Proposed NetID Access to University Information Technology Resources Policy

[Approved by the Data Oversight Committee on 12/13/07. Revision approved May 21, 2008. The policy is awaiting ratification by the Officers. The University is currently operating under this policy pending ratification.]

This policy is a component of a larger overall strategy for Identity Management (IDM), a program to deal with identifying individuals affiliated with the University in various ways, and controlling their access to University resources and services by associating individual rights and restrictions with their established identity. Two components are integral to managing access to Notre Dame’s information technology resources. Authentication is the means of verifying the identity of an individual. Authorization determines what an authenticated user is allowed to do or have access to.

A NetID plus a password is the primary authentication mechanism at the University. Possession of a NetID should not, in and of itself, authorize its owner to do, or have access to, any specific service. When Notre Dame’s IDM program is complete, we will be able to grant access to information technology resources on a service-by-service basis.

Policy Statement

The University of Notre Dame grants access to University-owned information technology resources by issuing NetIDs to members of the Notre Dame community, persons affiliated with the University, and external consultants under contract. An individual will normally be assigned one personal NetID, and it will never be reassigned or transferred to another individual. A University department, organization or student group may request a NetID to use for e-mail not specific to an individual employee, or to establish a web site or NetFile shared file space for department/organization use, or for various other reasons such as vendor support.

Individuals eligible for NetIDs include:

• Regular and non-regular faculty;
• Postdoctoral scholars (“post-docs”);
• Full-time, part-time and temporary on-call staff;
• Currently enrolled students, and prospective students who are admitted and confirmed;
• Graduated students, for a limited period of time following graduation;
• Retired faculty and staff as provided in the Notre Dame Faculty & Administrator Plan, the Staff Employee Pension Plan and the Academic Articles;
• Members of the Congregation of Holy Cross who are directly engaged with the University;
• Sponsored consultants;
• Employees or members of specific institutions or programs affiliated or collaborating with the University.

Unless they also belong to one of the foregoing groups, alumni of the University are not eligible for NetIDs.

The University will issue a department/organization NetID upon formal written request from an active faculty or staff member on behalf of a department or organization with whom s/he is affiliated. Two active faculty and/or staff members must be responsible owners of department/organization accounts. A registered student organization can also obtain a departmental NetID by working through the Student Activities Office and completing the appropriate form.

The University will determine the level of authorized access, based on role, status or other criteria. Scope of NetID access varies with the affiliation, and may change. Responsible University officials will reevaluate their sponsored affiliates annually to ensure that they remain eligible.

Reason for the Policy

The University of Notre Dame provides information technology resources to employees, students, and other affiliates for activities related to its mission of teaching and learning, research, and service. The University has an interest in conserving scarce resources and limiting access to individuals and entities who are actively involved in supporting the institutional mission and goals.

Scope

This policy applies to all users of information technology resources owned and provided by the University of Notre Dame.

Who Should Read This Policy

Individuals or departments of the University who are in a position to authorize access to University-owned information technology resources.

Reference Documents

Academic Articles
Department/Organization Account Request
Department/Organizational Account Ownership Change Form
Immediate Computer Access Suspension Request
Information Security Incident Response Policy (link)
Information Security Policy (link)
NetID & E-mail Address Changes Standard (link)
Non-Employee NetID Request Form
Password Reset Procedures (link)
Pay Periods (link)
Request for Finance Data Access
Responsible Use of Information Technology Policy (link)
Strong Password Standard (link)

Contacts

Policy Clarification:
Office of the Chief Information Officer, OIT, Phone: (574) 631-5936, E-mail: cio@nd.edu

Account Creation:
Help Desk, OIT (574) 631-8111 oithelp@nd.edu

Definitions

Account
The credentials to access services or resources available on University computer(s) or network(s).

Account Suspension
The state of an account when the owner is denied access to the account under certain circumstances. Essentially, the account is disabled.

Administrative Systems
Enterprise software applications used in the operation of the University’s business functions, such as human resources, payroll, financial management, business operations, and procurement.

Affiliation
An individual’s or entity’s relationship to the University. Primary affiliates are faculty, staff, and students.

Authenticate
Verify that an individual is who he/she claims to be, often by use of a NetID and password.

Authorize
Verify that a specific individual is allowed to access specific computing resource(s) or service(s).

Data Steward
An individual who is responsible for ensuring the accuracy, integrity, and confidentiality of University data. A data steward defines access to and restrictions on use of the data for which he or she is responsible.

