Skip to main content

Acceptable Use of Computers and Networks Policy

Policy Number:
ISO-700
Effective Date:
May 7, 2019
Last Revised Date:
December 1, 2021
Last Reviewed Date:
October 8, 2026
Applies To:
Classified Staff, Appointed Personnel, University Staff, Students
Responsible Unit(s):
Information Security Office
Responsible Unit Email(s):
security@arizona.edu
Status:
Active

Purpose and Summary

This Policy establishes requirements for the secure, ethical, lawful, and acceptable use of University Information Resources, owned, operated, or managed by or on behalf of the University of Arizona (University).

Each User of the University Information Systems (including subsystems) as well as other workstations, devices, network infrastructure, and other information technology owned or operated by or on behalf of the University is responsible for their activity. 

Scope

This Policy applies to all University-Related Persons, as well as all Information Systems and Information Resources owned or operated by or on behalf of the University. 

Definitions

Information Resources means University Information and related resources, such as equipment, devices, software, and other information technology.

Information System means a major application or general support system for storing, processing, or transmitting University Information. An Information System may contain multiple subsystems. Subsystems typically fall under the same management authority as the parent Information System. Additionally, an Information System and its constituent subsystems generally have the same function or mission objective, essentially the same operating characteristics, the same security needs, and reside in the same general operating environment.

System Administrator means a User with a level of access above that of a normal User, or with supervisory responsibility for Information Systems and Information Resources. Examples of System Administrators include, but are not limited to, a Database Administrator, a Network Administrator, a Central Administrator, a superuser, or any other privileged User.

Unit means any college, school, department, program, or other operating Unit.

University Information means any communication or representation of knowledge, such as facts, data, or opinions, recorded in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual, owned or controlled by or on behalf of the University.

University-Related Persons means any University students and applicants for admission, University employees and applicants for employment, Designated Campus Colleagues (DCCs), alumni, retirees, temporary employees of agencies who are assigned to work for the University, and third-party contractors engaged by the University and their agents and employees.

User means any individual or group that interacts with a system or benefits from a system during its utilization.

