Statement and Purpose

Privileged Access

Privileged access, commonly referred to as supervisor, system administrator, admin, or root access, grants an individual non-standard elevated access to the resources and data to perform system / data administration job duties.  University staff with privileges or access used to administrate systems or data is considered a user with privileged access.

Requirements for Privileged Access

• Privileged access is only be granted to employees requiring elevated access to perform documented job responsibilities. 
• CIS may require an in person meeting and/or technical skills assessment to demonstrate competency prior to granting privileged access.
• Eligible employees are required to sign and agree that they have read, understand, and will comply with the policy prior to being granted privileged access. Signed agreements will be kept on file by the CIO in the department of Computer and Information Systems.
  

Agreements by Privileged Users:

Privileged users agree to use privileged access appropriately, respect privacy, protect institutional data, and enforce security and legal compliance, as more fully described below.

Use Privileged Access Appropriately

1. Administrative credentials are not to be used as a primary login for non-privileged access and activities.
2. Privileged access may only be used when performing administrative job duties that require elevated permissions.

Respect Privacy

1. Privileged users should never “browse” through the another persons personal data or institutional data while using privileged access, unless such browsing is a specific part of their job description (e.g. computer auditor); is required during file system repair, management, or restoration; is necessary to investigate suspicious or system-impairing behavior; or is specifically requested by, or has the approval of, the person who authorized the privileged access. 
   1. Investigative activities must be authorized by the SPU president, provost, VP or the CIO. See CIS Privileged Account Usage for details. 
2. Privileged users should protect the confidentiality of any information they encounter while performing their duties.  Unauthorized disclosure of confidential information could seriously and adversely impact SPU, its students, and other individuals and organizations associated with SPU.
3. Privileged users should never disclose to any unauthorized person any institutional data observed while operating with privileged access.

4. Privileged users should not copy any institutional data observed while operating with privileged access for any purpose other than those authorized under their defined job responsibilities.

Protect Institutional Data

1. Privileged users should seek to protect institutional data and should not intentionally or recklessly damage or destroy any Institutional Data. See Institutional Data Policy for details.
2. Privileged users should not take actions on computer systems under their charge that will impair the integrity or security of that system or other University systems.

3.  Privileged users should not modify or delete institutional data unless it is done in accordance with SPU policies and procedures.

Enforce Security and Legal Compliance

1. Privileged users should use all available protections to safeguard computer system(s) under their charge from unauthorized access by any person or another computer.

2. Privileged users should report all suspicious requests, incidents, and situations regarding an SPU computing resource to an appropriate member of management or the CIO.

3. Privileged users should comply with all computer security standards and policies in force at SPU.

4. Privileged users should not attempt to gain or use privileged access outside of assigned responsibilities, or beyond the time when such access is no longer required in job functions.

5. Privileged users should not tell or disclose to any unauthorized person the information required to gain privileged access, and should not engage in careless practices that would reveal that information to unauthorized persons.

6. Privileged users should not change or develop any computer software in such a way that would (1) disclose computer information to unauthorized persons or (2) make it possible to retain any special access privilege, once that authorized privilege has been terminated by management.

7. Privileged users should not do special favors for any user, member of management, friend, or any other person regarding access to SPU computing resources that would circumvent prevailing security protections or standards or would otherwise violate this policy.

8. Privileged users should maintain awareness and responsibility for complying with all applicable laws, regulations, policies, and procedures.

Granting of Permissions

Many privileged users have the ability to grant access to SPU systems and/or institutional data they administer, including the ability to grant others privileged user access to that system. Privileged users are responsible for permissions they grant as follows:  

When granting permissions, privileged users are responsible for:

1. Following any policy or procedure governing the granting of permissions or access related to the system in question.

2. Receiving authorization from a system owner, supervisor, or other administrator authorizing the granting of permissions.

3. Questioning the requester and/or approver to ensure appropriate access is being granted.

When granting privileged access, privileged users are responsible for:

1. Following all the above noted responsibilities for granting permissions.
2. Referring new privileged users to training materials, documentation, and/or policy relevant to their new access.
3. Obtaining a copy of this policy, signed by the requester, (i.e., the individual requesting privileged access), the department approver, and the approving department head or director.
4. Following a least privileges methodology, granting only access required by the grantee's job duties and nothing more.

When granting permissions, approvers are responsible for:

1. Following any policy or procedure governing the granting of permissions or access related to the system in question.
2. Verifying with the grantor that the access/permissions are appropriate for the requester.

Revocation of Privileged Access

Privileged users must always be aware that these privileges place them in a position of considerable trust. Privileged users must not breach that trust by misusing privileges or failing to maintain a high professional standard.

Definition of Terms

Related Policies and Procedures