Reviewed/Revised: November 13, 2023

The Policy:

Persons having the following affiliation(s) with Columbia-Greene Community College are eligible to access and use College information technology resources:

1. Current academic appointees and staff,
2. Currently accepted students,
3. Certain persons affiliated with external agencies collaborating with Columbia-Greene Community College,
4. Members of the surrounding communities.

The scope of access and use will vary in accordance with the affiliation and may change from time to time. The College establishes procedures for verifying the eligibility of persons seeking to access and use College information technology resources. Eligibility to use College technology resources shall cease when the person no longer has an affiliation that supports eligibility. Procedures also describe the scope of access and use granted to persons with particular affiliations.

The eligibility of all individuals will be tested automatically and periodically against official College sources, including employee, faculty, and student enrollment records. Other sources may be used where these records do not accurately reflect ongoing affiliation.

The privilege of initial and continued eligibility to use College information technology resources by persons external to Columbia-Greene Community College requires initial and periodic verification by the appropriate department, faculty member or administrator that sponsored for the access to College resources.

Any individual seeking to access internal College resources through a VPN must either use a college owned device or if using a personal device, they must have installed the college’s security stack at their own personal cost.

Procedures

Faculty and Staff:

1. Full-time and part-time academic appointees, appointed staff, and hourly employees are eligible to use technology resources until the termination of their employment or appointment with the College. Eligibility will be based on information supplied by the Human Resources office.
2. The Human Resources office is responsible for keeping official College personnel records updated to reflect new and departed personnel, including adjunct faculty. This record will be used to determine account and resource access.
3. An employee’s access to his or her accounts will be disabled after official College records indicate his/her employment has ceased (indicated by the Human Resources office).
4. Employee accounts will remain in the database in accordance with the Computer and Network Accounts Administration policy.

Students:

1. Students (both traditional and off site) are eligible to use information technology resources for the duration of their enrollment. Eligibility is based on information supplied by the registrar’s office.
2. Continued eligibility is automatic for enrolled students, and enrollment status is based on official College records.
3. Student accounts will remain in the database in accordance with the Computer and Network Accounts Administration policy.

Persons affiliated with external entities collaborating with Columbia-Greene Community College

1. Contract employees are eligible to use technology resources for the duration of their contract, with written certification of need from the relevant Columbia-Greene Community College unit contract manager. Access to Columbia-Greene Community College technology resources will only be granted if deemed necessary to fulfill the purpose of the contract. The required technology needs and limits thereon will be specifically defined in the associated contract. Contract managers can submit a request to add an affiliate account by submitting a request through the Human Resources Department. Periodic renewal by the contract manager is required, and accounts will be removed at the termination of the activity.
2. Persons associated with external entities that have a contract or other collaboration with Columbia-Greene Community College are eligible to use technology resources for the duration of their contract or collaboration.  Written certification is required identifying the need of access from a full-time Columbia-Greene Community College faculty or staff member located in the unit that is most closely associated with the activity, and only if such access is necessary to fulfill the purposes of the contract or collaboration. The required technology access and limits thereon will be specifically defined in the associated contract. Unit sponsors can submit a request to add an affiliate account by submitting a request through the Human Resources Department. Periodic renewal by the sponsor is required, and accounts will be removed at the termination of the activity.
3. Others involved in short-term (less than one semester) temporary projects may be eligible to use technology resources, if such access is necessary to fulfill the purposes of the project, and with written certification from the Human Resources Office. Final review and approval of eligibility for such use is reserved to the Chief Information Officer. Renewals are not automatically granted, and accounts will be removed at the termination of the activity.
4. Account sponsor responsibilities: Sponsors should weigh the risks of an affiliated user causing harm through inappropriate use of Columbia-Greene Community College’s information technology resources against the benefits of the user having access. Sponsors are responsible for taking steps to reduce the likelihood of inappropriate use (including appropriate user training). Additionally, prior to requesting the account, the sponsor is required to discuss the request with their immediate supervisor and receive approval through the appropriate cabinet member.  A written agreement defining the terms between the College and the affiliated user must be in place prior to account creation and/or assignment.  Sponsors should consult with their department head and the Vice President for Administration and/or the Director of Human Resources on how best to document the user’s affiliation with and responsibilities to both Columbia-Greene Community College and the sponsor’s department.

