Information Security will report violations of this policy to the primary contact in ISC's Assignments database and to the senior Information Systems manager in the department or unit owning the machine. Remedy may be an immediate removal of the system from the network, depending on the severity of the operational impact on PennNet. In some cases, systems that are compromised and connected at 100mb or higher speeds, may be backed down to 10mb service until the security problem is rectified. Thus the problem should be resolved as quickly as possible. Information Security will offer assistance to the LSP for the area in correcting security problems, after which the device may be re-connected to the network, and or normal service restored.
Adequate funding is needed to present ongoing operating system security training.
The Strategic Site License Fund may be available to subsidize some of the software-related costs. Responsibility for remedy lies with the system administrator and system owner. Non-compliant devices must either be remedied within thirty days of notification of the support person, or must be removed from PennNet. Disputes about whether or not systems are considered critical shall be decided by the University Information Security Officer. Appeals to such decisions are decided by the Vice Provost for Information Systems.