Staff

Mobile and Remote Device Security Policy

Title: Mobile and Remote Device Security, Information Technology 
Policy Owner: Information Technology Services / Chief Information Security Officer 
Applies to: All faculty, staff, student employees, and volunteers   
Campus Applicability: All campuses except UConn Health 
Effective Date: August 30, 2021
For More Information, Contact UConn Information Security Office 
Contact Information: techsupport@uconn.edu or security@uconn.edu 
Official Website: https://security.uconn.edu/

PURPOSE 

To ensure data and information systems security by establishing requirements for mobile and remote devices.  Mobile and remote devices are important tools for the University, and their use is supported to advance the mission of the university. Mobile and remote devices also represent a significant risk to information and data security. If appropriate security measures and procedures are not applied, mobile and remote devices can serve as a conduit for unauthorized access to University data and IT resources that can subsequently lead to data leakage and a path for compromise of other systems. 

APPLIES TO 

This policy applies to all University faculty, staff, student employees, and volunteers who use mobile or remote devices to access any non-public IT resources owned or managed by the University. 

DEFINITIONS 

IT Resources: Includes systems and equipment, software, and networks. Systems and equipment include but are not limited to computers, hard drives, printers, scanners, video and audio recorders, cameras, photocopiers, and other related devices. Software includes but is not limited to computer software, including open-source and purchased software, and all cloud-based software, including infrastructure-based cloud computing and software as a service. Networks include but are not limited to all voice, video, and data systems, including both wired and wireless network access across the institution. 

Mobile Electronic Device: Includes telecommunication and portable computing devices which can execute programs or store data, including but not limited to laptops, tablet computers, smartphones, and external storage devices. Generally, a device capable of using the services provided by a public/private cellular, wireless, or satellite network. 

Remote Device: Personal computer used off-site 

POLICY STATEMENT  

University of Connecticut faculty, staff, student employees, and volunteers who use mobile or remote devices are responsible for any institutional data that is stored, processed, and/or transmitted via a mobile or remote device and for following the security requirements set forth in this policy. 

To adequately protect the data and information systems of the University, all individuals covered under this policy are expected to meet the following requirements: 

All users of a mobile electronic device used to access non-public university systems must take the following measures to secure the device: 

  • Configure the device to require a password (minimum of 10 characters), biometric identifier, PIN (minimum of 6 characters), or swipe gesture (minimum of 6 swipes) to be entered before access to the device is granted. Device must automatically lock and require one of the authentication methods after no more than 5 minutes of idle time. 
  • Keep devices on currently supported versions of the operating system and remain current with published patches. 
  • Enable the device’s remote wipe feature to permit a lost or stolen device to be securely erased. 
  • Securely store electronic devices at all times to minimize loss via theft or accidental misplacement. 

    Wherever practical, elements of these requirements will be enforced via centrally administered technology controls.  

    STORAGE OF CONFIDENTIAL DATA 

    In general, confidential data should not be stored on mobile devices, including laptops. However, in certain instances and depending on job responsibilities, this may be unavoidable. In these instances, confidential data must be stored on university-owned devices ONLY with the following requirements: 

    • Except when being actively used, confidential information must at all times be encrypted on any device through a mechanism approved by the University. Alternatively, whole drive encryption software may be deployed to meet this requirement. 
    • Mobile devices must have university-supported software enabled and running to identify, protect, and respond to any threats to the data or operating systems of the devices. 
    • Devices must have Mobile Device Management software installed to facilitate device protection, including remote wipe and, if possible, device location technology for recovery. 

    DEVICE DECOMISSION OR SEPARATION FROM UNIVERSITY 

    When mobile devices, specifically personally owned devices that may have had access to University resources or data, are no longer used, and donated, or given to anyone, the device owner is responsible for ensuring that any University information is securely deleted from the device, including University-related e-mails/accounts, user ID and password, or other cached credentials used to access University systems. 

    In the event of separation from the University, it is the employee’s responsibility to delete any University-related e-mail accounts or University licensed software that may have been installed on personal devices or computers. 

    ENFORCEMENT 

    Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code. 

