Author: Brandon Murray

Multi-Factor Authentication Policy

Posted on by
Title: Multi-Factor Authentication Policy
Policy Owner: Information Technology Services / Chief Information Security Officer 
Applies to: All employees, students
Campus Applicability:  All Campuses
Effective Date: March 29, 2023
For More Information, Contact UConn Information Security Office 
Contact Information: techsupport@uconn.edu or security@uconn.edu 
Official Website: https://security.uconn.edu/

PURPOSE 

To help prevent unauthorized access to University information systems.

DEFINITIONS  

DUO: A University–approved Multi-Factor Authentication (MFA) application That provides an added layer of protection to help prevent unauthorized access to university information systems. DUO can be loaded on individual devices including smartphones and tablets. It can also provide multi-factor authentication through the sending of SMS codes directly to phones and through the use of pre-generated codes.

Fob: A small hardware device that serves as a second authentication mechanism either in place of in addition to the DUO mobile app.

University Information System: Devices and/or components managed by the University for collecting, storing, and processing data and for providing information, knowledge, and digital products. For purposes of this policy, information technology devices and components managed exclusively by UConn Health are not considered University Information Systems.

 Multi-Factor Authentication (MFA): MFA is a method of system access control in which a user is granted access only after successfully providing at least two pieces of authentication, usually including knowledge (something the user knows such as a password), possession (something the user has such as a token generator), or inherence (something the user is such as the use of biometrics).

POLICY STATEMENT  

Users of University Information Systems must adhere to Multi-Factor Authentication requirements, where available, to ensure authorized access to University Information Systems and protected or confidential data.

PROCEDURES

User Requirements

  1. Users must maintain a device that can receive DUO authentication requests in a secure manner via the DUO mobile app or another mechanism, such as SMS, phone, or token.
  2. When an attempt is made to access a DUO enabled system or application, the system will challenge the user by requesting a second factor of authentication which may include an acknowledgement of a push notification via the DUO app, a 6-digit code via SMS, or a Fob.
  3. If users receive a DUO notification when not conducting a recent authentication, the authentication should be denied and reported to the Technology Support Center

Frequency of User Challenges

The frequency with which a user may be challenged depends both on policy and use.

  • Policy based – depending on information being accessed, more frequent authentications may be required.
  • Usage based – While user challenges may be “remembered” for a period of time, use of other hardware, browsers, or other behaviors may trigger additional verification using a second factor.

Lost or Stolen Devices

If a user’s registered device is lost, stolen, or the user has reason to suspect their UConn NetID has been compromised, the user must contact the Technology Support Center immediately. As a precaution, they should change their NetID password at netid.uconn.edu

Off-Hours and Emergency Access to systems and applications

UConn Information Technology Services will maintain internal procedures for processing emergency access requests if issues arise with the multi-factor authentication process. Users should contact the Support Desk for additional information.

Use of Automated Systems

Automated systems that intend to interfere with the approval component of multi-factor authentication are hereby prohibited.

ENFORCEMENT 

Users may not attempt to circumvent login procedures, including DUO multi-factor authentication, on any computer system or otherwise attempt to gain unauthorized access. Attempts to circumvent login procedures may subject individuals to disciplinary action. Financial losses incurred due to the use of DUO multi-factor circumvention techniques are the responsibility of the user, and the University may seek financial restitution from users who violate this policy.

Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.

EXCEPTIONS

ITS will review and document any requests for exceptions to this standard. ITS will also have available solutions for the intermittent failure of various second factors, which may include the allowance of temporary access codes upon verification of an individual’s identity.

Questions about this policy or suspected violations may be reported to any of the following:

Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357)

Information Security Office – https://security.uconn.edu

POLICY HISTORY 

Policy created:  March 29, 2023 (Approved by Senior Policy Council)

 

 

Mobile and Remote Device Security Policy

Posted on by
Title: Mobile and Remote Device Security, Information Technology 
Policy Owner: Information Technology Services / Chief Information Security Officer 
Applies to: All faculty, staff, student employees, and volunteers   
Campus Applicability: All campuses except UConn Health 
Effective Date: August 30, 2021
For More Information, Contact UConn Information Security Office 
Contact Information: techsupport@uconn.edu or security@uconn.edu 
Official Website: https://security.uconn.edu/

PURPOSE 

To ensure data and information systems security by establishing requirements for mobile and remote devices.  Mobile and remote devices are important tools for the University, and their use is supported to advance the mission of the university. Mobile and remote devices also represent a significant risk to information and data security. If appropriate security measures and procedures are not applied, mobile and remote devices can serve as a conduit for unauthorized access to University data and IT resources that can subsequently lead to data leakage and a path for compromise of other systems. 

APPLIES TO 

This policy applies to all University faculty, staff, student employees, and volunteers who use mobile or remote devices to access any non-public IT resources owned or managed by the University. 

DEFINITIONS 

IT Resources: Includes systems and equipment, software, and networks. Systems and equipment include but are not limited to computers, hard drives, printers, scanners, video and audio recorders, cameras, photocopiers, and other related devices. Software includes but is not limited to computer software, including open-source and purchased software, and all cloud-based software, including infrastructure-based cloud computing and software as a service. Networks include but are not limited to all voice, video, and data systems, including both wired and wireless network access across the institution. 

Mobile Electronic Device: Includes telecommunication and portable computing devices which can execute programs or store data, including but not limited to laptops, tablet computers, smartphones, and external storage devices. Generally, a device capable of using the services provided by a public/private cellular, wireless, or satellite network. 

Remote Device: Personal computer used off-site 

POLICY STATEMENT  

University of Connecticut faculty, staff, student employees, and volunteers who use mobile or remote devices are responsible for any institutional data that is stored, processed, and/or transmitted via a mobile or remote device and for following the security requirements set forth in this policy. 

To adequately protect the data and information systems of the University, all individuals covered under this policy are expected to meet the following requirements: 

All users of a mobile electronic device used to access non-public university systems must take the following measures to secure the device: 

  • Configure the device to require a password (minimum of 10 characters), biometric identifier, PIN (minimum of 6 characters), or swipe gesture (minimum of 6 swipes) to be entered before access to the device is granted. Device must automatically lock and require one of the authentication methods after no more than 5 minutes of idle time. 
  • Keep devices on currently supported versions of the operating system and remain current with published patches. 
  • Enable the device’s remote wipe feature to permit a lost or stolen device to be securely erased. 
  • Securely store electronic devices at all times to minimize loss via theft or accidental misplacement. 