Policy

  1. All Classifications of University Information
    1. Each User must:
      1. ​Take no actions that violate the University Code of Conduct, Code of Academic Integrity, Human Resources policies, Information Security Policies, or other applicable law, regulation, Arizona Board of Regents (“ABOR”) policy, or University policy.
        1. ​​As with other conduct as a University-Related Person, a User’s use of Information Resources is subject to all applicable law and University policies. In the event of a conflict between policies or other legal obligations, the obligation imposing the more restrictive use shall govern.
        2. Using University computer or network resources in violation of policy or for illegal activity is strictly prohibited. Prohibited uses may include, but are not limited to, harassment and intimidation of individuals in violation of the University Nondiscrimination and Anti-Harassment Policy, obscenity, child pornography, threats, or theft. Examples of misuse also include attempting to gain unauthorized access to data, attempting to breach security measures on any electronic communications software or system, attempting to intercept electronic communication transmissions without proper authority, and violating intellectual property or defamation laws. Do not use computer or network resources to send, post, or display slanderous or defamatory messages, text, graphics, or images.
        3. Each User accepts the responsibility to become informed about and to comply with all applicable laws and policies.​
      2. ​Follow established security controls that protect information, data, and systems.
        1. Examples of such security controls include, but are not limited to, handling University Information in accordance with requirements documented in the University Information Handling Standard and ensuring that default passwords are changed using strong password methodologies, as defined in the University Password Standard.
        2. Examples of failure to follow such security measures include, but are not limited to, using a computer account or password that a User is not authorized to use, using the campus network to exceed authorized access to a University computer system or any other computer system, and using network protocol analyzers or other tools to attempt to breach the confidentiality of data or passwords.
      3. Clearly and accurately identify oneself in electronic communications.
        1. Examples of violations include forging or misrepresenting one’s identity, or altering or concealing the source of electronic communications, such as creating or editing an email to make it appear as if the message was sent by someone else.
      4. Use computer and network resources efficiently.
        1. Users may use University computer and network resources for incidental personal purposes, provided that such use does not unreasonably interfere with the use of computing and network resources by other Users, or with the University operation of computing and network resources, interfere with the User's employment or other obligations to the University, or violate this policy or other applicable policy or law. Examples of inappropriate use include sending unsolicited email to large numbers of people to promote products or services, and engaging in unauthorized peer-to-peer file sharing.
        2. The University retains the right to set priorities on use of its computer and network resources and to limit recreational or personal uses when such uses could reasonably be expected to cause strain, directly or indirectly, on any computing facilities; to interfere with research, instructional, or administrative computing requirements; or to violate applicable policies or laws.
      5. Ensure that the use of computer resources and networks is oriented toward the academic and other missions of the University.
        1. ​Use of the User’s computer account or the network for profit or commercial gain, except as permitted under applicable University policies, is prohibited. Examples include use of a University computer account to engage in consulting services, software development for private profit, advertising products/services, crypto-currency mining, and/or other commercial profit-based endeavors.
      6. Respect copyright and intellectual property rights.
        1. Users must adhere to copyright laws, the University Intellectual Property Policy, and the terms and conditions of any applicable agreements (whether for software licensing, database licensing, or otherwise) entered into by the University. Any form of original expression fixed in a tangible medium is subject to copyright, even if there is no copyright notice. Examples include music, movies, graphics, text, photographs, artwork, and software, distributed in any medium, including online. The use of a copyrighted work (such as copying, downloading, file sharing, distribution, public performance, etc.) requires either the copyright owner's permission, or an exemption under the Copyright Act. The law also makes it unlawful to circumvent technological measures used by copyright owners to protect their works.
      7. Respect the integrity of the University computing and network resources.
        1. Misuse of University computing and network resources includes, but is not limited to, stealing or damaging equipment or software, attempting to circumvent installed data protection methods that are designed and constructed to provide secure data and information, attempting to interfere with the physical computer network or related hardware, or attempting to degrade the performance or integrity of any campus network or computer system.
      8. Respect individual privacy and confidentiality.
        1. Those who have access to personal information stored on or transmitted through University computing and network resources must respect individual privacy and confidentiality, consistent with applicable laws and University policies regarding the collection, use, and disclosure of personal information. All use of any such information must comply with the University Privacy Statement and other applicable Unit Privacy Notices issued pursuant to the University Electronic Privacy Policy.
        2. Users should consult the University Privacy Statement for information on how their personal information may be handled by the University.
        3. Users with access to University Information beyond what is generally available (e.g., system, network, and database administrators, among others) may only use such access in a way consistent with applicable laws, University policies, and accepted standards of professional conduct, including as set forth in the Acceptable Use for System Administrators Policy.
      9. Respect and adhere to other departmental/college/Internet Service Provider's acceptable use policies.
        1. When using a University computer system or network to connect to a non-University system or network, Users must adhere to the prevailing policies governing that system or network. However, this does not in any way reduce or release the obligation to abide by this and other policies governing the use of University computer systems and networks.
      10. Allow System Administrators or other authorized individuals to perform routine maintenance and operations, security reviews, and respond to emergency scenarios.
    2. Each University-Related Person who accesses the University Information Resources through a University-provided NetID is required to read and acknowledge a summary of this Policy and related requirements both as a condition of obtaining a NetID and again annually, at minimum. Additionally, a summary of this Policy and related requirements is required to be displayed to, and agreed to by, Users prior to accessing University Information Resources when no NetID login is required.
  2. Tracking, Measuring, and Reporting
    1. The Information Security Office must develop, test, review, maintain, and communicate a representation of the University’s information security practices to University leadership.
    2. The Information Security Office is authorized to track compliance of this Policy and produce reports of compliance measures to support University decision making.
    3. Academic and administrative Unit leaders are responsible for implementing and ensuring compliance with this Policy within their respective areas.
      1. Upon request, academic and administrative Unit leaders are responsible for providing the Information Security Office with information necessary to assess and report on compliance. 
      2. Specific responsibilities may be delegated to designees; however, overall accountability for University Information Resources, information security risk, and compliance remains with academic and administrative Unit leaders.
  3. Recourse for Noncompliance
    1. The Information Security Office is authorized to limit network access for individuals or Units not in compliance with all University information security policies and related procedures. 
    2. In cases where University resources are actively threatened, the Chief Information Security Officer must act in the best interest of the University by securing the resources in a manner consistent with the Information Security Incident Response Plan. 
      1. In an urgent situation requiring immediate action, the Chief Information Security Officer is authorized to disconnect affected individuals or Units from the network. 
    3. In cases where University-Related Persons violate this Policy, the University may apply appropriate employee sanctions or administrative actions, in accordance with relevant administrative, academic, and employment policies. 
  4. Exceptions
    1. Any requests for exceptions to any information security policies must be submitted to the Chief Information Security Officer for review and approval pursuant to the Information Security Office Policy Exception Request Procedure.
  5. Frequency of Policy Review
    1. The Chief Information Security Officer must review information security policies and procedures at least annually. This Policy may be revised based on these reviews.

 

Policy Feedback

For questions or comments regarding a particular policy or to notify us of broken links or typographical errors, please provide this information below.

To report violations of a policy, please notify the Responsible Unit.

Please Note: Policy feedback is available to the Policy Office, Policy Sponsor, and elected shared governance representatives, upon request, for policies impacting the populations they represent.

This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.