08:17:00 Computer Access
- Chattanooga State Community College relies heavily on its electronic data processing systems and the data stored in them to meet its educational, informational and operational needs. College students and staff rely on the security of the computer systems to protect instructional, research, personal, operational and other sensitive data maintained in those computer systems. It is essential that these systems be protected from misuse and that both the computer systems and the data stored in them are accessed and maintained in a secure environment.
- The standards described herein are those that CHSCC Computer Services intends to use in the normal operation of providing access to its computing systems. This document does not waive any claim that the College may have to ownership or control of any hardware, software, or data created on, stored on, or transmitted through College computing systems. Network requirements and standards are covered in another CHSCC policy.
- This policy functions as data and computing standards and provides instructions for requesting initial computer access and computer set-ups for new employees. The policy specifies how to initially request access to confidential/private Banner data, and provides a step-by-step breakdown of the current process. The policy establishes access review between data owner and Computer Center to ensure access is limited to only those individuals requiring access to perform their job duties. This policy also specifies electronic mail initial set-up, storage limits, and archival of email (non-record.)
- The scope of this policy includes all College staff, faculty, adjuncts, contractors, vendors and visitors that require access to computing resources or College data. Access for all Banner data requiring special access permissions is also covered in this policy. Email set-up, storage and archival is for staff and faculty. Adjuncts will be handled on a case by case basis.
New Employee Set-Up and Access Requirements:
- There are two separate types of access a new employee might need to perform their job. They include the basic computer set-up and special access set-up. Both types can be requested through the same process described below.
Basic Computer Set-up:
- Basic computer set-up includes: access to Exchange - CHSCC's email system, Self-Service Banner, standard desktop computer set-up, and/or any required IT equipment, i.e. desktop, laptop, and/or phones.
- To request basic computer set-up, supervisors should submit their request via the On-Line Work Order System (located on TigerWeb) as soon as possible, before the employee reports for work.
- Along with the work order, all new employees must have an Administrative Computer Access Request Form on file in the Computer Center. This completed form, signed by both supervisor and employee, is required by the Computer Center before any access can be granted.
- This form also contains the FERPA signature form required by TBR guidelines.
- Supervisors should plan on 1 - 5 business days to have complete computer set-up (desktop, phone, access, etc.) depending on requirements and 1 - 2 business days if requesting just computer access, once the completed form is received by the Computer Center. This form is available within the on-line work order system. Please see "Computer Access Request" link on TigerWeb for detailed instructions.
- Enterprise Vault is ChSCC's message archive system. This system is in place to reduce overall email storage requirements and to provide back-up capability of emails for a specific timeframe. Enterprise Vault or "EV" is not to be considered the college's record storage system. Emails stored within EV are not being deleted on a specific record retention schedule based on TBR Guideline G-70, Disposal of Records.
- Initial Set-up - all staff and faculty are set up with the same standard service. Email will be automatically stored in two separate systems for specific timeframes:
- Initially, email is stored on MicroSoft Outlook. Emails within the user's "Inbox", "Sent Items" and user folders within Outlook will be stored for a period of 60 days. "Deleted Items" folder will be automatically deleted every 30 days.
- At the end of that 60 day period, email will be automatically moved to Enterprise Vault (EV) for archival. Email will be stored in the EV system for a period of 1 year, at which time it will be automatically deleted. Once the emails are deleted from EV, they cannot be restored.
- Users will be able to delete emails at any time during the initial Outlook 60 day period. However, once the email is moved to Enterprise Vault, emails cannot be deleted from the system. This is to help ensure legal discovery requirements are in place.
- Vice President's and above will be set up within Enterprise Vault on a never delete status. That means any email that is 60 days old will be moved to EV on a never delete status. If there are other jobs that might require a "never delete" status for emails, employees need to fill out a CS work order along with the Request for Non-Standard Email Archival form. This form must contain job specifications that require non-deletion of email, and be approved by supervisor and Vice President. Needing to keep emails as records is not considered a requirement since this system is not set up to manage record disposition requirements as set forth by TBR.
- Again, this is not to be confused with record retention requirements. If you have questions on whether or not specific emails are records, please consult TBR Guideline G-70, Disposal of Records. and your supervisor.
- For specific guidance on how to use Enterprise Vault email archiving, please go to TigerWeb - MY WORK tab - Computer Services - Enterprise Vault.
- New employees should attend the "Introduction to CHSCC Computer Systems" course within 30 business days of hire. Employees not attending either the D2L class or the on-campus class, within that timeframe, will have their access disabled until training is completed. Please call the computer training coordinator at ext. 2581 to set up the training.