Disable
Remove all access by the account holder, while keeping the resources intact. Authentication is disabled; the account holder cannot log in to any services or resources. However, a disabled account may (for example) continue to receive email sent to it. The time period an account is disabled may vary depending on policy for each type of affiliation.

Faculty

• Regular Faculty
  • Teaching and Research Faculty
  • Research Faculty
  • Library Faculty
  • Special Professional Faculty
• Nonregular Faculty
  • Visitor
  • Adjunct
  • Concurrent
  • Guest
  • Emeritus/Emerita
  • Lecturer

Grace Period
A designated period of time after employment or affiliation ceases, during which all resources and access persist. The time period may vary depending on policy for each type of affiliation. During the grace period, the University sends email reminding the account holder of impending loss of access.

Inactive
An inactive account is no longer accessible by any user for any purpose, including directory entry or receipt of email, although the associated account resources may be intact.

Information Technology Resources
Applications, computer systems, servers, networks and related devices owned by or entrusted to the University.

ndID
A 9 digit unique number assigned to faculty, staff and students, shown on the back of older Notre Dame ID cards, or on the front of newer cards. Instructions for finding an ndID are at http://oit.nd.edu/passwords/ndid.shtml.

NetID
A unique identifier that, used with a password, provides access to technology resources.

Non-Employee NetID Request Form
The form used to request a NetID for an individual who is not eligible for a faculty, staff or student account. This form must specify the “start date” and “stop date” for the access, carry a sponsor’s signature, and be completed in its entirety.

NONND/Affiliate
An individual who is not faculty, staff, or student, but for purposes of eligibility has an affiliated status with the University. Examples may include, but are not limited to:

• Retired faculty
• Retired staff or administrator
• Some members of the Congregation of Holy Cross
• Consultant retained under contract with the University.
• Employee of an institution or program affiliated or collaborating with the University.

Responsibilities

Business Managers

• Complete and submit appropriate forms to Data Steward to obtain approval for faculty and staff to access administrative systems

Data Stewards

• Review and approve the application for administrative systems access, and notify the OIT

Department Head/Dean

• Authorize access to technology resources for affiliates
• Annually review the need for affiliate access

Office of Human Resources

• Approves access to administrative systems for staff
• Approves non-employee NetID requests

Office of Information Technology

• Disables and inactivates accounts

Office of the Provost

• Approves access to administrative systems for faculty

Registrar’s Office

• Approves account creation for students, in conjunction with the appropriate admissions offices and First Year of Studies
• Authorizes disabling accounts of confirmed, admitted students who do not register for classes

Sponsors

• Complete and submit a Non-Employee NetID Request Form to request access to technology resources for affiliates
• Annually review the need for affiliate access

Procedures

Faculty and Staff Access

• Regular and non-regular faculty, post-docs, full-time, part time and temporary/on-call staff are eligible to use technology resources until the termination of their employment or appointment with the University. Eligibility is based on information supplied by the Office of Human Resources or the Office of the Provost.
• The University automatically generates NetIDs when the correct and completed paperwork is delivered to the Office of the Provost (for faculty) or the Office of Human Resources (for staff), and that information is added to the appropriate administrative systems.
• New faculty and staff acquire and activate their NetIDs and set passwords online by visiting https://accounts.nd.edu/activation, providing their ndID and birth date, and reading and agreeing to the Responsible Use of Information Technologies policy.
• Continued eligibility is automatic and is based on official university records.
• Campus units are responsible for ensuring that official university personnel records reflect new hires, terminated personnel, and changes in personnel status or position, to synchronize with the applicable monthly, semi-monthly and bi-weekly pay periods.
• Faculty members have a grace period of 60 days following the end of employment, after which the University will disable access to their accounts.
• Staff members have a grace period of 30 days following the end of employment, after which the University will disable access to their accounts.
• Faculty and staff accounts may become inactive 15 days after the accounts are disabled. 15 days after inactivation, the account’s resources are removed. Retention of account data depends on policy for the account type.

