Author: Brandon Murray

Multi-Factor Authentication Policy

Title: Multi-Factor Authentication Policy
Policy Owner: Information Technology Services / Chief Information Security Officer 
Applies to: All employees, students
Campus Applicability:  All Campuses
Effective Date: March 29, 2023
For More Information, Contact UConn Information Security Office 
Contact Information: or 
Official Website:


To help prevent unauthorized access to University information systems.


DUO: A Universityapproved Multi-Factor Authentication (MFA) application That provides an added layer of protection to help prevent unauthorized access to university information systems. DUO can be loaded on individual devices including smartphones and tablets. It can also provide multi-factor authentication through the sending of SMS codes directly to phones and through the use of pre-generated codes.

Fob: A small hardware device that serves as a second authentication mechanism either in place of in addition to the DUO mobile app.

University Information System: Devices and/or components managed by the University for collecting, storing, and processing data and for providing information, knowledge, and digital products. For purposes of this policy, information technology devices and components managed exclusively by UConn Health are not considered University Information Systems.

 Multi-Factor Authentication (MFA): MFA is a method of system access control in which a user is granted access only after successfully providing at least two pieces of authentication, usually including knowledge (something the user knows such as a password), possession (something the user has such as a token generator), or inherence (something the user is such as the use of biometrics).


Users of University Information Systems must adhere to Multi-Factor Authentication requirements, where available, to ensure authorized access to University Information Systems and protected or confidential data.


User Requirements

  1. Users must maintain a device that can receive DUO authentication requests in a secure manner via the DUO mobile app or another mechanism, such as SMS, phone, or token.
  2. When an attempt is made to access a DUO enabled system or application, the system will challenge the user by requesting a second factor of authentication which may include an acknowledgement of a push notification via the DUO app, a 6-digit code via SMS, or a Fob.
  3. If users receive a DUO notification when not conducting a recent authentication, the authentication should be denied and reported to the Technology Support Center

Frequency of User Challenges

The frequency with which a user may be challenged depends both on policy and use.

  • Policy based – depending on information being accessed, more frequent authentications may be required.
  • Usage based – While user challenges may be “remembered” for a period of time, use of other hardware, browsers, or other behaviors may trigger additional verification using a second factor.

Lost or Stolen Devices

If a user’s registered device is lost, stolen, or the user has reason to suspect their UConn NetID has been compromised, the user must contact the Technology Support Center immediately. As a precaution, they should change their NetID password at

Off-Hours and Emergency Access to systems and applications

UConn Information Technology Services will maintain internal procedures for processing emergency access requests if issues arise with the multi-factor authentication process. Users should contact the Support Desk for additional information.

Use of Automated Systems

Automated systems that intend to interfere with the approval component of multi-factor authentication are hereby prohibited.


Users may not attempt to circumvent login procedures, including DUO multi-factor authentication, on any computer system or otherwise attempt to gain unauthorized access. Attempts to circumvent login procedures may subject individuals to disciplinary action. Financial losses incurred due to the use of DUO multi-factor circumvention techniques are the responsibility of the user, and the University may seek financial restitution from users who violate this policy.

Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.


ITS will review and document any requests for exceptions to this standard. ITS will also have available solutions for the intermittent failure of various second factors, which may include the allowance of temporary access codes upon verification of an individual’s identity.

Questions about this policy or suspected violations may be reported to any of the following:

Information Technology Services Tech Support – (860-486-4357)

Information Security Office –


Policy created:  March 29, 2023 (Approved by Senior Policy Council)



Mobile and Remote Device Security Policy

Title: Mobile and Remote Device Security, Information Technology 
Policy Owner: Information Technology Services / Chief Information Security Officer 
Applies to: All faculty, staff, student employees, and volunteers   
Campus Applicability: All campuses except UConn Health 
Effective Date: August 30, 2021
For More Information, Contact UConn Information Security Office 
Contact Information: or 
Official Website:


To ensure data and information systems security by establishing requirements for mobile and remote devices.  Mobile and remote devices are important tools for the University, and their use is supported to advance the mission of the university. Mobile and remote devices also represent a significant risk to information and data security. If appropriate security measures and procedures are not applied, mobile and remote devices can serve as a conduit for unauthorized access to University data and IT resources that can subsequently lead to data leakage and a path for compromise of other systems. 


