Policies and Guidelines

Policies form the foundation of any security infrastructure. Policies define how the UCSC Information Systems Security Team will approach security, how employees (staff/faculty) need to approach security, how students are to approach security, and how certain situations will be handled.

While this document lists many of the university policies, but is not an exhaustive or complete list. New regulations, policies and procedures are constantly evolving. Laws, policies, or other regulations on aspects not specific to networks or computing may apply, e.g.: student conduct, personnel policy or contract, sexual harassment, chain letter laws, or other regulations.

• University of California policies and guidelines
• UC Santa Cruz policies and guidelines
• Other General UC or UCSC Policies
• Local, State, or Federal laws
• UCSC Drafts

• University of California IT Policies
• University of California Electronic Communications Policy
• Digital Copyright Protection at the University of California
• Management Guide for Information Security
• UC Business and Finance Bulletins -- IS Series - Information Systems

• UCSC Electronic Information Policy Framework (Diagram)

• UCSC IT-Related Policies
  • Policy for Use of UCSC Computing Facilities
  • UCSC Password Policy
    • UCSC Password Strength and Security Standards
  • UC Santa Cruz ResNet Responsible Use Policy
  • Instructional Computing Lab Policy Summary
  • HIPAA Security Rule Compliance Policy

• Protecting Restricted Data
  • Practices for Protecting Electronic Restricted Data
  • Risk Assessment Matrix
  • University Administrative Information Systems, Access to Information Statement (all individuals with access to restricted data should read and sign)

• The Electronic Communications Policy (ECP) at UC Santa Cruz
  • UCSC Electronic Mail Guidelines (Implementation Procedures for UC Email Policy) Note that these implementation procedures will be updated for the UC Electronic Communications Policy.
  • Draft Electronic Communications Implementation Guidelines
  • "Access Without Consent" Process and Form (PDF)
  • ITS Routine System Monitoring Practices
  • SSN Scanning Methodology

• Additional Practices, Procedures and Guidelines
  • Electronic Official Communications Statement
  • Guidelines and Procedures for Blocking Network Access
  • Digital Millennium Copyright Act (DMCA) at UC Santa Cruz
  • UCSC Implementation Plan for Protection of Electronic Restricted Data - Updated May 2008
  • Remote Access Guidelines
  • Payment Card Industry Data Security Standard (PCI DSS) Compliance at UCSC

• Information Technology Services (ITS) Divisional Policies
  • ITS Commercial Endorsement Policy
  • ITS Policy Regarding Personal Identity Information (PII)
  • Instructions for information requests from FBI/Federal Law Enforcement

• Glossary of selected terms in UCSC IT-related policies, procedures and guidelines

• UC Systemwide Policies and Guidelines
• UC Santa Cruz Policies and Procedures
• Student Policies and Regulations Handbook
• Title IX/Sexual Harassment Office
• University Police

• United States Code from the Office of the Law Revision Counsel under the U.S. House of Representatives
• California legislative information, maintained by the Legislative Counsel of California
• United States Copyright Office
• Summary of Federal E-Discovery Regulations, December 21, 2006
• UCOP Legislative Update, August 11, 2005

Draft UC Santa Cruz Information Technology policies, guidelines, and practices
        Please forward feedback to itpolicy@ucsc.edu

• 1-page summary of all drafts listed below
  
• Policies for Acceptable Use of UCSC Electronic Information Resources (Acceptable Use Policy) - updated 5/13/08
• UCSC Minimum Network Connectivity Requirements - updated 4/23/08
• Roles and Responsibilities for UCSC Electronic Information Resources (PDF) - updated 1/31/08
• Expanded Practices for Protecting Electronic Restricted Data - updated 7/14/08