1. Home
2. Centers
3. Policy Development Unit(PDU)
4. Policy and Procedures
5. Unauthorized Use Policy

POLICY STATEMENT

All Unauthorized Users are banned from utilizing PSU Information Technology services for any goal. Furthermore, authorized users are only allowed to use PSU Information Technology services without exceeding the individual authorized limits.

BACKGROUND AND JUSTIFICATION

Unauthorized use can lead to data breaches, operational disruptions, and legal complications. As our systems become increasingly interconnected, the need to define clear boundaries of acceptable use becomes paramount. The Unauthorized Use Policy is our commitment to delineate these boundaries, safeguarding our organization's assets and ensuring a secure and ethical IT environment for all.

SCOPE AND PURPOSE

This policy covers all Unauthorized Use of PSU Information Technology services.

This describes PSU policy about Unauthorized Use of the Information Technology services

PRINCIPLES OF THE POLICY

1. Transparency: Clearly communicate what constitutes unauthorized use of IT resources, ensuring that users are well-informed.
2. Accountability: Users are responsible for their actions on organizational IT systems and must adhere to established acceptable use standards.
3. Proportionality: Consequences for unauthorized use should be appropriate and proportional to the severity and intent of the violation.
4. Privacy Respect: While monitoring for unauthorized use, respect the privacy rights of users, adhering to relevant privacy laws and regulations.
5. Continuous Education: Regularly inform and train users on the risks of unauthorized use and how to avoid potential pitfalls.
6. Relevance: The policy should be updated periodically to address emerging threats and changing IT environments.
7. Fairness: Ensure that enforcement of the policy is consistent and fair across all levels of the organization.
8. Prevention Over Punishment: While consequences are necessary, the primary aim should be to prevent unauthorized use through awareness, tools, and controls.

DEFINITIONS

1. Unauthorized Use: Any activity or action involving organizational IT resources that contravenes established policies, regulations, or laws, or is conducted without proper authorization.
2. IT Resources: The collective hardware, software, networks, and data assets owned, operated, or managed by the organization.
3. Acceptable Use: The policies, rules, and guidelines that define how IT resources may be used for legitimate business purposes.
4. Violation: An act or instance where an individual or entity breaches the terms outlined in the Unauthorized Use Policy.
5. Access Control: Mechanisms and measures that restrict access to IT resources, ensuring only authorized users can utilize them.
6. Incident Response: The process and procedures in place to handle and mitigate security incidents related to unauthorized use.

RESPONSIBILITIES AND IMPLEMENTATION STRATEGIES

1. Communication and Education:
   • Responsibility: Human Resources and IT Training Teams
   • Strategy: Develop training programs and materials to educate all employees and stakeholders about the policy's provisions and implications.
2. Access Control:
   • Responsibility: IT Security Team
   • Strategy: Implement strong access control mechanisms, such as authentication and authorization, to prevent unauthorized access to IT resources.
3. Monitoring and Detection:
   • Responsibility: IT Security Team
   • Strategy: Employ intrusion detection systems (IDS), log analysis, and real-time monitoring to detect and respond to unauthorized use incidents.
4. Incident Response:
   • Responsibility: IT Security Team
   • Strategy: Establish a clear incident response plan, including procedures for reporting, investigating, and mitigating unauthorized use incidents.
5. Consequences and Enforcement:
   • Responsibility: Human Resources and Legal Teams
   • Strategy: Define and communicate the consequences of unauthorized use, including disciplinary actions and potential legal measures. Ensure consistent enforcement.
6. Periodic Audits and Reviews:
   • Responsibility: Internal Audit Team
   • Strategy: Conduct regular audits of IT resource usage to identify unauthorized activities and assess policy compliance.
7. Documentation and Record Keeping:
   • Responsibility: IT and Compliance Teams
   • Strategy: Maintain detailed records of policy violations, actions taken, and resolutions to ensure accountability and compliance.
8. Privacy Compliance:
   • Responsibility: Data Protection Officer or Privacy Officer
   • Strategy: Ensure that monitoring and enforcement activities align with applicable privacy laws and regulations.
9. Continuous Improvement:
   • Responsibility: IT Governance Team
   • Strategy: Periodically review and update the Unauthorized Use Policy to reflect evolving technology, threats, and organizational needs.

PROCEDURES FOR HANDLING POLICY VIOLATION

Unauthorized Users may be subject to criminal prosecution and/or civil suits in which the PSU seeks damages and/or other legal and/or equitable remedies. Unauthorized Users who are employees of the PSU may also be subject to disciplinary action, up to and including termination of employment. Unauthorized Users who are employees at the organization may also be subject to disciplinary action, up to and including expulsion from the organization.