    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

    Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

    Information Security Office – https://security.uconn.edu 

     

    POLICY HISTORY 

    Policy created:  August 30, 2021 [Approved by President’s Senior Team] 

    System and Application Security Policy

    Title: System and Application Security Policy 
    Policy Owner: Information Technology Services / Chief Information Security Officer 
    Applies to: All students, faculty, and staff  
    Campus Applicability: All campuses except UConn Health 
    Effective Date: August 30, 2021
    For More Information, Contact UConn Information Security Office 
    Contact Information: techsupport@uconn.edu or security@uconn.edu 
    Official Website: https://security.uconn.edu/

    PURPOSE 

    To ensure the security of university data by establishing requirements for the proper maintenance and oversight of systems and applications used by university constituents. 

    APPLIES TO 

    This policy applies to all individuals responsible for operating or overseeing any University system or application, whether on premise or in the cloud. 

    DEFINITIONS  

    ITS: Information Technology Services 

    SaaS: Cloud-based service that is delivered via the web based on either a monthly or annual subscription 

    PaaS:  Cloud-based service that provides a platform allowing for the development of software using an established framework to improve development time and management of cloud services 

    PII (Personally Identifiable Information):  Information that either singularly or in conjunction with other data elements could reasonably lead to the identification of specific individuals 

    POLICY STATEMENT  

    The proper maintenance and review of systems and applications is critical to protecting the data they store or process. While requirements may vary as to the administration and operation of any system or application, the following are required of any individual responsible for a system or application related to the University of Connecticut’s computing environment, whether on-premise or in the cloud. 

    System Ownership 

    All systems supporting any aspect of the University must have an identified owner and responsible party for ensuring the controls specified in this document. For a system that is fully cloud-based, a UConn faculty or staff member is responsible for overseeing that the following controls are appropriately applied and adhered to by the cloud provider.  

    System and Application Security 

    All software and services used to process University of Connecticut information are subject to an Information Security review and sign off prior to their purchase or development. Information Security reviews will evaluate specific risks and controls available and necessary based on the information being processed. The system owner will be responsible for the deployment of the agreed upon security controls prior to enabling the production capability of the system or application. 

    Only necessary software should be loaded on systems, and old versions of software removed. The use of web browsers should be limited to the management of the system only. 

    System Access 

    Access to information in the possession of or under the control of the University of Connecticut must be provided on a need-to-know basis. Information must be disclosed only to individuals who have a legitimate and approved business need for information. Information may only be used for its intended purpose, and other uses of university information without the approval of the data owner is not allowed.  

    Patching and Maintenance 

    All individuals, including faculty, staff, or students, who have taken on or been assigned the responsibility of managing any system or application attached to the University of Connecticut network or any cloud system that holds a relationship to the University of Connecticut or holds University of Connecticut data, must ensure the timely implementation of operating systems and application patches to provide for the confidentiality, integrity, and availability of said systems or data. The ongoing maintenance of applications and the application of software updates is an activity that must be regularly scheduled on a minimum quarterly basis. ITS and many other parts of the University maintain systems to simplify the patching of operating systems. 

    Cloud-based SaaS and PaaS systems typically remove the requirement for patching and maintenance, as the responsibility for this is handled by the vendor. 

    User Management 

    University of Connecticut Information Technology Services (ITS) provides centralized user identity and access management that supports identity validation and access management (IAM) using a NetID and password. Systems and applications that rely on the University IAM platform for authenticating individual access rights can forgo the need for user management outside that of assigning any roles within the system or application, as necessary. 

    Systems and applications that do not use the central IAM solution must have a written plan and designated individual responsible for the creation, modification, and deletion of user IDs. User IDs, including student accounts, must be reviewed when faculty, staff, or students separate from the University at least annually. This includes a process for ensuring the secure creation of passwords and a secure password reset process for validating an individual’s identity prior to resetting the password. 

    Systems where individuals have access to a significant amount of the PII of other constituents, including students, faculty, staff, alumni, and vendors, or significant amounts of regulated data should leverage multi-factor authentication wherever possible. 

    Auditing of Systems and Application Logs 

    System and application logs should be reviewed for inappropriate access on a regular basis (at least monthly) or via automated systems capable of detecting misuse through the analysis of frequent password failures, geographic anomalies, or inappropriate access attempts. ITS maintains a centralized logging and reporting platform, which can assist in the analysis of large amounts of data often associated with system and application logs. 

    System and Application Lifecycle Management 

    Any system or application that is no longer supported by the vendor or is replaced by newer technology should be decommissioned as soon as possible. The proper update of systems and applications is critical to protecting the confidentiality, integrity and availability of the system or application and its data. The decommissioning process must include the proper retirement of any physical hardware or virtual images and the proper destruction of any media (e.g., hard drives, tapes, etc.) that may have data. Cloud services that are decommissioned should ensure the proper handling of any data (return and/or destruction) in the cloud vendor’s possession as part of the contract cancellation. 

