IT Regulations and Acceptable Use Policy

1. Introduction and Purpose

Who is this for? 

Everyone who uses the University of Sunderland’s Computers, Systems, and/or Network services.

What is expected?

Know the rules

Understand the relevant Law, so you do not break it.

Abide by University Regulations, Policies, and Guidance.

Observe the regulations of any third parties whose facilities you access.

We want to give you the best information and guidance available, to keep you, and the University safe and informed on how to use the systems you have access to.

 

3. Policy Summary

Access to the University’s IT systems and services is granted only to specific, authorised people. Users of these systems and services must abide by the conditions set out in IT Regulations and Guidance notes to this policy for acceptable and unacceptable use.

For security and network maintenance purposes, any or all use of the University IT systems and all data held within them may be intercepted, monitored, recorded, copied, audited, inspected, and disclosed to authorised University officials, authorised third parties and law enforcement personnel as part of their duties. The University of Sunderland reserves the right to audit, fault-find, and maintain networks and systems, and the information held on them, on a periodic basis.

The University operates web filtering on all University networks. As a result, some web pages may be unavailable to users without pre-agreed permissions.

User activity log information will be retained, and may be used for purposes, including, but not limited to:

• Network monitoring
• Cyber security
• Operational management
• Safeguarding
• As a requirement of the PREVENT duty

The logged information includes:

• Firewall traffic and website access logs
• Details of the user identity (where available)
• Source and destination IP addresses
• The type of traffic
• Intrusion prevention information
• Website classification

In the event of a user’s account credentials being found to be used for malicious purposes or after repeated failed attempts to access systems, those credentials may be reset, in order to protect the data, information and systems normally accessed by using the credentials.

Postings by employees from a University of Sunderland email address to newsgroups and/or social media should contain a disclaimer stating that “the opinions expressed are strictly their own and not necessarily those of the University of Sunderland”, unless posting is in the course of business duties.

All computing equipment connected to the University of Sunderland IT systems, whether owned by an employee, student or the University of Sunderland, must be continually executing approved virus-scanning software with a current virus database, and set to be patched automatically, unless specifically authorised otherwise in writing from the University’s Technical Director.

5. Questions to ask yourself concerning good judgement

Is it important for me to comment?

• Exercise good judgment regarding the reasonableness of posts and comments you make online towards other people. If you are not comfortable being the subject of a similar comment, do not comment in that way about others.
• Exercise good judgment regarding the reasonableness of comments you make about the university, its staff and other people, to prevent attracting accusations of harassment or defamation. Do not make unreasonable comments about activity, people or behaviours. Treat others with dignity and respect.

Could my comment be misconstrued or offence be taken from what I have said?

 Is it appropriate for me to comment publically?

• People may not have exercised good judgement online and sometimes it may be better to not respond, allowing the dust to settle and not jumping to conclusions. It may be more prudent to check understanding by speaking with an individual in person, or by phone rather than posting online. You may be able resolve matters without leaving an online footprint for anyone to review in years to come.
• Documents and comments stored online are retained, copied and redistributed, making them practically impossible to be removed. They can be referenced within the media and potentially within law courts or employment tribunals.
• When a Subject Access Request is received, the University could be asked for “all correspondence relating to subject x,y,z”, which will result in a review of all relevant content and communication trails. The discovered material will be released to the requester, even if users have not previously used good judgement on that occasion).

 Am I comfortable for my postings to be officially discovered in the future?

 Am I happy for my on-line content to reach those I didn’t intend?

• Facebook, Instagram and other services are excellent sources for people wanting to find out about you. Such content is likely to be accessed by people it was not meant for and they will form judgements about you based on your posted activity. Past Facebook images, LinkedIn comments and twitter posts may well be taken into consideration by hiring managers when recruiting potential employees. It’s very easy to search for a name on-line during a CV review and decide to avoid a person based on past postings and old images. You cannot control online search engines.
• Employees and students must not open e-mail attachments received from unknown senders, unless they are certain that the content of the attachment is not malicious. Employees and students must avoid clicking on links or content which they suspect may contain viruses, because they are from an unknown source, or from a known source but with an unexpected label, or are of an unexpected or unusual nature.
• If you suspect an email is spam and feel it should be reported, please forward it to spam@sunderland.ac.uk and cyber@sunderland.ac.uk, then delete the message. If you believe it is necessary, or are in doubt, raise a service request via the UIT Service Desk on extension 3333 or via the IT Portal at https://itportal.sunderland.ac.uk.

 Am I diligent enough before clicking to access something?

 The Student Handbook has advice and guidance for students on use of social media, available at https://my.sunderland.ac.uk/  

7. Definitions

7.1. Policy

A set of policies, principles, rules, and guidelines formulated or adopted by an organisation to reach its long-term goals, easily readable and widely accessible.

7.2. Network

A computer network is a group of connected systems and devices that are linked together to facilitate communication and resource sharing among users of the network.

7.3. Guidance Note

A document allowing further explanation and communication to Users and Staff, about the method of implementation of policies and procedures, the roles, processes, and accountability associated with a particular policy, to aid transparency and understanding of how it is implemented within the organisation. 

Provided to Users for information, to enable them to be better informed about how policies translate into operation and which safeguards in place.

7.4. Appendices to IT Regulations

A document allowing further explanation and communication to Users and Staff, about the full IT Regulations, specifying what is and is not Acceptable Use in different circumstances.