Digital Technologies Acceptable Use Procedures

Intent

This Procedure has been established to provide clear guidelines for the responsible and secure use of the University's Digital Technologies. It outlines the responsibilities of all stakeholders, the process for reporting potential Breaches, and the steps for mitigating such Breaches, and supports the University's mission to maintain a secure and productive Digital Environment.

Scope

This policy applies to all Authorised Users of JCU’s Digital Technologies including:

(a) JCU Australian Tropical Campuses;

(b) JCU controlled entities;

(c) JCU Singapore;

(d) JCU Brisbane;

regardless of location, whether during or after business hours or whether on JCU-owned or privately owned devices.

Definitions

The meanings of definitions used in this Procedure are as per Digital Technologies Acceptable Use Policy.

Introduction

This Procedure provides role-specific guidance for the use of Digital Technologies at the University and outlines responsibilities for specific roles as necessary.

Individuals may hold multiple roles, and the Procedure provides clear directives for each role to ensure accountability and transparency. Adherence to this procedure is not just about compliance, but also an ethical responsibility to maintain the integrity and security of the University's Digital Infrastructure.

By following this procedure, JCU can create and maintain a robust and secure Digital Environment.

Procedure

1. Authorised Users Responsibilities

1.1 Read, understand and adhere to the Digital Technologies Acceptable Use Policy and Procedure, in particular consequences of breaches.

1.2 Seek clarification from Technology Solutions Directorate if any part of the policy or procedure is unclear.

1.3 Stay updated by reading the communications and notifications (i.e. IT Bulletins, Info Bytes) for any changes or updates to Digital Technologies and/or the policy and procedure.

1.4 Review content on the Secure IT website and Cyber Security Hub periodically to ensure understanding and compliance.

1.5 Report any actual or perceived Security Incidents or Breaches by logging a job in ServiceNow.

1.6 Cooperate with the Technology Solutions Directorate and provide relevant information in the case of any Security Incident.

1.7 Ensure Digital Technology Assets comply with security updates, virus and malware scans, and encryption protocols as managed by the Technology Solutions Directorate.

1.8 Adhere to data management requirements and ensure all University-owned information is regularly backed up and disposed of in accordance with the University's Records Management Policy and associated procedures.

1.9 Adhere to all University and vendor licensing agreements when installing and using software.

1.10 Support sustainability by implementing power management programs, reducing energy consumption of devices when in use and connected to JCU’s power supply.

1.11 Support the University in establishing a secure and efficient digital ecosystem, ensuring that Limited Personal Use of Digital Resources is reasonable and not excessive, and refraining from engaging in any Unacceptable use activities.

1.12 Upon encountering inappropriate material not related to work duties, take the most appropriate and immediate action to delete material and/or cease such access. Notify Technology Solutions via Service Now if inappropriate material continues to be received.

2. Technology Solutions Directorate (TS) Responsibilities

2.1 Regularly monitor and review system logs to detect any Breaches or Unauthorised activities.

2.2 Monitor usage of Digital Resources to ensure compliance.

2.3 Respond promptly to reports of lost, stolen, or damaged University-owned equipment.

2.4 Respond to all reported Breaches or Security Incidents, taking immediate action to mitigate risks.

2.5 Conduct a preliminary investigation into reported Breaches, for serious Breaches consult with CISO, consulting with (or deferring to, as necessary) relevant internal stakeholders including the CISO, Chief Digital Officer, Deputy Vice Chancellor, Services & Resources, Chief of Staff, and the Director, Human Resources among others.

2.6 Notify relevant stakeholders of the outcome of a Breach investigation, including required solutions for managing risks and determining costs.

2.7 Respond to all requests to access records relating to Digital Resources from authorised University representatives.

2.8 Regularly review and update security measures to protect services and Data and Information Assets from Unauthorised access, Vulnerabilities, wilful damage, and virus infection.

2.9 Ensure University-owned information is regularly backed up and disposed of in accordance with the University’s Records Management Policy and associated procedures.

3. Chief Information Security Officer (CISO) Responsibilities

3.1 Collaborate with the Technology Solutions Directorate to assess and mitigate risks associated with the Digital Environment.

3.2 Identify potential threats to the University's Digital Technology assets and develop strategies to maintain a secure and reliable Digital Environment.

3.3 Implement Physical Security measures to prevent Unauthorised access to Digital Infrastructure. This includes using secure cables and locking rooms and cabinets when not in use.

3.4 Lead the investigation and handling of serious Security Incidents and or Breaches, and liaise with appropriate stakeholder/s to determine the most appropriate consequences and disciplinary actions in accordance with relevant policies and procedures.

3.5 Provide updates to the Chief Digital Officer and other relevant stakeholders regarding the outcomes of Breaches and the necessary solutions, potentially reporting to external authorities as necessary.