    Protection of Regulated Data 

    Certain classes of information stored within University of Connecticut systems and applications have additional regulatory requirements associated with their storage and/or transmission. This data includes but is not limited to: Personally Identifiable Information (PII), including certain combinations of data regarded as sensitive PII; Personal Health Information (PHI), Payment Card Industry (PCI) information, or any information subject to the Family Educational Rights and Privacy Act (FERPA).  The University must also comply with any additional protections of information or datasets contractually required by other agencies or organizations.  

    Mandatory Reporting 

    All suspected policy violations, system intrusions, and other conditions that might jeopardize University of Connecticut information or information systems must be immediately reported to the Information Security Office. 

    ENFORCEMENT 

    Systems and applications that do not follow the standards set forth in this policy may be administratively shut down or have access restricted to on-campus or individual personnel only. Systems maintained at the departmental or individual level may incur costs in association with enabling the proper protections or in the event of data exposure. 

    Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.  

    PROCEDURES/FORMS 

    Questions about this policy or suspected violations may be reported to any of the following: 

    Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

    Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

    Information Security Office – https://security.uconn.edu 

     

    POLICY HISTORY 

    Policy created: August 30, 2021 [Approved by President’s Senior Team]

     

    Network Access Policy

    Title: Network Access Policy, Information Technology
    Policy Owner: Information Technology Services / Chief Information Security Officer 
    Applies to: All students, faculty, staff, volunteers, and contractors  
    Campus Applicability: All campuses except UConn Health 
    Effective Date: August 30, 2021
    For More Information, Contact UConn Information Security Office 
    Contact Information: techsupport@uconn.edu or security@uconn.edu 
    Official Website: https://security.uconn.edu

    PURPOSE 

    The University invests significantly in maintaining a secure network that meets the academic, research, residential, and administrative needs of the institution. To ensure compliance with applicable Federal and State laws and regulations, and to protect the campus network and the ability of the University community to use it, certain security, performance, and reliability requirements must govern the operation of these networks. 

    APPLIES TO 

    This policy applies to all University faculty, staff, students, student employees, volunteers, and contractors who have access to university networks. 

    DEFINITIONS  

    University Network: The university network is comprised of the network hardware and infrastructure and the services to support them, from the data jack or wireless access point to the University’s Internet Service Provider’s (ISP) connection. The university network begins at the connection to the network (wired or wireless) and ends where we connect to the Internet. 

    Wired Network:  The wired network consists of the physical cabling, infrastructure, and management systems that provide physical network access via an ethernet or fiber optic cable. 

    Wireless Network:  The wireless network consists of the access points (connected to the wired network), wireless spectrum, and management systems that provide services via the UConn provided wireless networks, including UConn Secure, Guest, EDUROAM, and other specialty networks. 

    POLICY STATEMENT  

    The University network (wired & wireless) is an essential resource for the University of Connecticut students, faculty, staff, and guests. The University network provides a variety of critical services that meet the academic, administrative, research and residential needs of the University. Due to the complex nature of the University’s network, Information Technology Services (ITS) is responsible for the overall design, installation, coordination and operation of the University’s network environment. 

    Wired Networks 

    • The wiring and electronic components of the network are deemed part of the basic infrastructure and utility services of the University. Installation and maintenance of that network are to be considered part of the “up front” basic required building and renovation costs and are not considered discretionary options in construction and renovation design. 
    • Standards for the network wiring, electrical components, and their enclosures are defined by Information Technology Services (ITS), subject to Building and Grounds (B&G) oversight and are considered part of the University’s “building code” to which installations must conform. 
    • Upgrades to our campus network will be done as part of a university-wide Network Master Plan.  This Network Master Plan will be coordinated with the University’s Building Master. 
    • Units that would like to use their own funding to install wired/wireless technology or change the programmatic function or use of a room to newly include a wired/wireless activity must work directly with ITS Network Engineering for design services and standards requirements. ITS Network Engineering will thereby ensure that all changes to the wired network conform to applicable standards. 
    • Units choosing to install and establish their own security using local firewalls and/or VPNs must give ITS Network Engineering and Information Security access to/through these devices into the active network segments. This will give Network Engineering the ability to see beyond the secure points of the network for diagnosing problems potentially affecting the overall network. 
    • Units wishing to design, install and maintain their own network must have their designs reviewed by ITS Network Engineering. All installations must conform to the standards set forth in the ITS Design Guide and Standards. Before equipment is purchased, the requesting entity must submit technical specifications of the equipment to be used in the project, along with the logical and physical design maps, for ITS approval to ensure network compatibility and service conformance. ITS Network Engineering will provide the department with an approval letter, which can be submitted to Purchasing with the purchase request. 

