IT Policy

1. Purpose

This policy aims to establish guidelines for the secure and responsible use of Wi-Fi and digital resources to ensure the protection of institutional data, networks, and personal information. It defines acceptable usage and outlines security measures for the institution’s Wi-Fi network.

2. Scope

This policy applies to all users using Wi-Fi network, including students, faculty, staff, contractors, vendors, and guests, who access the institution’s wireless network or are responsible for managing IT infrastructure.

3. Wi-Fi Usage Policy

3.1 Authorized Users and Access

• Access to the Wi-Fi network is granted to authorized users, including faculty, staff, students, and approved guests.
• All users must use their institutional credentials (username and password) to access the primary Wi-Fi network. Temporary Wi-Fi credentials may be issued to guests or short-term users.
• Guest Wi-Fi will be available with limited access to non-sensitive resources such as the internet, but not to internal systems or data.

3.2 Wi-Fi Network Structure

• Secure Networks: The institution maintains separate, encrypted Wi-Fi networks for faculty/staff, students, and guests to ensure adequate security and access control.
• Encryption Protocols: The Wi-Fi network for authorized users must use WPA3 encryption (or the most secure available standard).
• Network Segmentation: Administrative systems and sensitive institutional resources will be segmented on separate networks with stricter access controls.

3.3 Device Security and Management

• Security Requirements: Devices connecting to the Wi-Fi network must have up-to-date antivirus software, firewalls, and security patches.
• BYOD (Bring Your Own Device): Students, faculty, and staff are permitted to connect personal devices, but these devices must comply with minimum security standards established by the institution’s IT department.
• Device Registration: Devices must be registered with the institution’s IT department before gaining access to secure networks.

3.4 Guest Access

• Guest Wi-Fi Network: A separate guest network will provide internet access only. Access to internal institutional resources, including academic systems, file servers, and administrative databases, is prohibited.
• Guest Authentication: Guests will authenticate using temporary login credentials provided by campus facilities, event organizers, or the IT department.
• Access Control: Guest network access will be time-limited and subject to review by the IT department.

3.5 Monitoring and Enforcement

• Network Monitoring: The IT department reserves the right to monitor Wi-Fi traffic for unusual activities, security threats, and to ensure compliance with this policy.
• Bandwidth Management: The IT department may implement measures to ensure fair usage of the Wi-Fi network, including bandwidth throttling and limiting access to non-essential services.

4. Cybersecurity Policy

4.1 Network Security

• Firewalls and Intrusion Detection Systems (IDS): Firewalls and IDS will be implemented at network entry points to detect and prevent unauthorized access.
• Network Segmentation: Critical institutional resources (e.g., financial systems, research data) will be isolated on dedicated, highly secure networks.
• Access Control: Network access will be controlled based on user roles, and users will only be able to access resources for which they have appropriate authorization.

4.2 User Authentication

• Single Sign-On (SSO): Students, faculty, and staff must use SSO for access to various institutional systems. Multi-factor authentication (MFA) is required for access to sensitive systems (e.g., email, research databases).
• Password Policy: All users must adhere to the institution’s password policy, which requires complex passwords (at least 12 characters) and periodic password changes.

4.3 Data Protection and Privacy

• Data Encryption: All sensitive data, including student records, financial information, and personal data, must be encrypted both in transit and at rest.
• Personal Devices: Users must secure personal devices that access institutional systems by using device encryption and strong passwords.
• Data Access: Access to sensitive data must be restricted on a need-to-know basis. Employees and students are prohibited from storing sensitive data on personal devices or unsecured locations.

4.4 Cybersecurity Awareness

• Training Programs: All users must complete cybersecurity awareness training during onboarding and at least once annually to recognize threats such as phishing, malware, and social engineering.
• Phishing Simulations: Regular phishing simulations will be conducted to raise awareness and prepare users to identify malicious emails and websites.

4.5 Malware Protection

• Anti-malware Software: All institution-owned devices, including laptops and workstations, must have institutional-approved anti-malware software installed and regularly updated.
• Incident Response: Any device infected with malware or suspected of being compromised must be immediately reported to the IT department for assessment and remediation.

4.6 Remote Access

• VPN for Remote Access: Remote access to the institution’s internal systems must be conducted via a Virtual Private Network (VPN). MFA is required for VPN access to all sensitive systems.
• Secure Remote Work Guidelines: When working remotely, users must follow the institution’s security policies and use only secure, trusted networks.

5. Incident Response and Reporting

5.1 Incident Reporting

• Users must immediately report any suspected security incidents, such as unauthorized access, malware infections, or data breaches, to the IT department via the institution’s designated incident response channels.
• An incident response team will investigate and respond to incidents promptly.

5.2 Incident Handling and Recovery

• The institution will maintain an incident response plan that includes identification, containment, eradication, and recovery procedures.
• Regular backups of critical data will be performed, and disaster recovery procedures will be tested periodically.

6. Roles and Responsibilities

6.1 IT Department

• Responsible for implementing, monitoring, and enforcing the Wi-Fi and cybersecurity policies, as well as providing support and training to users.

6.2 Users

• Students, faculty, and staff are responsible for complying with this policy, using the Wi-Fi network responsibly, and reporting any issues or security threats promptly.

6.3 Faculty and Staff

• Faculty and staff members are expected to ensure that their students follow institutional IT policies, especially regarding acceptable usage and security practices.

7. Compliance and Enforcement

7.1 Compliance

• Compliance with this policy is mandatory. Failure to adhere to the policy can result in disciplinary action, including suspension of network access, formal warnings, or more severe penalties for repeated or severe violations.

7.2 Audits and Reviews

• The institution will conduct periodic audits and security assessments to ensure compliance with this policy and identify areas for improvement.
• This policy will be reviewed annually and updated as needed to address new security challenges or changes in the technological landscape.

8. Conclusion

This policy ensures that [Institution Name]’s Wi-Fi and IT resources are used securely and responsibly, protecting the institution’s data and networks from unauthorized access and cyber threats. By adhering to these guidelines, we maintain a secure, accessible, and reliable IT environment for all users.