Introduction

Requirements for Privileged Access

• Privileged access is only granted to employees requiring special access to perform their job responsibilities. 
• Eligible employees are required to sign and agree that they have read, understand it, and will comply with the policy prior to being granted privileged access.

Employees with Privileged Access agree to:

Use Privileged Access Appropriately

1. Administrative credentials are not to be used as a primary login for non-privileged access and activities.
2. Privileged access may only be used when performing administrative job duties that require elevated permissions.

Respect Privacy

1. Never “browse” through the personal or institutional data while using the powers of privileged access, unless such browsing is a specific part of their job description (e.g. computer auditor); is required during file system repair, management, or restoration; is necessary to investigate suspicious or system-impairing behavior; or is specifically requested by, or has the approval of, the person who authorized the privileged access. 
   1. Investigative activities must be authorized by the SPU president, provost, VP or the CIO. See Privileged Account Audit and Usage Policy for details. 
2. Take responsibility to protect the confidentiality of any information they encounter while performing their duties.
3. Never disclose, to any unauthorized person, computer information observed while operating with privileged access.
4. Not copy any computer information for any purpose other than those authorized under defined job responsibilities.
   

Protect Institutional Data

1. Not intentionally or recklessly damage or destroy any institutional data.
2. Not take actions on computer systems under their charge that will impair the integrity or security of that system or other University systems.
3. Not modify or delete data unless it is done in accordance with SPU policies and procedures.

Enforce Security and Legal Compliance

1. Use all available protections to safeguard computer system(s) under their charge from unauthorized access by any person or another computer.
2. Report all suspicious requests, incidents, and situations regarding an SPU computing resource to an appropriate member of management or the CIO.
3. Comply with all computer security standards and policies in force at SPU.
4. Not attempt to gain or use privileged access outside of assigned responsibilities, or beyond the time when such access is no longer required in job functions.
5. Not tell or disclose to any unauthorized person the information required to gain privileged access, or to engage in careless practices that would reveal that information to unauthorized persons.
6. Not change or develop any computer software in such a way that would (1) disclose computer information to unauthorized persons, (2) make it possible to retain any special access privileges once that authorized privilege has been terminated by management or (3) create "backdoor" access that subvert in place security mechanisms.
7. Not do special favors for any user, member of management, friend, or any other person regarding access to SPU computing resources in a manner that would circumvent prevailing security protections or standards.
   
8. Maintain awareness and responsibility for complying with all applicable laws, regulations, policies, and procedures.

Granting of Permissions

Many Privileged Users have the ability to grant access SPU systems and/or Institutional Data they administer, including the ability to grant others privileged user access to that system. Privileged Users are responsible for permissions they grant as follows:  

When granting permissions, Privileged Users are responsible for:

1. Following any policy or procedure governing the granting of permissions or access related to the system in question.
2. Receive authorization from a system owner, supervisor, or other administrator authorizing the granting of permissions.
3. Questioning the requester and/or approver to ensure appropriate access is being granted.

When Granting Privileged Access, Privileged Users are responsible for:

1. Following all the above noted responsibilities for granting permissions.
2. Referring new privileged user to training materials, documentation, and/or policy relevant to their new access.
3. Receiving a copy of this policy, signed by the requester, department approver, and approving IT director.
4. Following a least privileges methodology, granting on access required by the grantee's job duties and nothing more.

When granting permissions, Approvers are responsible for:

1. Following any policy or procedure governing the granting of permissions or access related to the system in question.
2. Verifying with the grantor that the access/permissions are appropriate for the requester.

Provisions for Revocation of Privileged Access

Users with privileged access must always be aware that these privileges place them in a position of considerable trust. Users must not breach that trust by misusing privileges or failing to maintain a high professional standard.

Definition of Terms