    Wherever practical, elements of these requirements will be enforced via centrally administered technology controls.  

    STORAGE OF CONFIDENTIAL DATA 

    In general, confidential data should not be stored on mobile devices, including laptops. However, in certain instances and depending on job responsibilities, this may be unavoidable. In these instances, confidential data must be stored on university-owned devices ONLY with the following requirements: 

    • Except when being actively used, confidential information must at all times be encrypted on any device through a mechanism approved by the University. Alternatively, whole drive encryption software may be deployed to meet this requirement. 
    • Mobile devices must have university-supported software enabled and running to identify, protect, and respond to any threats to the data or operating systems of the devices. 
    • Devices must have Mobile Device Management software installed to facilitate device protection, including remote wipe and, if possible, device location technology for recovery. 

    DEVICE DECOMISSION OR SEPARATION FROM UNIVERSITY 

    When mobile devices, specifically personally owned devices that may have had access to University resources or data, are no longer used, and donated, or given to anyone, the device owner is responsible for ensuring that any University information is securely deleted from the device, including University-related e-mails/accounts, user ID and password, or other cached credentials used to access University systems. 

    In the event of separation from the University, it is the employee’s responsibility to delete any University-related e-mail accounts or University licensed software that may have been installed on personal devices or computers. 

    ENFORCEMENT 

    Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code. 

    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

    Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

    Information Security Office – https://security.uconn.edu 

     

    POLICY HISTORY 

    Policy created:  August 30, 2021 [Approved by President’s Senior Team] 

    System and Application Security Policy

    Posted on by
    Title: System and Application Security Policy 
    Policy Owner: Information Technology Services / Chief Information Security Officer 
    Applies to: All students, faculty, and staff  
    Campus Applicability: All campuses except UConn Health 
    Approval Date: August 30, 2023
    Effective Date: August 31, 2023
    For More Information, Contact: UConn Information Security Office 
    Contact Information: techsupport@uconn.edu or security@uconn.edu
    Official Website: https://security.uconn.edu/

    PURPOSE 

    To ensure the security of university data and systems by establishing requirements for the proper maintenance and oversight of systems and applications used by university constituents.

    APPLIES TO 

    This policy applies to all individuals responsible for operating or overseeing any University system or application, whether on premise or in the cloud.

    DEFINITIONS  

    Academic / Research System: A system whose primary responsibility relates to individual academic work or research

    Administrative System: Any system that is used in support of the operation of the university excluding individual Academic / Research Systems.

    Client Network: A client network is a computer network where individual machines are connected. Client networks consume services and do not offer services to the general population

    ITS: Information Technology Services

    IT Professional: An individual (staff) who is trained and skilled in using technology to solve business problems coupled with assigned job duties in support of technology at the university. This must be a defined responsibility within the position job description and may not fall under “other duties as assigned.” Appropriate training, support, and budget must also be available in support of the IT Professional role.

    Local Network: The local network is those computers logically located in the same subnet

    SaaS: Cloud-based service that is delivered via the web based on either a monthly or annual subscription

    PaaS:  Cloud-based service that provides a platform allowing for the development of software using an established framework to improve development time and management of cloud services

    PII (Personally Identifiable Information):  Information that either singularly or in conjunction with other data elements could reasonably lead to the identification of specific individuals

    Public Availability: Services offered publicly include services offered outside of the local network

    Regulated Data: Any data that has regulations around its protection prescribed either by law or contract is automatically considered administrative data. Examples include: Personally Identifiable Information (PII), Payment Card Information (PCI), Personal Health Information (PHI) and FERPA (Family Educational Rights and Privacy Act)

    System Owner: The individual who is responsible for the planning and operation of the service. All systems must have a designated system owner.

    POLICY STATEMENT  

    The proper management, maintenance and support of systems and applications is critical to protecting the data they store or process from a confidentiality, integrity, and availability perspective.

    Basic Requirements (all systems including academic, administrative and research)

    System Ownership

    All systems including cloud-based systems supporting any aspect of the University must have an identified owner and responsible party for ensuring the controls specified in this policy.

    All software and services used to process University information are subject to an Information Security review and sign off prior to their purchase or development. Information Security reviews will evaluate specific risks and controls available and necessary based on the information being processed. The system owner will be responsible for the deployment of the agreed upon security controls prior to enabling the production capability of the system or application.

    System Access

    Access to information in the possession of or under the control of the University must be provided on a need-to-know basis. Information must be disclosed only to individuals who have a legitimate and approved need for the information. For most applications, this requires the use of proper authentication methodologies and the use of Single Sign On (SSO) is encouraged.

    Information may only be used for its intended purpose, and other uses of university information without the approval of the data owner is prohibited.

    Patching and Maintenance

    All system owners must ensure the timely implementation of operating systems and application patches to provide for the confidentiality, integrity, and availability of the systems or data. The ongoing maintenance of applications and the application of software updates is an activity that must be minimally scheduled on a quarterly basis.

    System and Application Lifecycle Management

    System owners are responsible for the planning of and budgeting for system maintenance and obsolescence. Any system or application that is no longer supported by the vendor or is replaced by newer technology should be decommissioned as soon as possible.  The decommissioning process must include the proper retirement of any physical hardware or virtual images and the proper destruction of any media (e.g., hard drives, tapes, etc.) that may have data. Cloud services that are decommissioned should ensure the proper handling of any data (return and/or destruction) in the cloud vendor’s possession as part of the contract cancellation.

    Cloud based systems

    Software as a Service / Platform as a Service

    While patching and maintenance of Cloud-based SaaS and PaaS systems is typically handled by the vendor, identified individuals are responsible for proper security configurations and user management associated with providing the service. A Vendor Risk Management review is necessary for all newly procured services.

    Infrastructure as a Service (IASS)

    IAAS provides a significant amount of flexibility in the configuration and use of the platform. This requires additional expertise that requires management by an IT Professional and where applicable must meet the same requirements as Administrative Systems.

    Administrative Systems

    System and Application Security

    Administrative systems due to their complexity must be managed by an IT Professional.

    Administrative systems will be required to adhere to all regulatory requirements and meet security controls / standards as set forth by the Information Security Office based on institutional requirements.

