University of Tennessee at Chattanooga Acceptable Use Practices (AUP)
Responsibilities
Each departmental unit is responsible for the security on their systems and for any networks managed by the departmental unit. Any departmental unit may apply more stringent security policies than those detailed herein while connected to UTC Technology Resources. However, departments must follow these principles as a minimum or risk losing connectivity to UTC networks.
The central directory designated by ITAC is the primary authoritative source for authentication and authorization of access to information on individuals associated with UTC. All applications requiring authentication and authorization of information should whenever technically possible, obtain said information from the central directory.
ITAC is responsible for identifying a campus Information Security Officer (ISO) who will coordinate and facilitate the campus information security program with collaboration from the UTC Computer Security Committee. This program will include but not be limited to the following.
- Development and implementation of information security policies, standards, controls, procedures, and practices as defined in UT Fiscal Policy No. FI0805: Use of Information Technology Resources in order to protect UTC IT resources.
- Development of a security awareness and training program for users, system administrators, and designated security officers.
- Establishment of a central repository for recording, tracking, and resolving security-related incidents through collaboration with responsible organizations.
- Recommendations for cost-effective security solutions for unit/departmental systems, network administrators, and designated security officers.
- Establishment of UTC’s Best Practices Guidelines for Information Technology Resource Use to include but not limited to:
- User accountability requirements, e.g., user identification and authentication, account administration, and password integrity;
- Public access restrictions and limitations;
- Authorized access;
- System and data integrity;
- Auditing;
- File backup and recovery;
- Disaster recovery;
- Malicious code protection;
- Configuration security;
- Guest account guidelines;
- Unattended equipment; and
- Incident reporting and response.