This policy applies to all University faculty, staff, student employees, and volunteers who use mobile or remote devices to access any non-public IT resources owned or managed by the University. 


IT Resources: Includes systems and equipment, software, and networks. Systems and equipment include but are not limited to computers, hard drives, printers, scanners, video and audio recorders, cameras, photocopiers, and other related devices. Software includes but is not limited to computer software, including open-source and purchased software, and all cloud-based software, including infrastructure-based cloud computing and software as a service. Networks include but are not limited to all voice, video, and data systems, including both wired and wireless network access across the institution. 

Mobile Electronic Device: Includes telecommunication and portable computing devices which can execute programs or store data, including but not limited to laptops, tablet computers, smartphones, and external storage devices. Generally, a device capable of using the services provided by a public/private cellular, wireless, or satellite network. 

Remote Device: Personal computer used off-site 


University of Connecticut faculty, staff, student employees, and volunteers who use mobile or remote devices are responsible for any institutional data that is stored, processed, and/or transmitted via a mobile or remote device and for following the security requirements set forth in this policy. 

To adequately protect the data and information systems of the University, all individuals covered under this policy are expected to meet the following requirements: 

All users of a mobile electronic device used to access non-public university systems must take the following measures to secure the device: 

  • Configure the device to require a password (minimum of 10 characters), biometric identifier, PIN (minimum of 6 characters), or swipe gesture (minimum of 6 swipes) to be entered before access to the device is granted. Device must automatically lock and require one of the authentication methods after no more than 5 minutes of idle time. 
  • Keep devices on currently supported versions of the operating system and remain current with published patches. 
  • Enable the device’s remote wipe feature to permit a lost or stolen device to be securely erased. 
  • Securely store electronic devices at all times to minimize loss via theft or accidental misplacement. 

    Wherever practical, elements of these requirements will be enforced via centrally administered technology controls.  


    In general, confidential data should not be stored on mobile devices, including laptops. However, in certain instances and depending on job responsibilities, this may be unavoidable. In these instances, confidential data must be stored on university-owned devices ONLY with the following requirements: 

    • Except when being actively used, confidential information must at all times be encrypted on any device through a mechanism approved by the University. Alternatively, whole drive encryption software may be deployed to meet this requirement. 
    • Mobile devices must have university-supported software enabled and running to identify, protect, and respond to any threats to the data or operating systems of the devices. 
    • Devices must have Mobile Device Management software installed to facilitate device protection, including remote wipe and, if possible, device location technology for recovery. 


    When mobile devices, specifically personally owned devices that may have had access to University resources or data, are no longer used, and donated, or given to anyone, the device owner is responsible for ensuring that any University information is securely deleted from the device, including University-related e-mails/accounts, user ID and password, or other cached credentials used to access University systems. 

    In the event of separation from the University, it is the employee’s responsibility to delete any University-related e-mail accounts or University licensed software that may have been installed on personal devices or computers. 


    Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code. 

    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance – (860-486-2530) 

    Information Technology Services Tech Support – (860-486-4357) 

    Information Security Office – 



    Policy created:  August 30, 2021 [Approved by President’s Senior Team] 

    System and Application Security Policy

    Title: System and Application Security Policy 
    Policy Owner: Information Technology Services / Chief Information Security Officer 
    Applies to: All students, faculty, and staff  
    Campus Applicability: All campuses except UConn Health 
    Approval Date: August 30, 2023
    Effective Date: August 31, 2023
    For More Information, Contact: UConn Information Security Office 
    Contact Information: or
    Official Website:


    To ensure the security of university data and systems by establishing requirements for the proper maintenance and oversight of systems and applications used by university constituents.


    This policy applies to all individuals responsible for operating or overseeing any University system or application, whether on premise or in the cloud.


    Academic / Research System: A system whose primary responsibility relates to individual academic work or research

    Administrative System: Any system that is used in support of the operation of the university excluding individual Academic / Research Systems.

    Client Network: A client network is a computer network where individual machines are connected. Client networks consume services and do not offer services to the general population

    ITS: Information Technology Services

    IT Professional: An individual (staff) who is trained and skilled in using technology to solve business problems coupled with assigned job duties in support of technology at the university. This must be a defined responsibility within the position job description and may not fall under “other duties as assigned.” Appropriate training, support, and budget must also be available in support of the IT Professional role.