Faculty and Staff Administrative Systems Access

• Access to administrative systems is granted on a case-by-case basis as required by an individual’s professional responsibilities.
• Persons needing access to University administrative data work through their campus unit’s Business Manager, who completes the appropriate forms and sends them to the relevant Data Steward for approval.
• The Data Steward reviews and approves the application for access and notifies the OIT, where technical personnel make required entries to the administrative systems’ authorization mechanisms.
• Campus units are responsible for ensuring that official university personnel records reflect new hires, terminated personnel, and changes in personnel status or position, to synchronize with the applicable monthly, semi-monthly and bi-weekly pay periods.
• The University will disable access to administrative systems (for example, HR/Payroll, Finance, BuyND) immediately upon termination of employment for all faculty and staff.

Students’ Access

• Undergraduate, graduate, and non-degree students are eligible to use information technology resources while they are in active status. Eligibility is based on information supplied by the University Registrar.
• The University automatically generates student accounts when the student record appears in the Student Information System.
• New students acquire and activate their NetIDs and set passwords online by visiting https://accounts.nd.edu/activation, providing their ndID and birth date, and reading and agreeing to the Responsible Use of Information Technologies policy.
• Continued eligibility is automatic for active students, and active status is based on official University records.
• Generally, the University disables access to a student’s account 60 days after he/she is graduated, or 60 days after official university records indicate the student is no longer eligible.
• A student account will become inactive 15 days after the account is disabled. 15 days after inactivation, the account’s resources are removed. Retention of account data depends on policy for this type of account.

Retirees’ Access

• Retirees may continue to use electronic resources as defined by the Notre Dame Faculty & Administrator Plan, the Staff Employee Pension Plan, and the Academic Articles.

Other Affiliates’ Access

• Any Congregation of Holy Cross member may obtain an account by making a request to Human Resources via the Indiana or Midwest Province.
• Persons associated with external entities that collaborate with the University may be eligible to use technology resources for the duration of their contract, with written compelling justification of need from the relevant campus unit sponsor. The sponsor submits the request to add an affiliate account by completing and submitting a Non-Employee NetID Request Form to Human Resources. The appropriate University Department Head/Dean must also authorize the individual’s access. Annually, the campus unit sponsor must review, and the University Department Head/Dean must reauthorize the individual’s access. The campus unit sponsor must immediately notify Human Resources when the activity is concluded. The University will immediately disable and inactivate the account at the conclusion of the activity; account data will be removed at the University’s discretion.

Departments and Organizations

• Two active faculty or staff members complete and sign a Department/Organization Account Request Form, available at: http://oit.nd.edu/helpdesk/forms.shtml and in the Reference Documents section of this page.
• Deliver or FAX the completed form to the OIT Help Desk. The Help Desk will notify the account requestor when the account is activated, after which the requestor will reset the account password.
• Department/organization accounts are subject to annual account review and removal.
• The OIT reserves the right to review any request for a department/organization NetID and suggest alternatives when appropriate.

A form to change the owner of a department/organization account is at http://oit.nd.edu/helpdesk/forms.shtml and in the Reference Documents section of this page.

Student Groups

The Student Activities Office handles request for NetIDs for registered student groups as follows:

• Direct all inquires related to student group accounts to the Student Activities Office (574-631-7308).
• The Student Activities Office verifies that the requesting group is registered with the office.
• The group completes a Student Activities version of an account creation form, and the Student Activities Office authorizes it and sends to it to the OIT for processing.
• The OIT creates the account and sends the account information (NetID and password) to the Student Activities Office.
• Student Activities distributes the information to the requesting student group.

Immediate Suspension

• Complete the Immediate Computer Access Suspension Request Form and have it signed by the appropriate University official.
• Deliver or FAX the form to the OIT Help Desk for action.

Password Expiration and Account Removal

• The owner of any Notre Dame NetID — including those for departments, organizations, or student groups — must change the account password at least every 180 days. Beginning 30 days before a password expires, the NetID owner will receive repeated e-mail reminders to change the password.
• If the password for a department/organization NetID expires, the University allows a 30-day grace period, during which the account owner will receive e-mail warnings of the impending loss of the NetID. The University will disable the NetID at the end of the 30-day grace period.
• The owner of a department/organization NetID may request removal of the account at any time by contacting the OIT Help Desk.

Policy Enforcement

The University reserves the right to suspend or block access to an account when the University deems it necessary.
The University reserves the right to reduce or extend the grace period(s) at its sole discretion.

Exceptions

Exceptions to the stated grace periods are granted by the appropriate area(s) of responsibility (e.g., Student Affairs, Office of the Provost, Office of Human Resources). The relevant granting authority keeps a list of such exceptions.