      Wireless Networks 

      • The addition of new wireless access points on the University network must be coordinated and approved by ITS.  Wireless performance is impacted by the architectural features, building materials, and furnishings of a contemporary workspace.  Construction and renovation projects must be coordinated with ITS and include funding for additions or adjustments required to optimize performance and serviceability of impacted wireless access points and systems. 
      • On an exception basis, departments and individual faculty may install and manage wireless access points for specific programmatic needs. These locally administered wireless access points must be registered and coordinated with ITS prior to deployment to prevent radio frequency (RF) interference on either wireless network.  At least one individual in the requesting department must be designated as the official contact for the access point.  The official contact is responsible for the data and network traffic that traverses through the access point and appropriate access control and security configurationas well as the regular maintenance, software updates, and replacement. 
      • Any devices either not part of or that cause significant RF interference with the University wireless network will be considered a “rogue” access point or device.  ITS will pursue all reasonable efforts to contact the owner of the rogue device, and if necessarymay disable or disconnect them from the University network. This includes devices and equipment that operate in the frequency ranges occupied by the University Wi-Fi network. 

      ENFORCEMENT 

      Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.  

      Questions about this policy or suspected violations may be reported to any of the following: 

      Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

      Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

      Information Technology Services CIO – https://cio.uconn.edu  

       

      POLICY HISTORY 

      Policy created:  This policy replaces the Wireless Network Policy (05/15/2006) and Physical Network Access Policy (11/18/2008). Approved by President’s Senior Team 8/30/2021. 

       

      Firewall Policy

      Title: Firewall Policy 
      Policy Owner: Information Technology Services / Chief Information Security Officer 
      Applies to: All students, faculty, and staff responsible for configuring firewalls 
      Campus Applicability: All campuses except UConn Health 
      Effective Date: August 30, 2021
      For More Information, Contact UConn Information Security Office 
      Contact Information: techsupport@uconn.edu or security@uconn.edu 
      Official Website: https://security.uconn.edu/

      PURPOSE 

      To ensure a common set of firewall configurations across the organization to maximize their protection and detection capabilities in support of the security of the University. Firewalls provide a valuable protection and detection capability for the organization when properly configured, managed, and monitored.  

      APPLIES TO 

      This policy applies to all University faculty, staff, students, student employees, volunteers, and contractors who have responsibility for controlling or configuring firewalls. 

      DEFINITIONS 

      EOL: End of Life 

      EOS: End of Support 

      IANA: Internet Assigned Numbers Authority (iana.org)  

      POLICY STATEMENT  

      The University operates in a highly flexible and adaptive security environment to meet its academic, research, and administrative missions. While the ability to adapt to meet the ever-changing needs of the University is important, oversight and reporting of firewall activities are critical to the successful protection and operation of the University environment. The following firewall requirements must be met: 

      Firewall Configuration Standards 

      • All firewalls must be properly maintained from a hardware and software perspective. This includes proper lifecycle planning for EOL and EOS software/hardware and regular review (at least annually) of firewall rulesets. 
      • All dedicated firewalls used in production must follow the University firewall management standard, which includes the ability to review currently configured firewall rules across the organization, identification of shadow or redundant rules and rules in conflict, and standardization of device/object names.  
      • Firewall rulesets and configurations must be backed up frequently to alternate storage (not on the same device). Multiple generations must be captured and retained in order to preserve the integrity of the data, should restoration be required. Access to rulesets, configurations and backup media must be restricted to those responsible for administration and review. 

      Firewall Rules 

      Firewall rules specify (either allow or deny) the flow of traffic through the firewall device. Firewall rules are typically written based on a source object (IP address/range, DNS Name, or group), destination object (IP address/range, DNS Name, or group), Port/Protocol and action. 

