UTSI Acceptable Use Policy
IT0110-SI – Acceptable Use of Information Technology Resources
This policy governs the use of the university’s information technology resources in an atmosphere that encourages the free exchange of ideas and an unwavering commitment to academic freedom.
Information and Computer System Classification Plan
IT0115-SI – Information and Computer System Classification Plan
To establish a formal, documented plan for classifying business-critical information and computer systems.
Secure Network Infrastructure Program
IT0120-SI – Secure Network Infrastructure Program
To establish a formal, documented program for the creation and maintenance of a secure network infrastructure.
Information Security Program
IT0121-SI – Information Security Program
To establish a formal, documented program that describes the development and maintenance of security plans.
Security Incident Reporting and Response
IT0122-SI –Security Incident Reporting and Response
To develop a program for computer Security Incident Reporting and Response at the University of
Tennessee Space Institute (UTSI) that aligns with System-wide policy IT0122.
Security Awareness, Training, and Education Program
IT0123-SI – Security Awareness, Training, and Education Program
To establish a formal, documented Security Awareness, Training, and Education Program for University
information systems users, and facilitate appropriate training controls.
Risk Assessment Plan
IT0124-SI – Risk Assessment Plan
To establish a formal, documented plan to ensure the implementation of appropriate and effective Risk Assessment (RA) controls for information systems that host or contain sensitive University data.
Configuration Management Plan
IT0125-SI – Configuration Management Plan
To establish a formal, documented plan that describes the implementation of appropriate and effective Configuration Management (CM) controls for business-critical systems (CM-9). This plan establishes guidelines for baseline configurations and defines the change control process for managing configuration changes.
Audit and Accountability Plan
IT0127-SI – Audit and Accountability Plan
To establish a formal, documented plan for managing risk and implementing best practices with regard to the creation and retention of audit evidence.
IT0128-SI –Contingency Planning
Per System-Wide policy IT0128, the University of Tennessee Space Institute (UTSI) is tasked with establishing a Contingency Planning (CP) policy for managing the risk of information asset failures and service disruptions. The CP program is intended to address security best practices with regard to business continuity and disaster recovery.
Physical and Environmental Protection
IT0129-SI – Physical and Environmental Protection
To develop a procedure for Physical and Environmental Protection at the University of Tennessee Space
Institute (UTSI) that aligns with System-wide policy IT0129 and the National Institute of Standards and
Technology (NIST) 800 publication series.
IT0130-SI – Personnel Security
To establish a procedure for developing and maintaining a Personnel Security Program at the University of Tennessee Space Institute (UTSI) to ensure individuals granted access to systems and data are vetted in order to maintain information security objectives.
Security Assessment and Authorization Plan
IT0131-SI – Security Assessment and Authorization Plan
To establish a formal, documented program to manage the confidentiality, integrity, and availability of business-critical information systems at UTSI by assessing security controls.
Identification and Authentication Plan
IT0132-SI – Identification and Authentication Plan
To establish formal, documented identification and authentication plan for managing risk from user access and authentication into business-critical information systems and to provide the minimum requirements to control that risk.
Security Planning Program
IT0133-SI – Security Planning Program
To establish a formal, documented program to ensure that Security Plans providing an overview of security requirements and the controls to address those requirements are in place for critical information systems.
System and Communication Protection Program
IT0134-SI – System and Communication Protection Plan
To establish a formal, documented system and communication protection program to ensure compliance with requirements established by the University.
System and Information Integrity Program
IT0135-SI – System and Information Integrity Program
To establish a program for developing and maintaining a Systems & Information Integrity program to ensure compliance with minimally acceptable system configuration requirements.
UTSI Password Standard
IT1002-SI – Password Standard
This standard contains requirements and recommendations for all system passwords, including servers, workstations, and network devices, for UTSI. Each user and/or administrator is required to implement the system password definitions listed in this document.
Software Licensing and Copyright Law
S0125 – Software Licensing and Copyright Law
Prohibits unauthorized reproduction of copyrighted computer software. Software licenses required.
Higher Education Opportunity Act- Peer to Peer File Sharing
S0336 – Higher Education Opportunity Act- Peer to Peer File Sharing
Requires an annual disclosure to students that (1) states that unauthorized distribution of copyrighted material, such as through peer-to-peer networks, may subject students to civil and criminal penalties, (2) describes the penalties for such violations, and (3) includes the institution’s policies on peer-to-peer file sharing. Institutions must also develop a plan to combat unauthorized distribution of copyrighted material.
TN State Law of Personal Information Breach
S0370 – TN State Law of Personal Information Breach
Any information holder shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of Tennessee whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made in the most expedient time possible and without unreasonable delay. If over 1,000, must disclose to credit bureaus.
TN State Unsolicited Bulk Electronic Mail
S0371 – TN State Unsolicited Bulk Electronic Mail
It is an offense for a person without authority to falsify or forge electronic mail transmission information or other routing information in any manner in connection with the transmission of unsolicited bulk electronic mail through or into the computer network of an electronic mail service provider or its subscribers.
TN State Credit Security Act of 2007
S0372 – TN State Credit Security Act of 2007
Must make a reasonable effort to protect social security numbers from disclosure to the public. Social security numbers shall not: 1) be posted or displayed in public; 2) be required to be transmitted over the Internet, unless the Internet connection used is secure or the social security number is encrypted; 3) be required to log onto or access an Internet website, unless used in combination with a password or other authentication device; or 4) Be printed on any materials mailed to a consumer, unless such disclosure is required by law, or the document is a form or application.
Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
S0373 – Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
The bill permits e-mail marketers to send unsolicited commercial e-mail as long as it adheres to 3 basic types of compliance: 1) unsubscribe compliance; 2) content compliance; and 3) sending behavior compliance.
Electronic Communications Privacy Act of 1986
S0420 – Electronic Communications Privacy Act of 1986
This law protects communications from government surveillance. However, employers who own the computer system used by their employees have the right to monitor employees’ e-mail. Employee consent is a defense to liability under the ECPA intercept provision. Employees should either consent to or be put on notice that it is university policy that any information, stored, processed, or transmitted on university IT resources (including telephone) may be intercepted.
The Digital Millennium Copyright Act of 1998 (DMCA)
S0428 – The Digital Millennium Copyright Act of 1998 (DMCA)
The Digital Millennium Copyright Act (DMCA) addresses copyright law in the digitally networked environment. The Act brings U.S. law into line with the World Intellectual Property Organization (WIPO) and limits the liability for monetary damages with respect to copyright infringement for an Online Service Provider (OSP). In order to be eligible for the exemption from liability, the OSP must do the following:
• adopt and implement a policy that provides for termination of computer privileges of users who are repeat infringes;
• accommodate and not interfere with standard technical measures used by copyright owners to identify and protect copyrighted works; and
• designate an agent for notification of claimed infringement by providing contact information to the Copyright Office and through the OSP’s publicly accessible Web site.