    Local Network: The local network is those computers logically located in the same subnet

    SaaS: Cloud-based service that is delivered via the web based on either a monthly or annual subscription

    PaaS:  Cloud-based service that provides a platform allowing for the development of software using an established framework to improve development time and management of cloud services

    PII (Personally Identifiable Information):  Information that either singularly or in conjunction with other data elements could reasonably lead to the identification of specific individuals

    Public Availability: Services offered publicly include services offered outside of the local network

    Regulated Data: Any data that has regulations around its protection prescribed either by law or contract is automatically considered administrative data. Examples include: Personally Identifiable Information (PII), Payment Card Information (PCI), Personal Health Information (PHI) and FERPA (Family Educational Rights and Privacy Act)

    System Owner: The individual who is responsible for the planning and operation of the service. All systems must have a designated system owner.


    The proper management, maintenance and support of systems and applications is critical to protecting the data they store or process from a confidentiality, integrity, and availability perspective.

    Basic Requirements (all systems including academic, administrative and research)

    System Ownership

    All systems including cloud-based systems supporting any aspect of the University must have an identified owner and responsible party for ensuring the controls specified in this policy.

    All software and services used to process University information are subject to an Information Security review and sign off prior to their purchase or development. Information Security reviews will evaluate specific risks and controls available and necessary based on the information being processed. The system owner will be responsible for the deployment of the agreed upon security controls prior to enabling the production capability of the system or application.

    System Access

    Access to information in the possession of or under the control of the University must be provided on a need-to-know basis. Information must be disclosed only to individuals who have a legitimate and approved need for the information. For most applications, this requires the use of proper authentication methodologies and the use of Single Sign On (SSO) is encouraged.

    Information may only be used for its intended purpose, and other uses of university information without the approval of the data owner is prohibited.

    Patching and Maintenance

    All system owners must ensure the timely implementation of operating systems and application patches to provide for the confidentiality, integrity, and availability of the systems or data. The ongoing maintenance of applications and the application of software updates is an activity that must be minimally scheduled on a quarterly basis.

    System and Application Lifecycle Management

    System owners are responsible for the planning of and budgeting for system maintenance and obsolescence. Any system or application that is no longer supported by the vendor or is replaced by newer technology should be decommissioned as soon as possible.  The decommissioning process must include the proper retirement of any physical hardware or virtual images and the proper destruction of any media (e.g., hard drives, tapes, etc.) that may have data. Cloud services that are decommissioned should ensure the proper handling of any data (return and/or destruction) in the cloud vendor’s possession as part of the contract cancellation.

    Cloud based systems

    Software as a Service / Platform as a Service

    While patching and maintenance of Cloud-based SaaS and PaaS systems is typically handled by the vendor, identified individuals are responsible for proper security configurations and user management associated with providing the service. A Vendor Risk Management review is necessary for all newly procured services.

    Infrastructure as a Service (IASS)

    IAAS provides a significant amount of flexibility in the configuration and use of the platform. This requires additional expertise that requires management by an IT Professional and where applicable must meet the same requirements as Administrative Systems.

    Administrative Systems

    System and Application Security

    Administrative systems due to their complexity must be managed by an IT Professional.

    Administrative systems will be required to adhere to all regulatory requirements and meet security controls / standards as set forth by the Information Security Office based on institutional requirements.


    All systems housing administrative data are expected to have data encrypted in transit and at rest to protect data. Where available, encryption keys should reside outside of the application.

    User Management

    University of Connecticut Information Technology Services (ITS) provides centralized user identity and access management that supports identity validation and access management (IAM) using a NetID and password providing for single sign on (SSO) across multiple systems. Systems and applications that rely on the University IAM platform for authenticating individual access rights can forgo the need for user management outside that of assigning any roles within the system or application, as necessary. The use of SSO for all systems is highly recommended.

    Systems and applications that do not use the central IAM solution must have a written plan and designated individual responsible for the creation, modification, and deletion of user IDs. User IDs, including student accounts, must be reviewed when faculty, staff, or students separate from the University at least annually. This includes a process for ensuring the secure creation of passwords and a secure password reset process for validating an individual’s identity prior to resetting the password.