      • All firewall implementations should adopt the principal of “least privilege” and deny all inbound traffic by default. The ruleset should be opened incrementally to only allow permissible traffic. 
      • Outbound traffic should be enumerated for data stores, applications, or services 
      • Overtly broad rules may be allowed for specific groups of individuals (not systems). Approval must be granted by the Chief Information Security Officer or their designee. 
      • The use of overly permissive firewall rules is prohibited (i.e., ANY/ANY/ALL rules). 
      • Protocols defined in services and in the firewall must utilize Service Name and Protocol/Port information as assigned by IANA, unless there is a technical reason to do otherwise other than “security through obscurity” and must be commented appropriately in the ruleset.  

        Firewall Logging 

        Firewall log integrity is paramount to understanding potential threats to the network. Firewall devices must log the following data to a system outside of the physical firewall itself and must be regularly reviewed at least monthly or programmatically through automated means. Firewall logs may be forwarded to the ISO SIEM for retention and analysis. 

        The following items must be logged as part of the operation of the firewall: 

        • All changes to firewall configuration parameters, enabled services, and permitted connectivity 
        • Any suspicious activity that might be an indicator of either unauthorized usage or an attempt to compromise security measures 

        ENFORCEMENT 

        Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the Student Code.  

        Questions about this policy or suspected violations may be reported to any of the following: 

        Office of University Compliance –  https://compliance.uconn.edu (860-486-2530) 

        Information Technology Services Tech Support –  https://techsupport.uconn.edu (860-486-4357) 

        Information Security Office – https://security.uconn.edu 

         

        POLICY HISTORY 

        Policy created: August 30, 2021 [Approved by President’s Senior Team]

        Mandatory Workforce COVID-19 Vaccination Policy

        Title: Mandatory Workforce COVID-19 Vaccination Policy
        Policy Owner: Human Resources
        Applies to: All employees, including volunteers and contractors
        Campus Applicability: All campuses, excluding UConn Health
        Effective Date: August 18, 2021
        For More Information, Contact Human Resources
        Contact Information: HR@uconn.edu
        Official Website: https://hr.uconn.edu/

        PURPOSE 

        UConn is committed to protecting our students, employees, and our communities from COVID-19. Toward that goal, and in consideration of guidance released by the state of Connecticut, the U.S. Centers for Disease Control and Prevention (CDC), and a variety of public health authorities and professional organizations, UConn is implementing a mandatory vaccination policy for its workforce.

        APPLIES TO

        The Mandatory Workforce COVID-19 Vaccination Policy applies to all Workforce members (see definition below)[1]. This policy applies to Workforce members regardless of whether they work on-site or remotely, unless the individual qualifies for an exemption as provided herein. Exemptions may be granted to Workforce members (1) who have certain medical conditions; or (2) on the basis of a strong religious or sincerely held belief. Workforce members who are denied an exemption shall have ten (10) days from the date of the notice of the denial to receive the vaccine (either a single dose vaccine or first dose of the 2-dose vaccine). Deferral of the receipt of the vaccine may be granted to Workforce Members (1) who have certain medical conditions; (2) who are on approved block FMLA or supplemental leave; (3) due to a positive COVID test or treatment; or (4) due to current pregnancy or breastfeeding.

        DEFINITIONS

        Workforce Members: All UConn employees, volunteers, and any contracted individuals.

        COVID-19: COVID-19 is a respiratory disease caused by SARS-CoV-2, a new coronavirus discovered in 2019. The virus is thought to spread mainly from person to person through respiratory droplets produced when an infected person coughs, sneezes, or talks.

        Fully Vaccinated: Individuals are considered fully vaccinated 1) two weeks after their second dose in a 2-dose series (such as the Pfizer or Moderna vaccines); or 2) two weeks after a single-dose vaccine (such as Johnson & Johnson’s Janssen vaccine).

        International employees shall be considered in compliance with the COVID-19 vaccine requirement if they have been vaccinated with a COVID-19 vaccine that has either been authorized for emergency use in the United States by the Food and Drug Administration (FDA) or been authorized for emergency use outside of the United States by the World Health Organization (WHO).

        POLICY STATEMENT

        All Workforce members are required to have or obtain a COVID-19 vaccination as a term and condition of employment at UConn, unless an exemption or deferral has been approved. All Workforce members shall be required to report their vaccine status and to provide approved documentation as proof of vaccination.  All current employees shall be required to report their status not later than September 10, 2021.  All new Workforce members shall be required to provide proof of their vaccination status prior to the start of their employment.  All records of vaccinations and approved exemptions will be maintained by Human Resources. Such records will not be included in Workforce members’ personnel files.

