3.1.1 Employee Acceptable-Use Policy and Procedures (AUP)

1.     PURPOSE AND SCOPE

This policy addresses issues related to the access and use of Craven Community College's (CCC's) computer and information systems, telecommunications infrastructure including the Internet, intranet, extranet, e-mail, voicemail, facsimile (fax) transmissions, computer networks, servers, desktops, hardware, and software (TS resources).  It applies to all faculty and staff, including without limitation, full-time and part-time employees, contractors, adjunct faculty, and full-time faculty.  It promotes employee productivity and safety, and recognizes that technology alone cannot provide adequate assurance against external or internal threats to CCC's resources and assets.  This policy requires the combination of well-informed and trained employees applying diligence, judgment, and the best available technology to achieve its purpose.

The policy's key objectives are to (a) maintain a non-hostile workplace environment; (b) prevent sexual, racial, and other forms of prohibited discrimination, copyright infringement, software piracy, and any other misuses of CCC's resources; (c) protect CCC against computer crimes, viruses, worms, hackers, hoaxes, cyber pranks, denial of service attacks (DoS), cyber terrorist threats, and other civil wrongs or criminal offenses; (d) protect proprietary CCC information, employee and customer data, and other protected or privileged material; (e) restrict use of CCC Technology Services (TS) resources to authorized users for legitimate CCC purposes; and (f) maintain a productive workplace environment while using CCC's TS resources.

This policy is intended to clearly describe enforcement and compliance procedures, potential penalties, and expectations with regard to employee privileges and responsibilities while using CCC's TS resources.

2.     POLICY

CCC's TS resources are the property of the State of North Carolina and are subject to regulation by the State.  The TS resources are to be used only by authorized users.  For the purposes of this policy, authorized users are those individuals officially associated with CCC, including CCC employees or other individuals authorized in writing by the CCC Chief Information Officer (CIO).  Use of TS resources by anyone other than authorized users, including spouses, partners, children, or other family members, is not permitted at any time.

3.     PERSONAL USE

Personal use of CCC's TS resources is permitted if such use does not interfere with the performance of work responsibilities and meets the following conditions:

a.   The use does not overload the CCC's computing equipment or systems, or otherwise negatively impact the system's performance.  Prohibited personal use includes, but is not limited to, large e-mail files (exceeding 15MB), streaming audio, streaming video, Internet gaming (playing games over the Internet), and downloading or installing software.

b.   The use does not result in commercial gain or private profit, except as allowed under CCC's intellectual property policies and the external activities for pay policy. However, in no case may CCC's TS resources be used for spam generation, unsolicited direct marketing, mass mailing, or other solicitation of external activity for pay that the CCC President determines is detrimental to CCC's mission or operation.

c.   The use does not violate any CCC licensing agreements or any law or CCC policy on copyrights, trademarks, and patents. 

d.   The use does not state or imply CCC sponsorship or endorsement.

e.   The use does not violate laws or CCC policies prohibiting (i) discrimination based on race, sex, religion, disability, age, or other protected class, and (ii) other forms of prohibited discrimination and harassment.

f.    The use does not involve unauthorized passwords or identifying data that attempts to circumvent system security or in any way attempts to gain unauthorized access to TS resources or any data residing on the IT resources.

g.   The use does not involve sending or soliciting chain letters, nor does it involve sending unsolicited bulk mail messages (e.g., "junk mail," or "spam," or "MLM.").

h.   The use does not result in any direct cost to CCC.

i.    Instant messaging programs may not be used for personal use.

4.     OFFICIAL BUSINESS USE

All CCC's TS resources are to be used primarily for College business and in compliance with all applicable laws.  Limited personal use is allowed only pursuant to this AUP.

Network capacity is a scarce resource.  Excessive consumption by any one user will degrade the performance of the entire network for all other users.  As such, all highly resource-intensive activities (e.g., large file transfers exceeding 250MB, streaming audio/video, Internet gaming) are prohibited without express authorization granted using the CCC's AUP Exception Request process.  Large files being sent by e-mail (exceeding 30MB) should be compressed; otherwise, they are in danger of being rejected by the mail server.

The creation or transmission of any offensive, obscene, or indecent images, data, or other material is not permitted.

NOTE:  Any employee or other person using CCC's TS resources does so subject to CCC's right to monitor such use.   Users are subject to appropriate legal action for criminal activities conducted through or with the CCC TS resources.  Employees have no right to privacy in anything they create, store, send, or receive on CCC's TS resources.

NOTE:  Users must comply with the CCC Public Records Policy and applicable law while using CCC TS resources.

5.     PROVISIONS AND PROHIBITIONS

Users are responsible for ensuring the accuracy of distribution lists and that messages and information are transmitted only to the intended recipients and those who have a business or educational need to receive them.

College employees are responsible for ensuring that all devices (e.g. memory cards, CD drives, laptop computers, etc.) that any of their invited guests connect to Craven's network are scanned. Notification must be given to the TS department, and an appointment must be made two business days before the person attaches the device to Craven's network for the TS department to scan the device. The appointment for the scan must be scheduled at a minimum of two hours before the guest is to attach the device to the network.  Employees must complete a form to request the device be scanned and approved for attachment to the college's network.