    Systems where individuals have access to a significant amount of the PII of other constituents, including but not limited to students, faculty, staff, alumni, and vendors, or significant amounts of regulated data require two-factor authentication wherever possible.

    Software Maintenance

    Only necessary software should be loaded on systems, and old versions of software removed. The use of web browsers and other individual productivity tools should be limited to the management of the system only.

    Auditing of Systems and Application Logs

    System and application logs must be reviewed for inappropriate access on a regular basis (at least monthly) or via automated systems capable of detecting misuse through the analysis of frequent password failures, geographic anomalies, or inappropriate access attempts. ITS maintains a centralized logging and reporting platform, which can assist in the analysis of large amounts of data often associated with system and application logs. All administrative systems must log to the centralized logging and reporting platform events related to login activity and security event data.

    Mandatory Reporting

    All suspected policy violations, system intrusions, and other conditions that might jeopardize University information or information systems must be immediately reported to the Information Security Office.


    Systems and applications that do not follow the standards set forth in this policy may be administratively shut down or have access restricted. Systems maintained at the departmental or individual level may incur costs in association with enabling the proper protections or in the event of data exposure.

    Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct, applicable collective bargaining agreements, and the Student Code.


    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance – (860-486-2530) or UConn Reportline (1-888-685-2637)

    Information Technology Services Tech Support – (860-486-4357) 

    Information Security Office – 


    Policy created: August 30, 2021 (Approved by President’s Senior Team)

    Revisions: August 30, 2023 (Approved by the Senior Policy Council and the President)


    Firewall Policy

    Title: Firewall Policy 
    Policy Owner: Information Technology Services / Chief Information Security Officer 
    Applies to: All students, faculty, and staff responsible for configuring firewalls 
    Campus Applicability: All campuses except UConn Health 
    Effective Date: August 30, 2021
    For More Information, Contact UConn Information Security Office 
    Contact Information: or 
    Official Website:


    To ensure a common set of firewall configurations across the organization to maximize their protection and detection capabilities in support of the security of the University. Firewalls provide a valuable protection and detection capability for the organization when properly configured, managed, and monitored.  


    This policy applies to all University faculty, staff, students, student employees, volunteers, and contractors who have responsibility for controlling or configuring firewalls. 


    EOL: End of Life 

    EOS: End of Support 

    IANA: Internet Assigned Numbers Authority (  


    The University operates in a highly flexible and adaptive security environment to meet its academic, research, and administrative missions. While the ability to adapt to meet the ever-changing needs of the University is important, oversight and reporting of firewall activities are critical to the successful protection and operation of the University environment. The following firewall requirements must be met: 

    Firewall Configuration Standards 

    • All firewalls must be properly maintained from a hardware and software perspective. This includes proper lifecycle planning for EOL and EOS software/hardware and regular review (at least annually) of firewall rulesets. 
    • All dedicated firewalls used in production must follow the University firewall management standard, which includes the ability to review currently configured firewall rules across the organization, identification of shadow or redundant rules and rules in conflict, and standardization of device/object names.  
    • Firewall rulesets and configurations must be backed up frequently to alternate storage (not on the same device). Multiple generations must be captured and retained in order to preserve the integrity of the data, should restoration be required. Access to rulesets, configurations and backup media must be restricted to those responsible for administration and review. 

    Firewall Rules 

    Firewall rules specify (either allow or deny) the flow of traffic through the firewall device. Firewall rules are typically written based on a source object (IP address/range, DNS Name, or group), destination object (IP address/range, DNS Name, or group), Port/Protocol and action. 

    • All firewall implementations should adopt the principal of “least privilege” and deny all inbound traffic by default. The ruleset should be opened incrementally to only allow permissible traffic. 
    • Outbound traffic should be enumerated for data stores, applications, or services 
    • Overtly broad rules may be allowed for specific groups of individuals (not systems). Approval must be granted by the Chief Information Security Officer or their designee. 
    • The use of overly permissive firewall rules is prohibited (i.e., ANY/ANY/ALL rules). 
    • Protocols defined in services and in the firewall must utilize Service Name and Protocol/Port information as assigned by IANA, unless there is a technical reason to do otherwise other than “security through obscurity” and must be commented appropriately in the ruleset.  