Limited Access 

The College may also provide limited access accounts/services for specialized purposes, such as for potential students, conference attendees, or visitors requiring only access to the Internet from their personal computers, tablets or cell phones.

Suspension or Termination of Access

System administrators, network engineers and support technicians may temporarily suspend or block access to an account when it reasonably appears necessary to protect the integrity, security, and functionality of the College or other computing resources, or to protect the College from liability.

Access to College technology resources may be removed immediately given a written request from the Vice President for Administration and/or the Director of Human Resources. Reasons for removal may include, but are not limited to, the following: 1) the individual is terminated for cause and there is concern for safety of systems or data; or 2) there is reasonable belief that the individual to whom the account is assigned has perpetrated or is involved in illegal activities or activities that violate College policy. Before removing access for staff or faculty who are also students, the department will consult with the Vice President for Administration and the Provost.

The technician responsible for a particular service may disable access unilaterally if processes in an assigned account are causing or reasonably appear likely to cause damage to systems or data or serious service degradation for other users. Except when prohibited by law, inappropriate, or impractical, the support technician will notify the involved individual prior to disabling the computer account. Where prior notification is not permitted, appropriate, or practical, the support technician will make all efforts to notify the involved individual afterward in a timely manner. Unless other policies are invoked, access will be restored as soon as possible after the removal of the threat.

Reviewed/Revised: November 13, 2023

1. The Policy:
   Identity and eligibility to use Columbia-Greene Community College technology resources will be authenticated for all users. Level of identification and authentication will be commensurate with the capabilities and sensitivity of the specific resources they are using.
   Each eligible individual obtaining an account will have a College-wide unique username assigned that has been created from a standard format.
   Usernames will not be changed unless the individual’s name changes in the official College database and the individual personally requests such a change, or in cases where there might be personal danger to the individual if they have a commonly derived username. Changes will also be allowed where the combinations of characters’ result in an objectionable name or term. Vanity username changes will not be permitted.
   To ensure optimal use of resources and to address security concerns, accounts databases will be kept clean. That is, published eligibility criteria will be consistently applied, testing procedures will be applied at required intervals, and appropriate account removal and archiving tasks will be performed as required.
   All accounts will be directly assigned to single individuals based on eligibility rules, and those individuals will be the sole contact and have sole responsibility for all actions taken with and in that account.
   Account holders who leave their accounts active and unattended will be deemed in violation of College policy. They may also be held accountable if others use their unattended account for more serious infractions.
   Passwords are set by individuals through using the self-service portal. Passwords will meet the following requirements:
   1. Multifactor authentication (MFA) will be used with all user accounts in conjunction with all password requirements.
   2. The same passwords cannot be reused after a password reset.
   3. After several failed login/password attempt, the User ID will be locked.
   Agents of Columbia-Greene Community College will not ask for or require a user to give them their password or MFA authentication codes for any reason. Only the account owner will know the password for computer accounts assigned to them. Circumstances under which Support Specialists or System Administrators can learn or obtain the user’s assigned password must be minimal.
   “Group” accounts (i.e. shared mailboxes) will be created only in support of activities directly associated with Columbia-Greene Community College functions. A current full-time faculty or appointed staff member must identify himself or herself as the person responsible for management of and use of the account. When requesting or renewing the account, this “sponsor” will provide information stating their relationship to the group, outlining the group’s membership and affiliation/benefit to Columbia-Greene Community College, and an indication that they understand their responsibilities related to the use of the group account.
   Accounts may be assigned to individuals not employed by Columbia-Greene Community College only in support of activities directly associated with Columbia-Greene Community College functions. A current full-time faculty or appointed staff member must identify himself or herself as the sponsor or contact related to the individual’s activities while they are at the College. When requesting or renewing the account, this “sponsor” will provide information stating their relationship to the individual, outlining the individual’s affiliation/benefit to Columbia-Greene Community College, and an indication that they understand their responsibilities related to the use of the individual account. Generic accounts are not allowed, requiring all users to log on to a college owned computer using network credentials.
   The Human Resources Department will make the initial determination regarding eligibility of an individual to receive a Columbia-Greene Community College account. Cases where eligibility is unclear will be passed to the Chief Information Officer, Server Administrator or to the Director of Information Technology for review and approval.
   The IT department will retain all files and email related to computer system accounts (including the account itself) while the account is active and for up to 3 months following the point at which the employee is no longer associated with Columbia-Greene Community College and/or at the discretion of executive leadership. Required data associated with the account will be made available to the account sponsor, after receiving approval from the Executive Leadership team, until the account has been removed from the system databases. Student accounts (including email) are maintained for up to 3 months upon departure from the college.
2. Procedures
   In partnership with the Information Technology department and other naming functions and stakeholders, the Chief Information Officer will coordinate accounts administration procedures.