CCC recommends that users check e-mail daily, delete unwanted messages, and keep remaining messages on the server to a minimum.  The maximum allowable space available for mail server storage will be defined as no more than 20MB per user.  In most cases, messages should be deleted after one month, when they may be archived to offline storage. 

CCC's TS resources are not to be used for unauthorized political, commercial, or religious activity, including seeking employment outside CCC.

Employees must not use CCC's TS resources to communicate via e-mail, message boards, or other online forums anonymously or while using a false name, pseudonym, or a username that does not clearly and accurately identify the user.  Masquerading as someone else by using their e-mail or Internet address or electronic signature is prohibited.

Users are to comply with all applicable intellectual property and licensing rights of software and Web content manufacturers at all times.  Unauthorized duplication, installation, or use of copyrighted materials, including software, images, text, presentations, etc., is expressly prohibited.

Installation of unauthorized software is prohibited without the express written consent of the CIO in conjunction with the CCC President. 

Users must scan all files and other material copied or downloaded from the Internet or non-CCC computers, diskettes, or networks for viruses and other destructive programs before being accessed or saved on CCC's TS resources.

All authorized updates to CCC provided software, including vendor-supplied patches, virus definition updates, etc., are to be applied according to TS department instructions. 

Use of CCC's TS resources for hacking, cracking, bugging, virus, or self-replicating program distribution, and unauthorized access to or tampering with College, government, or other personal and private data is prohibited.

Falsely representing your position or job responsibilities to obtain information or access to CCC's TS resources is prohibited.

Users must not transmit or store CCC's confidential information using CCC's TS resources without appropriately protecting it.  Any unauthorized posting, transmittal, or dissemination of CCC classified information via an insecure electronic method is prohibited.  To the extent allowed by the North Carolina Public Records Act, classified information includes, but is not limited to information such as student educational records, personnel information, financial information, and health and insurance records.  

Users must not export software, technical information, encryption software, or technology in violation of United States export control laws.

Users are to access the Internet only through the approved college's Internet Firewall.  Accessing the Internet directly, by modem, is prohibited unless (a) the accessing computer is not physically connected to CCC's TS resources and (b) the user has received written authorizations from the TS department for any connection outside of the CCC network.  This includes, for example, handheld PDA's, laptop computers or any other wireless or wired devices.  Electronic devices of any kind, not strictly controlled by CCC, will not be allowed to connect to the CCC network without written authorization from the TS department.

Only authorized employees are allowed to access CCC's network remotely.  Remote access is only allowed from computers with an up-to-date, properly configured, and functioning firewall with virus protection.  Security precautions must be taken whenever logging into the CCC network, including the protection of passwords and data pertaining to CCC.  Such transactions must be encrypted or confined to private networks.

6.     COMPLIANCE

CCC may choose to monitor or review all use of its TS resources, including but not limited to:

• e-mail sent and received,
• Internet usage,
• computer files, documents, and faxes created, stored, deleted, or distributed, or
• any files that contain images, text, video, or audio for content installed software for licensing.

Be aware that all computer activities create audit trails.  Deleted, edited, and overwritten computer files often cannot be erased or may be recovered using computer forensics techniques.

Users must not (i) view another user's e-mail without permission; (ii) send, create, or receive e-mail or other information or material under another user's name; or (iii) tamper with, reveal, or change another user's password.

Users are to report any violation of this AUP to one of the following individuals:

• CCC Chief Information Officer Dr. P. D. Scott,  (252) 6...,  scottp@cravencc.edu
• CCC Executive Vice-President Dr. Cindy Hess,  (252) 6..., hessc@cravencc.edu or
• CCC President Dr. Catherine Chew,  (252) 638-7201 , chewc@cravencc.edu 

CCC makes no warranties of any kind, either expressed or implied, related to the personal use of TS resources.  CCC is not responsible for the loss of personal data.  Users assume responsibility for any damages suffered as a result of unauthorized or misused information, data, or software obtained through TS resources.  The user agrees to indemnify and hold harmless CCC, its Board of Trustees, and its employees from and against any claim, lawsuit, cause of action, damage judgment, loss, expense, or liability resulting from any claim, including reasonable attorneys' fees, arising out of or related to the misuse or personal use of CCC's TS resources.  This indemnity shall include, without limitation, those claims based on trademark or service mark infringement, trade name infringement, copyright infringement, defamation, unlawful discrimination or harassment, rights of publicity, and invasion of privacy.

Any use of CCC's TS resources that is not in strict compliance with this AUP can result in disciplinary action including suspension of access to TS resources, termination, and legal action.

The AUP and any implementing procedures may be amended or revised as necessary by CCC.

STATEMENT OF ACKNOWLEDGEMENT OF THE AUP

This signifies that I have read and understand the AUP.  I agree to comply with all of its terms and conditions.  My signed acknowledgement is to be kept in my Personnel File.

User's Name (Print):                                         Date:                              

User's Signature:                                                                                  

REFUSAL TO ACKNOWLEDGE OR AGREE TO THE CONDITIONS OF AUP

By signing below, I signify my refusal to acknowledge or agree to the conditions of AUP. 

User's Name (Print):                                          Date:                             

User's Signature:                                                                                   

Amended by CCC Board of Trustees April 18, 2006

Approved by CCC Board of Trustees February 21, 2006