3.6 Ensure alignment of the Digital Technologies Acceptable Use Policy and Procedure with the University's broader strategic objectives and priorities, communicating regularly with senior leadership.

3.7 Advise on cybersecurity trends, potential threats and security measures to be considered by the University.

3.8 Report alleged breaches of the Digital Technologies Acceptable Use Policy to the Chief Digital Officer in a timely and accurate manner.

4. Chief Digital Officer (CDO) Responsibilities

4.1 Collaborate with the CISO to evaluate and mitigate risks associated with the Digital Technologies Acceptable Use Policy.

4.2 Regularly review and respond to requests to access records relating to Digital Resources from the University General Counsel and designated authorities.

4.3 Regularly communicate with senior leadership and other stakeholders to ensure the Digital Technologies Acceptable Use Policy aligns with broader strategic objectives.

4.4 Work with the CISO to identify potential threats to the University's Digital Technology assets and recommend strategies for maintaining a secure and reliable Digital Environment.

4.5 Approve suspensions or restrictions to access in case of a serious breach, particularly in cases of inadvertent Unacceptable use.

4.6 Provide appropriate stakeholders with updates regarding the outcomes of Breaches and necessary solutions related to i.e., risk management, training and awareness, and cost determination.

5. Manager Responsibilities

5.1 Ensure that their team members and Students understand their obligations under the Digital Technologies Acceptable Use Policy.

5.2 Regularly communicate to their team the importance of energy management and sustainability in the use of Digital Resources.

5.3 Monitor Digital Communication Systems (i.e., IT bulletins, InfoBytes) and share relevant updates with their team.

5.4 Support the investigation of incidents, Breaches or suspected policy breaches in their areas.

5.5 Review and update access of Digital Technology assets for Authorised Users during onboarding, transfers or departures.

5.6 Determine appropriate consequences of Breach(es) as per the Digital Technologies Acceptable Use Policy, except where alternative policies or the JCU Enterprise Agreement delegate this authority to an alternative decision maker, considering the nature of the Breach and ensuring inadvertent Unacceptable use is treated differently from intentional Breaches.

6. Business Owners

6.1 Train staff and users on the Digital Technologies Acceptable Use policy and enforce policy compliance.

6.2 Manage access controls and implement security measures for the Digital Technology Assets under purview.

6.3 Oversee the use of Digital Technology Assets to ensure compliance with the Digital Technologies Acceptable Use Policy and take proactive steps to prevent Unauthorised access or modification.

6.4 Regularly check that the data stored, transmitted, or processed on the Digital Technology Asset is regularly backed up, secure, and can be recovered quickly in case of a system failure.

6.5 Monitor Physical Security access to the Digital Technology Asset. Implement secure cables, lock rooms, and cabinets as needed.

6.6 Report potential/actual Security Incidents or Breaches.

6.7 Maintain the confidentiality of Personal Information and ensure Multi-Factor Authentication is supported by the Digital Technology Asset provider.

7. Third Party Service Providers Responsibilities

7.1 Ensure that the third-party service provided is in accordance with the Digital Technologies Acceptable Use Policy.

7.2 Cooperate with the University's Technology Solutions Division and other stakeholders in investigating any potential or security Breaches involving their services.

7.3 Maintain a high level of security and Data Protection in their services, complying with University standards and regulations.

7.4 Regularly update the University on any potential risks or improvements related to the services provided.

7.5 Report potential/actual Security Incidents or Breaches to the Business Owner.

7.6 Regularly check that the data stored, transmitted, or processed on the Digital Technology Asset is regularly backed up, secure, and can be recovered quickly in case of a system failure.

7.7 Report to the University about any potential risks or improvements related to sustainability or energy management.

Related policy instruments

Digital Technologies Acceptable Use Policy

Academic Misconduct Procedure

Adaptive Workplace Policy

Blended Learning Policy

Code of Conduct

Code of Conduct – University Council

Copyright Policy and Procedure

Coursework Academia Integrity Procedure

Cybersecurity Policy

Data Governance Policy

Environmental Policy

Fraud and Corruption Procedure

ICT Access and Account Management Procedures

Information Privacy Policy

Intellectual Property Policy and Procedure

James Cook University Enterprise Agreement 2022

LearnJCU Data Management Procedure

Managing and Investigating Potential Breaches of the JCU Code for the Responsible Conduct of Research Procedure

Personal Information Data Breach Procedure

Public Interest Disclosure Procedure

Records Management Policy

Remote Working Policy

Risk Management Policy

Security Policy

Social Media Policy

Space Allocation and Management Policy

Student Code of Conduct Policy

Student Digital Experience Policy

Student General Misconduct Procedure

Student Professional Misconduct Procedure

Schedules/Appendices

Nil

Administration

NOTE: Printed copies of this policy are uncontrolled, and currency can only be assured at the time of printing.

Approval Details

Revision History

Keywords