    Encryption

    All systems housing administrative data are expected to have data encrypted in transit and at rest to protect data. Where available, encryption keys should reside outside of the application.

    User Management

    University of Connecticut Information Technology Services (ITS) provides centralized user identity and access management that supports identity validation and access management (IAM) using a NetID and password providing for single sign on (SSO) across multiple systems. Systems and applications that rely on the University IAM platform for authenticating individual access rights can forgo the need for user management outside that of assigning any roles within the system or application, as necessary. The use of SSO for all systems is highly recommended.

    Systems and applications that do not use the central IAM solution must have a written plan and designated individual responsible for the creation, modification, and deletion of user IDs. User IDs, including student accounts, must be reviewed when faculty, staff, or students separate from the University at least annually. This includes a process for ensuring the secure creation of passwords and a secure password reset process for validating an individual’s identity prior to resetting the password.

    Systems where individuals have access to a significant amount of the PII of other constituents, including but not limited to students, faculty, staff, alumni, and vendors, or significant amounts of regulated data require two-factor authentication wherever possible.

    Software Maintenance

    Only necessary software should be loaded on systems, and old versions of software removed. The use of web browsers and other individual productivity tools should be limited to the management of the system only.

    Auditing of Systems and Application Logs

    System and application logs must be reviewed for inappropriate access on a regular basis (at least monthly) or via automated systems capable of detecting misuse through the analysis of frequent password failures, geographic anomalies, or inappropriate access attempts. ITS maintains a centralized logging and reporting platform, which can assist in the analysis of large amounts of data often associated with system and application logs. All administrative systems must log to the centralized logging and reporting platform events related to login activity and security event data.

    Mandatory Reporting

    All suspected policy violations, system intrusions, and other conditions that might jeopardize University information or information systems must be immediately reported to the Information Security Office.

    ENFORCEMENT 

    Systems and applications that do not follow the standards set forth in this policy may be administratively shut down or have access restricted. Systems maintained at the departmental or individual level may incur costs in association with enabling the proper protections or in the event of data exposure.

    Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct, applicable collective bargaining agreements, and the Student Code.

    PROCEDURES/FORMS 

    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) or UConn Reportline (1-888-685-2637)

    Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

    Information Security Office – https://security.uconn.edu 

    POLICY HISTORY 

    Policy created: August 30, 2021 (Approved by President’s Senior Team)

    Revisions: August 30, 2023 (Approved by the Senior Policy Council and the President)

     

    Firewall Policy

    Posted on by
    Title: Firewall Policy 
    Policy Owner: Information Technology Services / Chief Information Security Officer 
    Applies to: All students, faculty, and staff responsible for configuring firewalls 
    Campus Applicability: All campuses except UConn Health 
    Effective Date: August 30, 2021
    For More Information, Contact UConn Information Security Office 
    Contact Information: techsupport@uconn.edu or security@uconn.edu 
    Official Website: https://security.uconn.edu/

    PURPOSE 

    To ensure a common set of firewall configurations across the organization to maximize their protection and detection capabilities in support of the security of the University. Firewalls provide a valuable protection and detection capability for the organization when properly configured, managed, and monitored.  

    APPLIES TO 

    This policy applies to all University faculty, staff, students, student employees, volunteers, and contractors who have responsibility for controlling or configuring firewalls. 

    DEFINITIONS 

    EOL: End of Life 

    EOS: End of Support 

    IANA: Internet Assigned Numbers Authority (iana.org)  

    POLICY STATEMENT  

    The University operates in a highly flexible and adaptive security environment to meet its academic, research, and administrative missions. While the ability to adapt to meet the ever-changing needs of the University is important, oversight and reporting of firewall activities are critical to the successful protection and operation of the University environment. The following firewall requirements must be met: 

    Firewall Configuration Standards 

    • All firewalls must be properly maintained from a hardware and software perspective. This includes proper lifecycle planning for EOL and EOS software/hardware and regular review (at least annually) of firewall rulesets. 
    • All dedicated firewalls used in production must follow the University firewall management standard, which includes the ability to review currently configured firewall rules across the organization, identification of shadow or redundant rules and rules in conflict, and standardization of device/object names.  
    • Firewall rulesets and configurations must be backed up frequently to alternate storage (not on the same device). Multiple generations must be captured and retained in order to preserve the integrity of the data, should restoration be required. Access to rulesets, configurations and backup media must be restricted to those responsible for administration and review. 

    Firewall Rules 

    Firewall rules specify (either allow or deny) the flow of traffic through the firewall device. Firewall rules are typically written based on a source object (IP address/range, DNS Name, or group), destination object (IP address/range, DNS Name, or group), Port/Protocol and action. 

    • All firewall implementations should adopt the principal of “least privilege” and deny all inbound traffic by default. The ruleset should be opened incrementally to only allow permissible traffic. 
    • Outbound traffic should be enumerated for data stores, applications, or services 
    • Overtly broad rules may be allowed for specific groups of individuals (not systems). Approval must be granted by the Chief Information Security Officer or their designee. 
    • The use of overly permissive firewall rules is prohibited (i.e., ANY/ANY/ALL rules). 
    • Protocols defined in services and in the firewall must utilize Service Name and Protocol/Port information as assigned by IANA, unless there is a technical reason to do otherwise other than “security through obscurity” and must be commented appropriately in the ruleset.  

      Firewall Logging 

      Firewall log integrity is paramount to understanding potential threats to the network. Firewall devices must log the following data to a system outside of the physical firewall itself and must be regularly reviewed at least monthly or programmatically through automated means. Firewall logs may be forwarded to the ISO SIEM for retention and analysis. 

      The following items must be logged as part of the operation of the firewall: 

      • All changes to firewall configuration parameters, enabled services, and permitted connectivity 
      • Any suspicious activity that might be an indicator of either unauthorized usage or an attempt to compromise security measures 

      ENFORCEMENT 

      Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.  