        ENFORCEMENT

        Violations of this policy or associated procedures may result in appropriate disciplinary measures, up to an including dismissal, in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, other applicable University Policies, or as outlined in any procedures document related to this policy.

        PROCEDURES/FORMS

        Procedures and forms associated with this policy are available on the Human Resources website.

        REFERNCES

         

        [1] Workforce members represented by bargaining units under the jurisdiction of the State’s Office of Labor Relations (OLR-OPM) are not currently subject to mandatory vaccination requirements of this policy until negotiations have concluded. They are subject to the mandatory reporting, testing and health and safety requirements if unvaccinated.

        Information and Communication Technology (ICT) Accessibility Policy

        Title: Information and Communication Technology (ICT) Accessibility Policy
        Policy Owner: Information Technology Services
        Applies to: Faculty, Staff, Students
        Campus Applicability: Storrs and Regional Campuses
        Effective Date: July 24, 2019
        For More Information, Contact Information Technology Services-IT Accessibility Coordinator
        Contact Information: itaccessibility@uconn.edu; (860) 486-9193
        Official Website: accessibility.its.uconn.edu

        Background and Reason for the Policy: The University of Connecticut is committed to accessibility of its digital information, communication, content, and technology for people with disabilities, in accordance with federal and state laws including the Americans with Disabilities Act, Section 504 of the Rehabilitation Act of 1973, and the State of Connecticut’s Universal Website Accessibility Policy for State Websites.

        Policy Purpose: The purpose of this policy is to set expectations that digital information, communication, content, and technology be designed, developed, and procured to be accessible to people with disabilities.

        Policy Applicability: This policy extends to the procurement, development, implementation, and ongoing maintenance of the University’s information and communication technologies at Storrs and Regional Campuses.

        Policy Statement: The University of Connecticut is committed to achieving equal opportunity to its educational and administrative services, programs, and activities in accordance with federal and state law.  Providing an accessible information, communication, content, and technology experience for people with disabilities is the responsibility of all University administrators, faculty, staff, students and those who maintain externally facing University websites.

        Procedures: See Procedures (https://accessibility.its.uconn.edu/ict-policy-procedures/).  Any issues or questions should be addressed to ITAccessibility@uconn.edu.

        Exceptions: Requests for exceptions to this policy must be submitted to the IT Accessibility Coordinator. Individuals requesting an exception must provide a plan that would provide equally effective alternative access, unless such an alternative is not possible due to technological constraints or if the intended purpose of the technology (e.g., virtual reality goggles) at issue does not allow for an alternative

        Policy History:

        Adopted 07/24/2019 [Approved by the President’s Cabinet]

        Leave Benefits for Managerial and Confidential Exempt Employees

        Title: Leave Benefits for Managerial and Confidential Exempt Employees
        Policy Owner: Human Resources
        Applies to: Management and Confidential (except as noted)
        Campus Applicability: All Campuses (Storrs, Regionals, Law, UConn Health)
        Effective Date: July 1, 2019
        For More Information, Contact Human Resources
        Contact Information: (860) 486-3034
        Official Website: https://www.hr.uconn.edu/

        Please click here to access procedures related to this policy.

        This policy sets forth leave benefits for managerial and confidential employees of the University, including non-represented faculty with an academic title.[1]

        The benefits outlined below are identical, except where noted, for all exempt and non-exempt, non-represented groups who are unclassified managerial and confidential state employees at the University of Connecticut. They derive from State of Connecticut benefits or statutory language specific to higher education, in addition to Board of Trustee actions.

        Vacation, personal, and sick times granted and accrued are prorated based on percentage employed.

        Vacation

        Managerial and confidential employees can accrue twenty-two (22) days of paid vacation leave in each calendar year.[2] Vacation is accrued either bi-weekly or monthly during the time of an appointment. It is expected that vacation will be taken within the year in which it is accrued. It is recognized that circumstances may arise that limit an employee’s ability to utilize all vacation time in any given year. Employees may carry over vacation days from year-to-year to a maximum of sixty (60) days. Employees may request approval from the appropriate Division Head (President, Provost, Executive Vice Presidents), and in the case of the President, from the Board of Trustees, to carry over accrued vacation in excess of sixty (60) days up to a maximum of one hundred twenty (120) days, consistent with the State of Connecticut’s vacation accrual cap.

        Upon leaving the University or returning to a faculty position (for managerial employees with academic titles), an employee shall be paid for their accrued vacation time up to a maximum of sixty (60) days.