      Firewall Logging 

      Firewall log integrity is paramount to understanding potential threats to the network. Firewall devices must log the following data to a system outside of the physical firewall itself and must be regularly reviewed at least monthly or programmatically through automated means. Firewall logs may be forwarded to the ISO SIEM for retention and analysis. 

      The following items must be logged as part of the operation of the firewall: 

      • All changes to firewall configuration parameters, enabled services, and permitted connectivity 
      • Any suspicious activity that might be an indicator of either unauthorized usage or an attempt to compromise security measures 


      Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.  

      Questions about this policy or suspected violations may be reported to any of the following: 

      Office of University Compliance – (860-486-2530) 

      Information Technology Services Tech Support – (860-486-4357) 

      Information Security Office – 



      Policy created: August 30, 2021 [Approved by President’s Senior Team]

      The Provost’s Professional Internship Program for Public Outreach, Service, and Engagement

      Title: The Provost’s Professional Internship Program for Public Outreach, Service, and Engagement
      Policy Owner: The Graduate School
      Applies to: Graduate Students
      Campus Applicability:
      Effective Date: January 9, 2013
      For More Information, Contact Office of the Vice Provost for Graduate Education and Dean
      Contact Information: 860-486-3617
      Official Website:

      Graduate students are often supported by a graduate assistantship awarded for performing research or teaching functions at the University. The University covers tuition expenses for those students. In addition, the University may cover tuition expenses of students who are funded by a grant that does not cover the cost of the student’s tuition.

      The University recognizes the value of supporting graduate student professional development activities that extend beyond on-campus research and teaching. The Provost may determine that the University will cover tuition expenses for graduate students engaged in other activities directly related to the University’s mission and directly aligned to a student’s academic program of study. The circumstances under which the University will cover tuition expenses and provide a health insurance subsidy for such students are very limited and based on compelling evidence that the activity supports important academic objectives, such as professional internships required as an integral component of a graduate educational program. The Provost will evaluate such activities on a case-by-case basis using the following criteria:

      • The substantive focus of the graduate internship must serve a clear public service, public outreach, or engagement purpose.
      • The graduate internship’s objectives must support the academic mission of the University and align directly with the goals of the University’s Academic Plan.
      • The graduate internship must be established as a required component of the academic program in which the participating students are enrolled.
      • It must be demonstrated that the viability of the internship program is threatened if tuition is not covered.
      • The graduate internship must be credit-bearing, be directed by an instructor of record, and must require students to produce an academic work product.
      • The paid internship experience for the student must include compensation equivalent to or higher than that of a Level I graduate assistant for the academic year.
      • The graduate student interns must be placed in a sponsoring organization that provides at least partial support for the graduate student, including paying the student’s stipend and benefits.
      • The graduate students participating in the internship must serve their internships in public or nonprofit organizations with a clear public service mission.
      • The term of tuition coverage associated with a graduate internship will not exceed four semesters per student.
      • The graduate students participating in the internship must be in good academic standing.

      For student tuition to be covered and for a health insurance subsidy to be provided by the University under this program, the Dean of the School or College that houses the internship program must present appropriate justification to the Provost.

      The academic programs currently included in this program are available here.

      Relocation and Moving Policy

      Title: Relocation and Moving Policy
      Policy Owner: Office of the Provost / Department of Human Resources
      Applies to: Designated Full-time Faculty, Athletics, Librarians, Management Exempt, and Management Exempt positions with faculty titles
      Campus Applicability:  All Campuses except UConn Health
      Effective Date: February 25, 2021
      For More Information, Contact Office of the Provost or Human Resources
      Contact Information: /
      Official Website:


      The University recognizes the competitive nature of the hiring process and therefore grants the flexibility to reimburse or pay for actual relocation expenses for designated full-time faculty, athletics, management-exempt administrators.


      The relocation policy and procedures establishes the nature of expenses that can be direct billed or reimbursed from the University, limits on these expenses, and a timeframe of when these expenses can occur.