      Questions about this policy or suspected violations may be reported to any of the following: 

      Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

      Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

      Information Security Office – https://security.uconn.edu 

       

      POLICY HISTORY 

      Policy created: August 30, 2021 [Approved by President’s Senior Team]

      The Provost’s Professional Internship Program for Public Outreach, Service, and Engagement

      Posted on by
      Title: The Provost’s Professional Internship Program for Public Outreach, Service, and Engagement
      Policy Owner: The Graduate School
      Applies to: Graduate Students
      Campus Applicability:
      Effective Date: January 9, 2013
      For More Information, Contact Office of the Vice Provost for Graduate Education and Dean
      Contact Information: 860-486-3617
      Official Website: http://grad.uconn.edu/

      Graduate students are often supported by a graduate assistantship awarded for performing research or teaching functions at the University. The University covers tuition expenses for those students. In addition, the University may cover tuition expenses of students who are funded by a grant that does not cover the cost of the student’s tuition.

      The University recognizes the value of supporting graduate student professional development activities that extend beyond on-campus research and teaching. The Provost may determine that the University will cover tuition expenses for graduate students engaged in other activities directly related to the University’s mission and directly aligned to a student’s academic program of study. The circumstances under which the University will cover tuition expenses and provide a health insurance subsidy for such students are very limited and based on compelling evidence that the activity supports important academic objectives, such as professional internships required as an integral component of a graduate educational program. The Provost will evaluate such activities on a case-by-case basis using the following criteria:

      • The substantive focus of the graduate internship must serve a clear public service, public outreach, or engagement purpose.
      • The graduate internship’s objectives must support the academic mission of the University and align directly with the goals of the University’s Academic Plan.
      • The graduate internship must be established as a required component of the academic program in which the participating students are enrolled.
      • It must be demonstrated that the viability of the internship program is threatened if tuition is not covered.
      • The graduate internship must be credit-bearing, be directed by an instructor of record, and must require students to produce an academic work product.
      • The paid internship experience for the student must include compensation equivalent to or higher than that of a Level I graduate assistant for the academic year.
      • The graduate student interns must be placed in a sponsoring organization that provides at least partial support for the graduate student, including paying the student’s stipend and benefits.
      • The graduate students participating in the internship must serve their internships in public or nonprofit organizations with a clear public service mission.
      • The term of tuition coverage associated with a graduate internship will not exceed four semesters per student.
      • The graduate students participating in the internship must be in good academic standing.

      For student tuition to be covered and for a health insurance subsidy to be provided by the University under this program, the Dean of the School or College that houses the internship program must present appropriate justification to the Provost.

      The academic programs currently included in this program are available here.

      Relocation and Moving Policy

      Posted on by
      Title: Relocation and Moving Policy
      Policy Owner: Office of the Provost / Department of Human Resources
      Applies to: Designated Full-time Faculty, Athletics, Librarians, Management Exempt, and Management Exempt positions with faculty titles
      Campus Applicability:  All Campuses except UConn Health
      Effective Date: February 25, 2021
      For More Information, Contact Office of the Provost or Human Resources
      Contact Information: Provost@uconn.edu / HR@uconn.edu
      Official Website: http://www.policy.uconn.edu

      REASON FOR POLICY

      The University recognizes the competitive nature of the hiring process and therefore grants the flexibility to reimburse or pay for actual relocation expenses for designated full-time faculty, athletics, management-exempt administrators.

      POLICY STATEMENT

      The relocation policy and procedures establishes the nature of expenses that can be direct billed or reimbursed from the University, limits on these expenses, and a timeframe of when these expenses can occur.

      POLICY

      1. In the offer of employment, the University may include an offer to reimburse and/or provide direct payment for allowable moving expenses required for relocation up to the amount specified in the table set forth in paragraph 15 herein.
      2. All reimbursement or direct payments for relocation expenses are includable in the employee’s taxable wages.
      3. Designated faculty includes tenured and tenure-track faculty, management-exempt employees with a base faculty appointment, in-residence faculty, clinical faculty, extension faculty, and  librarians.
      4. Direct billing cannot be used for moves that occur during November or December.
      5. The hiring process includes three phases: interview, offer and acceptance, and move. The final phase, the move, begins the date of the final one-way trip of the selected candidate and their  family to their new residence. The move phase ends upon the day of arrival. Only expenses incurred in connection with the move phase are covered by this policy. Common relocation expenses include (where relevant, this covers the employee and one immediate family member, defined as spouse or child):
        • Transportation of household goods
        • Airfare, in accordance with the University Travel Policy
        • Car rental (through the day of arrival), or mileage at the standard IRS medical/moving mileage rate, in accordance with the University Travel Policy
        • Lodging (only during the one-way trip of the move phase, ending on the day of arrival), in accordance with the University Travel Policy
        • Meals during travel (excluding alcohol), in accordance with the University Travel Policy
        • Shipping of car
        • Storage of household goods after arrival; not to exceed 30 consecutive days after date goods are moved from the former residence
      6. Employees will be reimbursed for the shortest, most direct route available. Travel incurred for side trips or vacations en route, etc. may proportionally reduce the amount of moving  expenses an employee is eligible to receive.
      7. The following types of non-business expenses, included but not limited to, will not be paid or reimbursed as part of relocation expenses:
        • Entertainment
        • Side trips, sightseeing
        • Violations (parking tickets, moving violations, )
        • Return trips to former residence
        • Expenses related to former residence
        • General repairs or maintenance of vehicle resulting from self-move
        • Temporary accommodation in the new location beyond the day of arrival
      8. Individuals should refer to the Reimbursement of Recruitment Expenses Policy for guidance regarding appropriate payment or reimbursement of expenses related to the “interview” and  “offer and acceptance” phases. Relocation payments are not intended to cover any travel expenses incurred during these two earlier phases.
      9. The cost associated with the relocation of a laboratory, professional library, scholarly collection and/or equipment (scientific, musical, etc.) are excluded from this policy as they are not   considered household goods or personal effects. If relevant for business purposes, costs associated with moving such materials should be negotiated separately.
      10. This policy applies to new employees whose move exceeds 50 miles and who are moving to within 35 miles of the primary campus at which they will be working. Exceptions to this rule may   be made by a Dean, the Director of Athletics, or by the appropriate EVP if a) they think that a move is reasonable given the commuting distance that the new employee would be facing, or b)   the new residence of the employee will be close enough to the primary campus at which they will be working so that they will reasonably be able to relocate there and perform their duties.
      11. Relocation expenses will only be covered by this policy if they occur within 12 months of the new start date of an employee.
      12. If employment with the University ends in a voluntary separation prior to working at least thirty-nine (39) weeks on a full-time basis in the first twelve months after starting employment,   the employee must reimburse the University the full amount of relocation expenses paid by the University.
      13. Exceptions to extend applicability beyond these employees require a business justification and must be explicitly approved by the Director of Athletics, EVP, or President as appropriate.
      14. The President will recommend an amount for reimbursement and/or direct payment for the Executive Vice Presidents/Provost to the Board. The Chairman of the Board will recommend an   amount for reimbursement and/or direct payment for the President to the Board.
      15. The formula for determining the amount to be reimbursed is based on the distance of the move. This figure represents the maximum reimbursement allowed. The allowance for a move   constitutes the maximum commitment for reimbursement of University and/or Foundation funds, rather than an entitlement of the employee. The figure is also the maximum amount the   University will pay when the direct bill option is selected. The formula is calculated according to the distance of the move, as follows:
      Mileage Reimbursement of expenses up to:
      ≤ 1,000 miles $2,000
      ≤ 1,500 miles $2,500
      ≤ 2,000 miles $3,000
      ≤ 2,500 miles $3,500
      ≤ 3,000 miles $4,000
      1. It may be the case that the competitive hiring practices of a specific field require exceptions to this policy. Exceptions that involve costs of up to 200% of the standard formula may be approved by the Dean, Director of Athletics, or EVP as appropriate. Exceptions above 200% of the standard formula or involving other requirements of the policy will require documentation of the business justification for the requested exception and these require approval by the EVP or President as appropriate.