        In general, the University acknowledges the unused vacation leave balances of employees entering UConn service from another Connecticut state agency.

        Holidays

        Managerial and confidential employees receive twelve (12) paid State holidays. Holidays, which do not conflict with the academic calendar or operational needs, as appropriate, may be taken off as a day off with pay.  If an employee works on the holiday they shall be granted a compensatory day off in lieu thereof. Holiday compensatory time is earned and recorded on an employee’s time and attendance record. Holiday compensatory time must be used by the end of the calendar year following the year in which it was earned. For example, an employee who earns holiday compensatory time for working on a holiday in Year 1 must use that holiday compensatory time before the close of Year 2, the next calendar year.

        Upon leaving the University or returning to a faculty position (for managerial employees with academic titles), an employee shall be paid for their unexpired compensatory holiday time.

        Personal

        Personal leave time of two (2) days is granted to managerial and confidential employees at the beginning of each fiscal year, July 1.[3] Personal leave is not accrued and must be used in the fiscal year in which it was granted.  Personal leave time not used within the fiscal year will be forfeited.

        Sick

        Managerial and confidential employees are granted sick leave of fifteen (15) work days at the beginning of each fiscal year, July 1.3 Sick leave is treated “as if accrued,” and is available for use by such employee for personal illness, personal medical appointments, and other provisions outlined within this policy. Any sick leave not utilized in a fiscal year will continue to be available “as if accrued” solely for use by the employee during their tenure at the University. “As if accrued” sick leave shall not be paid out to an employee upon departure or retirement from the University. Employees may use “as if accrued” sick leave balances for personal or family medical illness or appointments and funeral leave, consistent with the yearly limits of this policy.

        Effective July 5, 2019, all managerial and confidential employees at UConn Health will cease accruing sick leave days. At the beginning of the first pay-period in July, sick leave is granted as 15 days. Sick leave is treated “as if accrued,” and is available for use by such for personal illness, personal medical appointments, and other provisions outlined within this policy. Any sick leave not utilized in a fiscal year will continue to be available “as if accrued” solely for use by the employee during their tenure at the UConn Health. “As if accrued” sick leave shall not be paid out to an employee upon departure or retirement from UConn Health. Employees may use “as if accrued” sick leave balances for personal or family medical illnesses or appointments and funeral leave, consistent with the yearly limits of this policy. UConn Health managerial and confidential employees with accrued sick leave balances on the books as of July 4, 2019, may retain such sick leave for use in accordance with UConn Health policy. A managerial or confidential employee with any remaining accrued pre-July 5, 2019 sick leave balances shall be paid out at the rate of 25% of the total of such accrued sick leave balance or sixty (60) days whichever is less as of the date of retirement or death of the employee.

        In general, the University acknowledges the unused accrued sick leave balances of employees entering UConn service from another Connecticut state agency, and the University treats such balances similar to UConn Health employees noted above.

        Funeral

        Funeral leave of up to five (5) days of sick leave per occurrence may be used for a death in the immediate family. Immediate family means husband, wife, mother, mother-in-law, father, father-in-law, brother, brother-in-law, sister, sister-in-law, child and any relative who is domiciled in the employee’s household. Funeral leave of up to one (1) day of sick leave per occurrence may be used for a death outside of the immediate family.

        Sick Family

        Sick leave of up to ten (10) days may be utilized for the illness of one’s spouse, child, or parent. Child means biological, foster, adopted, or step-child residing the employee’s household. Parent means mother, father, mother-in-law, or father-in-law of the employee.

        Donating Time

        Managerial and confidential employees may donate accrued vacation, personal, or holiday compensatory time to another non-represented managerial or confidential employee who is absent due to a long-term illness or injury. The absent employee must have exhausted all paid leave time and be on leave without pay status to be eligible for such donation.

        UConn – Managerial and Confidential Exempt Employee Leave Donation Form

        UConn Health – Managerial and Confidential Exempt Employee Leave Donation Form

        Non-Exempt Compensatory Time

        Confidential employees who are non-exempt, as defined in the Fair Labor Standards Act earn compensatory time[4] for working above 40 hours per week.

        [1] Non-represented faculty at UConn Health follow the By-Laws of the University of Connecticut and the University of Connecticut Health Center Faculty Vacation and Holiday Leave Policy and are therefore excluded from all provisions of this policy. Non-represented faculty at the School of Law follow the By-Laws of the University of Connecticut and the Faculty Medical Leave Guidelines and are therefore excluded from all provisions of this policy.