      1. In the offer of employment, the University may include an offer to reimburse and/or provide direct payment for allowable moving expenses required for relocation up to the amount specified in the table set forth in paragraph 15 herein.
      2. All reimbursement or direct payments for relocation expenses are includable in the employee’s taxable wages.
      3. Designated faculty includes tenured and tenure-track faculty, management-exempt employees with a base faculty appointment, in-residence faculty, clinical faculty, extension faculty, and  librarians.
      4. Direct billing cannot be used for moves that occur during November or December.
      5. The hiring process includes three phases: interview, offer and acceptance, and move. The final phase, the move, begins the date of the final one-way trip of the selected candidate and their  family to their new residence. The move phase ends upon the day of arrival. Only expenses incurred in connection with the move phase are covered by this policy. Common relocation expenses include (where relevant, this covers the employee and one immediate family member, defined as spouse or child):
        • Transportation of household goods
        • Airfare, in accordance with the University Travel Policy
        • Car rental (through the day of arrival), or mileage at the standard IRS medical/moving mileage rate, in accordance with the University Travel Policy
        • Lodging (only during the one-way trip of the move phase, ending on the day of arrival), in accordance with the University Travel Policy
        • Meals during travel (excluding alcohol), in accordance with the University Travel Policy
        • Shipping of car
        • Storage of household goods after arrival; not to exceed 30 consecutive days after date goods are moved from the former residence
      6. Employees will be reimbursed for the shortest, most direct route available. Travel incurred for side trips or vacations en route, etc. may proportionally reduce the amount of moving  expenses an employee is eligible to receive.
      7. The following types of non-business expenses, included but not limited to, will not be paid or reimbursed as part of relocation expenses:
        • Entertainment
        • Side trips, sightseeing
        • Violations (parking tickets, moving violations, )
        • Return trips to former residence
        • Expenses related to former residence
        • General repairs or maintenance of vehicle resulting from self-move
        • Temporary accommodation in the new location beyond the day of arrival
      8. Individuals should refer to the Reimbursement of Recruitment Expenses Policy for guidance regarding appropriate payment or reimbursement of expenses related to the “interview” and  “offer and acceptance” phases. Relocation payments are not intended to cover any travel expenses incurred during these two earlier phases.
      9. The cost associated with the relocation of a laboratory, professional library, scholarly collection and/or equipment (scientific, musical, etc.) are excluded from this policy as they are not   considered household goods or personal effects. If relevant for business purposes, costs associated with moving such materials should be negotiated separately.
      10. This policy applies to new employees whose move exceeds 50 miles and who are moving to within 35 miles of the primary campus at which they will be working. Exceptions to this rule may   be made by a Dean, the Director of Athletics, or by the appropriate EVP if a) they think that a move is reasonable given the commuting distance that the new employee would be facing, or b)   the new residence of the employee will be close enough to the primary campus at which they will be working so that they will reasonably be able to relocate there and perform their duties.
      11. Relocation expenses will only be covered by this policy if they occur within 12 months of the new start date of an employee.
      12. If employment with the University ends in a voluntary separation prior to working at least thirty-nine (39) weeks on a full-time basis in the first twelve months after starting employment,   the employee must reimburse the University the full amount of relocation expenses paid by the University.
      13. Exceptions to extend applicability beyond these employees require a business justification and must be explicitly approved by the Director of Athletics, EVP, or President as appropriate.
      14. The President will recommend an amount for reimbursement and/or direct payment for the Executive Vice Presidents/Provost to the Board. The Chairman of the Board will recommend an   amount for reimbursement and/or direct payment for the President to the Board.
      15. The formula for determining the amount to be reimbursed is based on the distance of the move. This figure represents the maximum reimbursement allowed. The allowance for a move   constitutes the maximum commitment for reimbursement of University and/or Foundation funds, rather than an entitlement of the employee. The figure is also the maximum amount the   University will pay when the direct bill option is selected. The formula is calculated according to the distance of the move, as follows:
      Mileage Reimbursement of expenses up to:
      ≤ 1,000 miles $2,000
      ≤ 1,500 miles $2,500
      ≤ 2,000 miles $3,000
      ≤ 2,500 miles $3,500
      ≤ 3,000 miles $4,000
      1. It may be the case that the competitive hiring practices of a specific field require exceptions to this policy. Exceptions that involve costs of up to 200% of the standard formula may be approved by the Dean, Director of Athletics, or EVP as appropriate. Exceptions above 200% of the standard formula or involving other requirements of the policy will require documentation of the business justification for the requested exception and these require approval by the EVP or President as appropriate.