      PROCEDURES

      Relocation and Moving Procedures are located here. Upon acceptance, the University’s contracted relocation services provider, Signature Relocation, will contact the employee directly to assist the employee with their relocation.

      ENFORCEMENT

      Violations of this policy or associated procedures may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, the University of Connecticut Student Code, or other applicable University Policies.

      RELATED POLICIES

      Reimbursement of Recruitment Expenses, Policy on

      POLICY HISTORY

      Policy Created:  07/01/2003 (Reimbursement of Recruitment and Moving Expenses Policy approved by Board of Trustees)

      Revisions:

      08/07/2013 (Reimbursement of Moving Expenses Policy and Procedures approved by Board of Trustees)

      11/21/2014 (Procedural revisions to Reimbursement of Moving Expenses Policy and Procedures)

      02/24/2021 (Relocation and Moving Policy approved by Board of Trustees)

      Missing Student Policy

      Posted on by
      Title: Missing Student Policy
      Policy Owner: UConn Police Department
      Applies to: Faculty, Staff, Students
      Campus Applicability:  Storrs
      Effective Date: August 18, 2016
      For More Information, Contact Deputy Chief Maggie Silver
      Contact Information: 860-486-4800
      Official Website: http://www.police.uconn.edu/

      If a member of the university community has reason to believe that a student is missing, whether or not the student resides on campus, all possible efforts will be made to locate the student to determine his or her state of health and well-being through the collaboration of UConn Police, Dean of Students Office, Residential Life staff, and local law enforcement.

      At the beginning of each year or upon matriculation, all students are given the opportunity to identify an individual to be contacted by the University in case of emergency.

      This contact information is subject to the University’s FERPA Policy. (See: http://policy.uconn.edu/?p=368).

      In addition, consistent with Clery Act requirements, all students living in on-campus housing are also given the option each year, or upon moving into on-campus housing, to designate a confidential contact for use in case the student is reported missing.  Although the same contact may be provided for both purposes, by law the missing student contact is distinct from the general emergency contact provided by all students, and is held to a higher standard of confidentiality than the general emergency contact.  It will be accessible only to authorized University personnel, and disclosed only to law enforcement personnel in furtherance of an investigation.  To help ensure timely and complete notification and investigation of all missing student situations, confidential missing student contact should be provided or updated at: https://student.studentadmin.uconn.edu/psp/CSPR/EMPLOYEE/HRMS/c/CC_PORTFOLIO.SS_CC_EMERG_CNTCT.GBL.

      If a member of the university community has reason to believe that any student is missing they should immediately contact UConn Police at 860-486-4800.  

      In missing persons cases, time is of the essence. Hence, we urge the community to contact UConn Police immediately upon suspicion that an individual is missing.  The UConn Police Department is committed to begin an investigation upon the first report.

      The UConn Police department will initiate formal investigation or contact the appropriate law enforcement agency.

      UConn Police will communicate and collaborate as appropriate with one or both of the following departments:

      • Dean of Students Office at (860) 486-3426
      • Residential Life Staff at (860) 486-9000

      Within 24 hours of the determination that a residential student is a missing person, UConn Police will:

      • Notify the local law enforcement agency with jurisdiction, if other than UConn Police;
      • Notify the student’s designated missing person contact;
      • If the student is under the age of 18 years and is not emancipated, notify the student’s custodial parent or guardian

      However, if the student is under 18 and is not an emancipated individual, UConn Police will notify the student parent or guardian as well as any other designated missing person contact.

       

      Parking and Vehicle Policy

      Posted on by
      Title: Parking and Vehicle Policy
      Policy Owner: Facilities Operations – Logistics
      Applies to: Workforce Members, Students, Visitors
      Campus Applicability: All UConn Campuses, except UConn Health
      Approval Date: May 29, 2025
      Effective Date: May 29, 2025
      For More Information, Contact Parking Services
      Contact Information: parkingservices@uconn.edu
      Official Website: https://park.uconn.edu/

      BACKGROUND

      The University of Connecticut (“UConn”) is authorized by state law[1] to promulgate rules and regulations concerning the parking and operation of all Motor Vehicles on UConn campuses, which include its Main Campus (Storrs), its Law School (Hartford), and each of its Regional Campuses.

      Facilities Operations has overall supervisory responsibility for parking and Motor Vehicle operations at UConn Storrs, UConn Law School, and Regional Campuses.  UConn Parking Services, a subdivision of Logistics, is designated to enforce these rules and regulations.

      PURPOSE

      To establish a framework for the allocation, regulation, and enforcement of parking and vehicle use across UConn campuses, ensuring equitable access, safety, and alignment with the University’s operational needs and mission.

      APPLIES TO

      Workforce members, students, and visitors on the UConn Storrs, UConn Law School, and Regional Campuses.

      DEFINITIONS

      Bicycle: Any wheeled vehicle that is not self-propelled and is designed to be pedaled by the rider.

