This plan identifies key concerns and issues faced by the University community at the application, host, and network level, and strives for a balance between the University's desire to promote and enhance the free exchange of ideas and its need for security of critical information and systems. This document establishes an overarching security policy and direction for Washington University. Individual schools and departments are expected to establish standards, guidelines, and operating procedures that adhere to and reference this policy while addressing their specific and individual needs. Access defines rights, privileges, and mechanisms to protect assets from access or loss. Accountability defines the responsibilities of users, operations staff, and management.
Authentication establishes password and authentication policy.
Availability establishes hours of resource availability, redundancy and recovery, and maintenance downtime periods. Information technology system and network maintenance describes how both internal and external maintenance people are allowed to handle and access technology. Many other categories of records, including faculty and other personnel records, and records relating to the University's business and finances are, as a matter of University policy, treated as confidential. Networks provide connection to records, information, and other networks and also require security protections. The use of University Information Technology assets in other than a manner and for the purpose of which they were intended represents a misallocation of resources and, possibly, a violation of law.