provide access to cloud storage. Storage of any PII, credit card or other financial information is not permitted. The data in cloud storage will not be backed up so deleting a file permanently deletes the data with no opportunity for recovery. In addition, users should be aware that CSN can legally access everything uploaded to this cloud storage in the case of wrongdoing or computer misconduct as determined by CSN.

   3. Exiting Employees

      Employee email accounts will be closed upon separation from active employment. As of the separation date, the employee will no longer have any access to their e-mail account, their “H” drive, all “J” drives, OneDrive or any backups of any data. It is the responsibility of the exiting employee’s manager to inform the Department of Human Resources prior to the employee’s exit date, if the e-mail account for the exiting employee is to be forwarded to a supervisor, or retained for a maximum of thirty days (unless a longer period of retention is authorized by the relevant Vice President). Human Resources personnel will then notify the Office of Technology Services of the request. If notification is not given when the employee’s network account is closed, only the e-mail will be stored according to the Schedule.

   4. Inactive Employees

      An employee who has not logged into the system for five (5) months will have their accounts disabled. After twelve (12) months of inactivity, these accounts will be purged. Departments must notify the Office of technology if an employee will be out on sabbatical or inactive for a period longer than four (4) months.

3. Litigation Holds

   When litigation is pending or threatened against CSN or its employees, court rules impose a duty upon CSN to preserve all documents and records that pertain to the issues. It is the responsibility of employees who have actual knowledge of matters in which it can be reasonably anticipated that a court action will be filed, a subpoena has been served or notice of same has been given, or records are sought pursuant to an audit, a government investigation or in similar circumstances to attempt to preserve CSN records, including emails or instant messages.

   Employees should consider that all e-mail entering or leaving the CSN messaging system will be captured and subject to litigation based research without consideration of the subject or if the message is personal in nature.

   A ‘litigation hold’ directive overrides the Schedule, as well as any other records retention schedules that may have otherwise called for the transfer, disposal or destruction of relevant documents, until the hold has been cleared by written directive.