      Employee, Regular Payroll: UConn employees who receive UConn bi-weekly paychecks created during its regularly scheduled payroll processes and who are, therefore, eligible for pre-tax Parking Permit fee deductions and the annual extension of preexisting permit parking privileges.

      Employee, Special Payroll: UConn employees whose employment periods are part-time, seasonal, or contractually limited.

      Hand/Stair Rail: Any railing intended to provide physical support to a pedestrian.

      Immobilization: Restricting the vehicle’s use by detaining it at the point of infraction with a UConn locking device.

      Impoundment: Removing the owner’s lock, transporting the vehicle to a UConn facility and detaining it.

      Motor Vehicle: A motorized conveyance designed for transportation, including but not limited to cars, trucks, motorcycles, motorbikes, motor scooters, and mopeds. Motor Vehicles are classified into the following categories based on their design, engine capacity, and/or Connecticut state law and regulatory requirements:

      1. Motorcycle: A Motor Vehicle with no more than three wheels in contact with the ground, designed with a saddle or seat for the rider or a platform for standing. Motorcycles may not be operated on sidewalks under state law. This includes:
        • Motor scooters with an engine capacity greater than 50 cubic centimeters (cc), which are classified as motorcycles under Connecticut state law and require registration and a valid motorcycle license for operation on public roadways.
        • Bicycles with an attached motor, except those classified as mopeds (bicycles with a helper motor).
      2. Motorized Personal Transportation Vehicle (MPTV): A vehicle or device used for human transport that does not require a license to operate and is propelled by a fuel- or battery-driven motor. This includes:
        • Electric bicycles
        • Electric skateboards
        • Hoverboards
        • Self-balancing electric scooters
        • Gasoline-powered scooters
        • Mopeds (bicycles with a helper motor)
          • A moped is a bicycle equipped with a helper motor with the following characteristics:
            • Engine capacity of less than 50 cubic centimeters (cc)
            • Not exceeding two brake horsepower
            • Maximum speed of 30 mph with automatic transmission
            • Not subject to registration, but operators must have a valid motorcycle license to ride on public roadways.
      3. Motor Scooter: A subset of vehicle under MPTVs or Motorcycles, depending on engine size:
        • Scooters with an engine capacity of less than 50 cc are classified as “bicycles with a helper motor” (mopeds).
        • Scooters with an engine capacity greater than 50 cc are classified as motorcycles under state law, requiring registration and a motorcycle license for operation on public roadways.

          Parking Citation (‘Citation’): The written documentation of a violated parking regulation; any associated parking fine(s) will remain due until it is either paid or an appeal is upheld.

          Parking Permit (‘Permit’): UConn Parking Permits authorize parking by the permit holder on designated areas of UConn campuses, with some restrictions. Permits are available for online purchase year-round by UConn employees and students.

          Public Safety Equipment: Any system or resource necessary for the prevention of and protection from events that could endanger the safety of the public from significant danger, injury/harm, or damage, such as crimes or disasters.  For example, fire hydrants and blue light emergency phones.

          POLICY STATEMENT

          The operation and parking of a Motor Vehicle on UConn campuses is a privilege granted by UConn. All individuals who operate or park a Motor Vehicle on UConn campuses must comply with applicable state and federal laws, as well as UConn policies. All vehicles, including Bicycles, skateboards, and MPTVs, must be operated in a manner that does not endanger pedestrians or obstruct pathways.

          The University reserves the right to restrict or regulate any transportation device that poses a safety hazard.

          Parking Permits

          Parking on UConn campuses, including Motorcycles, Mopeds, and Motor Scooters, requires a valid Parking Permit. MPTVs do not require Parking Permits but they are subject to all vehicle and traffic laws on UConn campuses.

          All workforce members and students who park on UConn campuses must register their vehicles with UConn Parking Services and display a valid UConn Parking Permit when parked on campus. Parking Permits are valid for the permit holder only as Parking Permits are not transferable. A Parking Permit grants the holder the opportunity to park within designated area(s), but it does not guarantee the availability of a parking space. Not finding a space in a preferred lot is not a valid reason for violating parking policy or regulations.

          Students enrolled at institutions other than UConn are considered visitors and must use designated visitor parking for a fee. UConn students employed by UConn are NOT eligible for the purchase of employee Parking Permits.

          Affiliated individuals who park on UConn campuses are required to purchase an Area 2 Parking Permit to be authorized to park.

          Parking Services is not authorized to issue temporary state handicap parking placards.

          UConn Parking Permit holders are responsible for keeping their vehicle information up to date. Any changes to vehicle registration must be reported to Parking Services immediately.

          Parking Services reserves the right to revoke a Parking Permit and its associated privileges before its expiration.

          Restricted Parking

          Parking of any vehicle, including Bicycles, is strictly prohibited in the following areas unless explicitly designated:

          • Sidewalks, pedestrian walkways, and crosswalks or anywhere that obstructs or negatively impacts pedestrian movement
          • Alleyways, fire lanes, driveways, loading zones, ADA parking transfer zones
          • Within 10 feet of fire hydrants or Public Safety Equipment
          • Adjacent to UConn buildings
          • Inside buildings, under overhangs, or in breezeways
          • Secured to unauthorized structures (e.g., trees, Hand/Stair Rails, bollards, fences, signposts, or Public Safety Equipment)
          • Any location or manner that creates, or has potential to create, a public safety hazard such as blocking or encumbering a building entrance or exit

          Additionally:

          • Bicycles must be parked in designated Bicycle racks.
          • Overnight parking, not specifically authorized by University Permit privileges, posted signage, or written communication from Parking Services is prohibited.
          • Severe weather may require UConn to modify or suspend normal parking operations. Vehicles that impede snow removal will be ticketed by UConn Parking Services and/or towed.
          • Vehicles abandoned or otherwise parked for an extended period in an inoperable or neglected condition may be impounded without notice by Parking Services, at the owner’s risk and expense.

          Event parking may require temporary redirection of Permit holders to alternate parking locations. Permit holders must comply with posted signage or instructions from Parking Services regarding event-related parking adjustments.

          Parking Citations

          • Failure to display a valid Parking Permit or comply with applicable laws, regulations, and policies may result in Parking Citations, towing, or revocation of parking privileges. The registered owner of the cited Motor Vehicle is responsible for the payment of the associated fines.
          • Unpaid Parking Citations after 14 days are considered delinquent, accrue late fees, and cannot be appealed.
          • Unauthorized vehicles in restricted areas may be impounded at the owner’s expense.