      Relocation and Moving Procedures are located here. Upon acceptance, the University’s contracted relocation services provider, Signature Relocation, will contact the employee directly to assist the employee with their relocation.


      Violations of this policy or associated procedures may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, the University of Connecticut Student Code, or other applicable University Policies.


      Reimbursement of Recruitment Expenses, Policy on


      Policy Created:  07/01/2003 (Reimbursement of Recruitment and Moving Expenses Policy approved by Board of Trustees)


      08/07/2013 (Reimbursement of Moving Expenses Policy and Procedures approved by Board of Trustees)

      11/21/2014 (Procedural revisions to Reimbursement of Moving Expenses Policy and Procedures)

      02/24/2021 (Relocation and Moving Policy approved by Board of Trustees)

      Missing Student Policy

      Title: Missing Student Policy
      Policy Owner: UConn Police Department
      Applies to: Faculty, Staff, Students
      Campus Applicability:  Storrs
      Effective Date: August 18, 2016
      For More Information, Contact Deputy Chief Maggie Silver
      Contact Information: 860-486-4800
      Official Website:

      If a member of the university community has reason to believe that a student is missing, whether or not the student resides on campus, all possible efforts will be made to locate the student to determine his or her state of health and well-being through the collaboration of UConn Police, Dean of Students Office, Residential Life staff, and local law enforcement.

      At the beginning of each year or upon matriculation, all students are given the opportunity to identify an individual to be contacted by the University in case of emergency.

      This contact information is subject to the University’s FERPA Policy. (See:

      In addition, consistent with Clery Act requirements, all students living in on-campus housing are also given the option each year, or upon moving into on-campus housing, to designate a confidential contact for use in case the student is reported missing.  Although the same contact may be provided for both purposes, by law the missing student contact is distinct from the general emergency contact provided by all students, and is held to a higher standard of confidentiality than the general emergency contact.  It will be accessible only to authorized University personnel, and disclosed only to law enforcement personnel in furtherance of an investigation.  To help ensure timely and complete notification and investigation of all missing student situations, confidential missing student contact should be provided or updated at:

      If a member of the university community has reason to believe that any student is missing they should immediately contact UConn Police at 860-486-4800.  

      In missing persons cases, time is of the essence. Hence, we urge the community to contact UConn Police immediately upon suspicion that an individual is missing.  The UConn Police Department is committed to begin an investigation upon the first report.

      The UConn Police department will initiate formal investigation or contact the appropriate law enforcement agency.

      UConn Police will communicate and collaborate as appropriate with one or both of the following departments:

      • Dean of Students Office at (860) 486-3426
      • Residential Life Staff at (860) 486-9000

      Within 24 hours of the determination that a residential student is a missing person, UConn Police will:

      • Notify the local law enforcement agency with jurisdiction, if other than UConn Police;
      • Notify the student’s designated missing person contact;
      • If the student is under the age of 18 years and is not emancipated, notify the student’s custodial parent or guardian

      However, if the student is under 18 and is not an emancipated individual, UConn Police will notify the student parent or guardian as well as any other designated missing person contact.


      Parking and Vehicles on the Grounds of the University of Connecticut, Rules and Regulations for the Control of

      Title: Rules and Regulations for Control of Parking and Vehicles on the Grounds of the University of Connecticut
      Policy Owner: Transportation, Logistics, and Parking Services
      Applies to: Faculty, Staff, Students, Visitors
      Campus Applicability:  Storrs and Regional Campuses
      Effective Date: July 11, 2017
      For More Information, Contact Transportation, Logistics and Parking Services
      Contact Information: (860) 486- 3628
      Official Website:

      The complete Rules and Regulations for the Control of Parking and Vehicles on Campus (Revised 11.21.18) are available in PDF.

      Approved by the Board of Trustees on August 8, 2012.

      Revised July 11, 2017 and approved by the President’s Cabinet.