- If a new employee will also require special Banner access to fulfill job duties, that access can also be requested at the same time as basic access.
- If supervisors know that special Banner access is also needed, simply annotate on the on-line work order that special access is requested, and complete the section for special access on the same initial form. Once the form is received by the Computer Center, the data owner will be notified of the request.
- Once the form is approved and returned from data owners, the request will be processed. No access will be given until the form is signed by data owner authorizing access. Supervisors should plan on 3 - 5 business days for completion of special access requests. Computer Center personnel will notify the individual that access has been authorized and granted.
Change of Access Requirements:
- Requests to remove/disable access due to an employee changing jobs, having a new supervisor, leaving CHSCC, etc., any change that could impact access requirements, must be sent to the Computer Center for handling as soon as possible.
- Anyone on a contract will have access limits set to disable upon last day of the contract. If the individual is to be extended for any reason, please follow the directions provided in section 7 and 8. Without receipt of new forms, access will be removed on the last contract date.
- The current supervisor should fill out an online work order providing sufficient information in order to disable/remove access. These changes should be sent to the Computer Center, within 10 business days before the change in status takes effect, as much as possible to ensure disabling of access in a timely manner. Sufficient information contains the name of the individual, reason for the access change, and the date the access needs to be disabled. The Computer Center will disable all access on the stated date in the work order.
- Any customer account will be disabled after one (1) year of inactivity. Accounts will be deleted six (6) months after they are disabled. Anyone returning to ChSCC after this timeframe will be given a new account (user-id and password.)
- Requests to add additional access due to an employee changing jobs, receiving a new supervisor, etc, or any change that could impact access requirements will require completion of new forms. If the employee will require the same or other special/protected Banner access as part of the new job requirements, the "gaining" supervisor will need to fill out a new Administrative Computer Access Request Form. This form is available within the on-line work order system. This form must be filled out and signed by the employee and the "gaining" supervisor. If a FERPA form has already been filled out and is on file within the Computer Center, a new FERPA statement is not required. Supervisors should plan on 1 - 5 business days for access to be granted for new requirements. Access won't be granted until the signed form is on file in the Computer Center.
Planned Retirement or Leaving ChSCC:
- Supervisors for employees, contractors, etc, that are leaving CHSCC for any reason, should notify the Computer Center as soon as possible, to ensure security access is removed on the date the employee leaves. Supervisors will fill out a work order providing name and date that access will be removed. All access will be removed on the stated date contained in the work order.
Emergency Access Removal:
- Emergency access removal requests can only be authorized by employee's Vice President, Vice President of HR, or the President of the College. To initiate the emergency access removal process, notify the Assistant VP of Computer Services or the Director, Systems Development and Operations. Once notified, requester will be contacted to ensure exactly what needs to take place and when.
- Access will be removed upon stated date for emergency access removal. Access to Exchange and Enterprise Vault will only is disabled initially. Disabling the account allows the supervisor or others, as necessary, to have access to the emails, etc., if required. Computer Services will work with designated individuals to determine when the email box, etc., can be deleted.
- The Computer Center will contact each individual data owner responsible for approving special access authorizations for access reviews at least annually. Notification received by the Computer Center through official channels concerning personnel changes that impact access will be shared with appropriate data owners to ensure access lists stay current between data owners and the Computer Center.
Access to Forms:
- Supervisors can find detailed instructions on filling out required forms by clicking on "Computer Access Request" link located on TigerWeb.
- State of Tennessee Department of Finance and Administration Office/Office for Information Resources Aug 2007/Apr 2008
- Tennessee Board of Regents (TBR) Information Technology Policy 1:08:00:00
- Tennessee Board of Regents (TBR) G-070 Disposal of Records
- Tennessee Board of Regents (TBR) Guideline G-075 Litigation Hold Notice procedures for Federal Litigation (Federal Rules of Civil Procedure)
Approved: Executive Staff, 05/20/09
Approved: President's Cabinet, 05/20/09 rev 1
Approved: President, 05/20/09
President's Cabinet, 02/12/2012 rev 4
Dr. James L. Catanzaro, President, 05/7/2012 rev 4
Reviewed and Revised by: Computer Services, 09/30/08
Reviewed and Revised by: Computer Services, 03/27/09 No updates required Reviewed and Revised by: Computer Services, 06/01/10 No updates required Reviewed and Revised by Computer Services, 12/1/2011 rev 3