Reviewed/Revised: November 13, 2023

1. The Policy:
   The use of Columbia-Greene Community College’s technology resources is restricted to purposes related to the college’s mission of inspiring its community and creating lifelong learners. Access to the College’s technology resources is provided so that users have access to resources that support their studies, instruction, duties as employees, and other college-sanctioned activities. Individuals may not share with or provide to others their college accounts, including network IDs or passwords.
   The College’s technology resources may not be used in a manner that violates the law, for private commercial activities that are not approved by the college, for personal private gain, or for political campaigning and similar activities that are inconsistent with the college’s tax-exempt status.
   Incidental personal use is an accepted benefit of being associated with Columbia-Greene Community College. Incidental personal use must adhere to all applicable college policies. Under no circumstances may incidental personal use involve violations of the law, interfere with the fulfillment of an employee’s college responsibilities, or adversely impact or conflict with activities supporting the mission of the college.
   An employee’s supervisor may require the employee to cease or limit any incidental personal use that hampers job performance or violates college policy. The College’s Information Technology department will always place a higher priority on support of college-related activities over any form of incidental personal use.
2. Definitions:
   • Commercial activities
     are defined as economic activities geared toward a mass or specialized market and ordinarily intended to result in a profit and that are not part of one’s college responsibilities. Commercial activities do not include the use of technology resources for one-time, minimal transactions, such as students using their Columbia-Greene Community College email accounts to communicate with potential buyers for used textbooks. This type of transaction is considered incidental personal use.
   • Incidental personal use
     is the use of technology resources by members of the Columbia-Greene Community College community in support of activities that do not relate to their college employment or studies or to other activities involving and approved by the College.  Examples include use of email to send personal messages to friends, family, or colleagues, as well as including messages relating to one-time minimal sales or purchase transactions. Personal use should be limited and not adversely affect or conflict with college operations or activities and should not be used for mass emailing.
   • Technology resources
     includes all college-owned computers, peripherals, and related equipment and software; voice communications infrastructure, peripherals, and related equipment and software; data communications infrastructure including email, peripherals, and related equipment and software; all other associated tools, instruments, and facilities; and the services that make use of any of these technology resources. The components may be individually controlled (i.e., assigned to an employee) or shared in a single-user or multi-user manner; they may be stand-alone or networked; and they may be stationary or mobile.
   • Personal private gain
     is defined as securing profit or reward for an individual in his or her personal capacity that is not otherwise permitted by this policy.
   • Political campaigning and similar activities that are inconsistent with the college’s tax-exempt status
     include campaign purposes that would further the interests of the candidate or candidates of any one political party.
3. Sanctions
   Columbia-Greene Community College will handle reports of misuse and abuse of information and technology resources in accordance with existing policies and procedures issued by appropriate authorities. Depending on the individual and circumstances involved this could include the Vice President for Administration, Provost, and/or appropriate law enforcement agencies. See policy Misuse and Abuse of Technology Resources for more detail.
   Failure to comply with Columbia-Greene Community College’s information technology policies may result in sanctions relating to the individual’s use of technology resources (such as suspension or termination of access, or removal of online material); the individual’s employment (up to and including immediate termination of employment in accordance with applicable college policy and/or collective bargaining agreements); the individual’s studies within the college (such as student discipline in accordance with applicable college policy); civil or criminal liability; or any combination of these.