          ENFORCEMENT

          Parking rules and regulations are enforced year-round, including during academic recesses. University Permit parking privileges are strictly enforced in most surface lots between the hours of 7:00 a.m. and 5:00 p.m. on weekdays, unless otherwise posted. Parking garages are enforced 24/7 year-round. Although Permits are not required in most employee and student commuter lots after 5 PM, they are required in all resident and apartment lots and in other restricted locations 24/7.

          Violations of this policy or procedures may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the University of Connecticut Student Code.

          PROCEDURES

          Parking Permits

          See Parking Services/Permits for specific Parking Permit information.

          Employees

          Employee Parking Permits are available for purchase throughout the year. See: Employee Permit Parking information.

          New UConn Regular and Special Payroll Employees may register and purchase their UConn Parking Permits online or may apply for and purchase their Parking Permits at the Parking Services Office in Storrs.
          Only Regular Payroll Employees are eligible for payroll-deducted Permits.

          Special payroll Employees must pay for their Parking Permits upfront using a credit/debit card, check, or money order.

          Renewal of Permits

          The parking privileges of Regular Payroll UConn Employees are automatically extended from one Permit year to the next. Those who secure their parking privileges using payroll deductions will be given the opportunity to discontinue their deductions.  Special payroll Employees must manually renew their Parking Permit if they continue working at UConn in subsequent semesters. Permits purchased using check, money order or credit/debit card can be cancelled through Parking Services for refunds according to the prorated refund schedule.

          Students

          Permit types and eligibility are based on academic credit hours and housing status. Parking Permits are available for students living off campus (commuter); on campus (resident); or teaching assistants/graduate assistants (GA/TA). UConn annual student Parking Permits remain valid from the start of the fall semester to the end of summer recess.

          See: Student Parking Permit Product and Sales Information for the Storrs and Regional campuses.

          See: Resident Parking Permits Rates, Types, & Eligibility.

          • Resident Student Permits: Students with 54 or more earned academic credits assigned UConn housing on the Storrs or Regional campuses are eligible to purchase a Resident Parking Permit.
          • Exceptions to 54 Credit Rule for Resident Students: Exceptions for resident students with fewer than 54 credits are limited to medical needs or life events that require a resident student to have a car on campus. Documentation may be required, and parking is typically restricted to Lot J or other perimeter lots.  Off-campus employment obligations do not qualify for an exemption from the 54-earned-credit-hour prerequisite.
          • Commuter Student Permits: All Commuter students are eligible to purchase available Commuter Parking Permits.
          • Student Carpool Permits: Only commuter students are eligible to purchase Carpool Permits.

          Renewal of Permits

          Students must renew Parking Permits each academic year if they plan to park on campus. To cancel a Permit, students must notify Parking Services, and if eligible, they may receive a prorated refund based on UConn’s refund schedule.

          Visitors

          Visitors can make their own parking arrangements on all UConn campuses. On the Storrs campus, hourly self-pay parking is also available in the North and South parking garages.

          For all campuses, see: Guest and Visitor Parking.

          Accessible Accommodations and Special Requests

          Parking Services’ staff are available to discuss on-campus travel and parking accommodation for those with special circumstances at (860) 486-4930.

          Connecticut residents may visit the Connecticut Department of Motor Vehicles website to learn more about the availability and privileges associated with Connecticut’s temporary handicap parking placards.

          For Employees

          UConn Faculty and Staff with state-issued handicap placards can apply for a UConn Parking Permit and use ADA compliant spaces within their selected Permit-type area. See: UConn Accessible Parking for complete Accessible Parking information.

          For Students

          Any UConn Resident student requesting to purchase a Parking Permit based on a documented disability should register with the Center for Students with Disabilities (CSD) and follow the procedures for requesting accommodations. See: UConn Center for Students with Disabilities (CSD).

          Parking Citations & Appeals

          Parking Citations & Fines

          Payment of UConn Parking Citations can be made online, by mail, or in person at Parking Services. Acceptable payment methods include check, credit/debit card, or money order made out to the “University of Connecticut.”

          See: Paying a Ticket.

          See: Parking Citation Appeal Processes and associated forms.

           Parking Citations must be paid within 14 calendar days of issuance. Payment methods include:

          • Online: via the Parking Services website.
          • By mail: with check or money order payable to “University of Connecticut.”
          • In person: at the Parking Services Office.

          Unpaid Citations after 14 days are delinquent and subject to late fees. Delinquent Citations cannot be appealed. UConn may send Citations that are delinquent for six months or more to a collection agency. Unpaid student Citations may be posted to student fee bills. All those with delinquent Parking Citation fees will be sent up to three notifications of payment.

          Two weeks following the issuance of the third payment notification, the revocation of the payee’s UConn parking privileges may occur. If a Permit is revoked, a refund of the remaining value of the Permit may be considered.

          UConn may forward any Parking Citation fees delinquent for six months or more to a collection agency.  The overdue Parking Citation fees of UConn students can be posted to their student fee bills for payment.

          See: Paying a Ticket for full payment details.

          How to Appeal a Parking Citation

          Appeals must be submitted in writing within 14 calendar days of Citation issuance. Appeal methods Appeals may be submitted online or via the submission of a preprinted paper form, available for online download and at the Parking Services (Storrs) office. Parking Citation appeals are either “granted” or “denied”. If granted, no payment is due.  If denied, payment must be made within 14 days to avoid a late fee.

          If an appeal is denied, payment must be made within 14 days to avoid late fees. An appellant may request a verbal appeal only if new facts were omitted from the original appeal.

          The verbal appeal process may be initiated by phone at (860) 486-4930.

          See: Citation Appeals | Parking Services

          Towing and Impoundment

          Private towing contractors complete tows initiated by UConn. Any towing or storage fees must be paid directly to the towing contractor.

          All impounded Motor Scooters will be stored within a Parking Services facility until claimed by their owners or disposed of by UConn through not-for-profit donation.

          A Bicycle parked or operated in violation of these regulations may be impounded.  UConn will not compensate the owner of the Bicycle for the cost of any lock (or other security device) that is cut or otherwise damaged during the Impoundment process.

