BYU IT STANDARDS

Ensure university communications are sent in a secure manner through university-provided email accounts, received in campus email mailboxes, and protected by required email delivery and security controls.

Protect university passwords and authentication processes to reduce the risk of unauthorized access to university IT Resources, systems, data, and services.

These procedures establish the steps to be taken when a faculty or staff member retires to ensure a secure, compliant, and orderly transition of university technology resources. The procedures protect institutional data, uphold record retention requirements, and clarify post-retirement access to hardware, software, and services.

Ensure university-owned workstations use actively patched and supported operating systems and software, are patched monthly, and run required endpoint protection software.

Protect university systems, data, and resources by addressing identified risks to the integrity of systems and applications.

Minimize the overall risk of using Service Accounts, which generally have greater access to IT systems and resources and may pose a higher risk to the University.

The purpose of this document is to establish a clear process for transitioning applications developed by campus units to OIT when the originating team can no longer provide support, or when the originating team is transitioning to OIT. This ensures that applications critical to university operations continue to be supported, maintained, replaced or transitioned appropriately. (Note that in some cases a unit may request support that OIT is unable to provide. If this happens the requesting unit will be given an evaluation of the health of the application, and recommendations for next steps.)

This addendum adds to the IT Standards for Workstations. Its purpose is to ensure university-owned workstations deployed to Office of Information Technology (OIT) employees use actively patched and supported operating systems and software, are patched monthly, and run required endpoint protection software.