Cloud Computing Policy
Use of Cloud Computing Services
CIS remains committed to enabling employees to do their jobs as efficiently as possible through the use of technology. The following guidelines are intended to establish a process whereby University employees can use cloud services without jeopardizing Institutional Data and computing resources.
While cloud computing services, especially free ones, may mention computer security and confidentiality standards, they tend not to guarantee that the data you place there will be secure or treated confidentially in order to shield themselves from liability should your data be misused, stolen, or otherwise inappropriately accessed.
The AVP for Information Technology is responsible for securing Institutional Data and controls what data may or may not be safely stored in by cloud service provider.
- Access Controls
Access controls for any service must either tie into the University's authentication services or the client department must have documented practices to manage access, permissions, and employee transitions. See NIST 800-171 section 3.1 for access control compliance requirements. - Contracts and Terms of Services Review
For any cloud services that require users to agree to terms of service, such agreements must be reviewed by ORM and approved by CIS in accordance with the Enterprise Software Acquisition policy. - University Technology Policy
The use of such services must comply with existing Computer Acceptable Use Policy and Institutional Data Policy. Employees may not share log-in credentials with co-workers. See Password Policies and Guidelines. - Business Continuity / Administrative Access
CIS requires an administrative credential for all cloud services to be stored by CIS in a centrally managed and encrypted password vault for business continuity. - Regulatory Compliance
The use of such services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, or any other data owned or collected by the University. Personal Cloud Services
Employees may not use personal cloud services for the storage, manipulation, or exchange of University-related communications or Institutional Data.- Security
Use of cloud computing services for work purposes must be formally authorized by CIS, who, in partnership with ORM, will certify that security, privacy and all other IT management requirements will be adequately addressed by the cloud computing vendor.
Do not confuse personal cloud services such as OneDrive with approved cloud services such as OneDrive for Business, which is protected by enterprise grade security and is under signed contract with the University.
Protecting Sensitive and Regulated Data
Confidential Data and Institutional Data must not be stored, shared, or otherwise processed by a cloud computing service, unless the University enters into a legally binding agreement with Seattle Pacific University to protect and manage the data according to standards and procedures approved by the University and in accordance with the regulatory environment governing University operations.
Should you ever need to store or share Institutional Data in a manner not currently provided within the University's approved and secured computing environment (see the Regulated Data Chart), please contact CIS, who will work with you to identify and provide a solution that meets your needs.