      Human Stem Cell Research Approval

      Title: Human Stem Cell Research Approval
      Policy Owner: Office of the Vice President for Research
      Applies to: Employees, Faculty, Students, Other
      Campus Applicability:  All Campuses
      Effective Date: May 25, 2018
      For More Information, Contact Office of the Vice President for Research
      Contact Information: (860) 486-3001
      Official Website:


      The purpose of this policy is to ensure that proposals for human embryonic stem cell (hESC) research and selected types of human induced pluripotent stem cell (iPSC) research are approved by the University’s Stem Cell Research Oversight (SCRO) Committee. This policy does not apply to primary cells isolated from human tissues that are not manipulated to become pluripotent.

      The role of the SCRO Committee is to ensure that human embryonic stem cell (hESC) and selected types of human induced pluripotent stem cell (iPSC) research at all University of Connecticut campuses is well-justified and that inappropriate and/or unethical research is not conducted. The SCRO Committee facilitates the collaboration between researchers across University campuses by adopting nationally and internationally accepted standards designed to protect the University’s reputation for ethical and responsible research.

      The review and approval of hESC research by the SCRO Committee (or its equivalent) is required by Connecticut law. The SCRO Committee review and approval is also required for all proposals funded by the State of Connecticut Regenerative Medicine Research Fund.


      All University faculty, employees, students, postdoctoral fellows, residents and other trainees, and agents who supervise or conduct research involving hESCs and select types of iPSCs.


      Human Embryonic Stem Cell (hESC): Human embryonic stem cells are pluripotent cells that are self-replicating, derived from human embryos, and are capable of developing into cells and tissues of the three primary germ layers. Although human embryonic stem cells may be derived from embryos, such stem cells are not themselves embryos.

      Human Induced Pluripotent Stem Cell (iPSC): Human induced stem cells are a type of pluripotent stem cell that have been artificially created by reprogramming non-pluripotent human cells through techniques that do not involve oocytes or embryos, e.g., through inserting genes into a somatic cell.


      All research projects in the following categories are required to obtain SCRO Committee approval before acquiring cells or cell lines and before commencing research:

      • All research involving hESCs and their derivatives;
      • All stem cell research involving human gametes and human embryos;
      • All stem cell research projects funded by the State of Connecticut, including those that do not use hESCs;
      • All in vitro human iPSC research involving the generation of gametes, embryos, or other types of totipotent cells; and
      • All in vivo research involving implantation of human iPSCs into prenatal animals or into the central nervous system of post-natal animals.

      The SCRO Committee supplements but does not replace other University review processes (e.g., reviews by Institutional Animal Care and Use Committees (IACUC), Institutional Review Boards (IRB), Institutional Biological Safety Committees (IBC), etc.) and compliance with applicable legal requirements.


      Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, the University of Connecticut Student Code, and other applicable University Policies.


      Connecticut General Statutes §§ 4-28e and 32-41jj to 32-41mm, inclusive

      NIH Stem Cell Information


      Revisions: March 28, 2012; May 25, 2018 (Approved by President’s Cabinet)

      Secure Web Application Development, Information Technology

      Title: Secure Web Application Development, Information Technology
      Policy Owner: Information Security Office
      Applies to: Students, Employees, Users
      Campus Applicability:  Storrs and Regionals
      Effective Date: May 16, 2012
      For More Information, Contact Chief Information Security Officer
      Contact Information: (860) 486-8255
      Official Website:

      This policy is available in the Information Security Policy Manual.

      Departments will ensure that development, test, and production environments are separated. Confidential Data must not be used in the development or test environments.

      Production application code shall not be modified directly without following an emergency protocol that is developed by the department, approved by the Data Steward, and includes post-emergency testing procedures.

      Web servers that host multiple sites may not contain Confidential Data.

      All test data and accounts shall be removed prior to systems becoming active in production.

      The use of industry-standard encryption for data in transit is required for applications that process, store, or transmit Confidential Data.

      Authentication must always be done over encrypted connections. University enterprise Central Authentication Service (CAS), Shibboleth, or Active Directory services must perform authentication for all applications that process, store, or transmit Confidential or Protected Data.

      Change sentence to “Web application and transaction logging for applications that process, store, or transmit Confidential Data or Regulated Data must submit system-generated logs to the ITS Information Security Office. For more information please view UConn’s Logging Standard.

      Departments implementing applications must retain records of security testing performed in accordance with this policy.

      Policy Created: May 16, 2012