          Violations of any Bicycle or traffic regulation may result in:

          • criminal charges
          • Impoundment of the Bicycle
          • the assessment of fines

          How To Claim an Impounded Bicycle

          Proof of ownership is required before UConn will release an impounded Bicycle to a claimant. When Bicycles are impounded, they are relocated to a secure Parking Services impound facility. See: Reclaim an Impounded Bicycle.

          Event Parking

          Special event rates are typically charged during the four (4) hours that immediately precede the start of an event.

          Event Coordinators must inform Parking Services two (2) weeks in advance of any event for which five (5) or more vehicles will be parked on UConn campuses to ensure that appropriate parking arrangements can be made.

          See: Event Parking Requests & Day Permits for more information on event parking.

          Winter Storms and Emergencies

          Parking updates for winter storms and other emergencies will be communicated via the UConn Alert System and/or the Parking Services website. When UConn declares a winter parking ban, parking will not be allowed on streets, roadways or in employee or commuter lots between the hours of 1:00am and 5:00am, unless otherwise noted.  Winter storm parking plans and information are published seasonally on the Parking Services website.

          For questions or more information, please contact:

          UConn Parking Services
          3 Discovery Drive; Unit 6199
          Storrs, CT 06269-6199
          Phone: 860-486-4930
          https://www.park.uconn.edu

          POLICY HISTORY

          Policy created:  08/08/2012 (Approved by the Board of Trustees)

          Revisions:
          07/11/2017 (Approved by the President’s Cabinet)
          05/29/2025 (Approved by the Senior Policy Council and President)

           

          [1] Connecticut General Statutes section 10a-139, Traffic regulations on the grounds of The University of Connecticut and The University of Connecticut Health Center. Disposition of fines. See also, OSTA No. 170-1411-01.

          Human Stem Cell Research Approval

          Posted on by
          Title: Human Stem Cell Research Approval
          Policy Owner: Office of the Vice President for Research
          Applies to: Employees, Faculty, Students, Other
          Campus Applicability:  All Campuses
          Effective Date: May 25, 2018
          For More Information, Contact Office of the Vice President for Research
          Contact Information: (860) 486-3001
          Official Website: https://ovpr.uchc.edu/

          REASON FOR POLICY

          The purpose of this policy is to ensure that proposals for human embryonic stem cell (hESC) research and selected types of human induced pluripotent stem cell (iPSC) research are approved by the University’s Stem Cell Research Oversight (SCRO) Committee. This policy does not apply to primary cells isolated from human tissues that are not manipulated to become pluripotent.

          The role of the SCRO Committee is to ensure that human embryonic stem cell (hESC) and selected types of human induced pluripotent stem cell (iPSC) research at all University of Connecticut campuses is well-justified and that inappropriate and/or unethical research is not conducted. The SCRO Committee facilitates the collaboration between researchers across University campuses by adopting nationally and internationally accepted standards designed to protect the University’s reputation for ethical and responsible research.

          The review and approval of hESC research by the SCRO Committee (or its equivalent) is required by Connecticut law. The SCRO Committee review and approval is also required for all proposals funded by the State of Connecticut Regenerative Medicine Research Fund.

          APPLIES TO

          All University faculty, employees, students, postdoctoral fellows, residents and other trainees, and agents who supervise or conduct research involving hESCs and select types of iPSCs.

          DEFINITIONS

          Human Embryonic Stem Cell (hESC): Human embryonic stem cells are pluripotent cells that are self-replicating, derived from human embryos, and are capable of developing into cells and tissues of the three primary germ layers. Although human embryonic stem cells may be derived from embryos, such stem cells are not themselves embryos.

          Human Induced Pluripotent Stem Cell (iPSC): Human induced stem cells are a type of pluripotent stem cell that have been artificially created by reprogramming non-pluripotent human cells through techniques that do not involve oocytes or embryos, e.g., through inserting genes into a somatic cell.

          POLICY STATEMENT

          All research projects in the following categories are required to obtain SCRO Committee approval before acquiring cells or cell lines and before commencing research:

          • All research involving hESCs and their derivatives;
          • All stem cell research involving human gametes and human embryos;
          • All stem cell research projects funded by the State of Connecticut, including those that do not use hESCs;
          • All in vitro human iPSC research involving the generation of gametes, embryos, or other types of totipotent cells; and
          • All in vivo research involving implantation of human iPSCs into prenatal animals or into the central nervous system of post-natal animals.

          The SCRO Committee supplements but does not replace other University review processes (e.g., reviews by Institutional Animal Care and Use Committees (IACUC), Institutional Review Boards (IRB), Institutional Biological Safety Committees (IBC), etc.) and compliance with applicable legal requirements.

          ENFORCEMENT

          Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, the University of Connecticut Student Code, and other applicable University Policies.

          ADDITIONAL RESOURCES

          Connecticut General Statutes §§ 4-28e and 32-41jj to 32-41mm, inclusive

          NIH Stem Cell Information

          POLICY HISTORY

          Revisions: March 28, 2012; May 25, 2018 (Approved by President’s Cabinet)

          Secure Web Application Development, Information Technology

          Posted on by
          Title: Secure Web Application Development, Information Technology
          Policy Owner: Information Security Office
          Applies to: Students, Employees, Users
          Campus Applicability: Storrs and Regionals
          Effective Date: May 16, 2012
          For More Information, Contact Chief Information Security Officer
          Contact Information: (860) 486-8255
          Official Website: https://security.uconn.edu/

          Departments will ensure that development, test, and production environments are separated. Confidential Data must not be used in the development or test environments.

          Production application code shall not be modified directly without following an emergency protocol that is developed by the department, approved by the Data Steward, and includes post-emergency testing procedures.

          Web servers that host multiple sites may not contain Confidential Data.

          All test data and accounts shall be removed prior to systems becoming active in production.

          The use of industry-standard encryption for data in transit is required for applications that process, store, or transmit Confidential Data.

          Authentication must always be done over encrypted connections. University enterprise Central Authentication Service (CAS), Shibboleth, or Active Directory services must perform authentication for all applications that process, store, or transmit Confidential or Protected Data.

          Change sentence to “Web application and transaction logging for applications that process, store, or transmit Confidential Data or Regulated Data must submit system-generated logs to the ITS Information Security Office. For more information please view UConn’s Logging Standard.

          Departments implementing applications must retain records of security testing performed in accordance with this policy.

          Policy Created: May 16, 2012