        [2] For monthly accruals, managerial and confidential employees are not eligible for vacation accruals when more than 5 days (40 hours) are unpaid leave in a month. For bi-weekly accruals, managerial and confidential employees are not eligible for vacation accruals when more than 2 days (16 hours) are unpaid in a pay-period.

        [3] The annual granting of personal and sick leave will occur on July 1 for Storrs and Regional employees and at the beginning of the first pay-period in July for UConn Health employees.

        [4] Compensatory time shall be paid out in accordance with the applicable provisions of the UHP contract.

        Policy History:

        Approved by the HR Governance Group on June 25, 2019.

        Religious Accommodation Policy

        Title: Religious Accommodation Policy
        Policy Owner: Office of Institutional Equity
        Applies to: Faculty, Staff, Graduate Assistants, Students
        Campus Applicability: All Campuses
        Effective Date: August 1, 2018
        For More Information, Contact Office of Institutional Equity
        Contact Information: Storrs/Regionals: Office of Institutional Equity (OIE) (860) 486-2943 or equity@uconn.edu

        UConn Health: Office of Institutional Equity (OIE) (860) 679-3563 or equity@uconn.edu

        Official Website: http://www.equity.uconn.edu

        A printer friendly copy of this policy is available at: https://policy.uconn.edu/wp-content/uploads/sites/243/2018/09/2018-08-01-Religious-Accommodation-Policy-Printable-Copy.pdf

        Reason for Policy

        The purpose of this policy is to set forth the University’s processes for responding to requests from students and employees for religious accommodations.  This policy is in accordance with relevant laws and regulations regarding religious beliefs.

        Applies to

        All faculty, staff and students on all Campuses.

        Definitions

        Essential Function: A fundamental job duty of an employment position for staff and faculty, or a fundamental academic element of a course or program of study for a student.

        Religious Accommodation: A reasonable change in the work or academic environment that enables a student or employee to practice or otherwise observe a sincerely held religious practice or belief without undue hardship on the University. A religious accommodation may include, but is not limited to: time for prayer during a work day; the ability to attend religious events or observe a religious holiday; or any necessary modification to University policy, procedure or other requirement for a student’s or employee’s (or prospective employee’s) religious beliefs, observance or practice; provided such accommodation is reasonable and does not cause undue hardship.

        Religious Practice or Belief: A sincerely held practice or observance that includes moral or ethical beliefs as to what is right and wrong, most commonly in the context of the cause, nature and purpose of the universe. Religion includes not only traditional, organized religions, but also religious beliefs that are new, uncommon, not part of a formal religious institution or sect, or only subscribed to by a small number of people. Social, political, or economic philosophies, as well as mere personal preferences, are not considered to be religious beliefs.

        Undue Hardship: More than a minimal burden on the operation of the University. For example, an accommodation may be considered an undue hardship if it would interfere with the safe or efficient operation of the workplace or learning environment and/or would result in the inability of the employee or student to perform an essential function of the position or course of study. The University will not be required to violate a seniority system; cause a lack of necessary staffing; jeopardize security or health; or expend more than a minimal amount. The determination of undue hardship is dependent on the facts of each individual situation, and will be made on a case-by-case basis.

        Policy Statement

        The University of Connecticut is committed to providing welcoming and inclusive learning and workplace environments. As part of this commitment, the University will make good faith efforts to provide reasonable religious accommodations to faculty, staff and students whose sincerely held religious practices or beliefs conflict with a University policy, procedure, or other academic or employment requirement, unless such an accommodation would create an undue hardship.

        Consistent with state law, any student who is unable to attend classes on a particular day or days or at a particular time of day because of the tenets of a sincerely held religious practice or belief may be excused from any academic activities on such particular day or days or at such particular time of day.[1] Additionally, it shall be the responsibility of course instructors to make available to each student who is absent from academic activities because of a sincerely held religious practice or belief an equivalent opportunity to make up any examination, study or work requirements which has been missed because of such absence.

        In keeping with the University’s commitment to building and maintaining a welcoming and inclusive work environment, the University will consider religious accommodations requests by employees, including faculty and staff, based on the totality of the circumstances.

        The University of Connecticut prohibits discrimination, harassment, and retaliation on the basis of religion. For more information, refer to the University Policy Against Discrimination, Harassment and Related Interpersonal Violence.

        Enforcement

        Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the University of Connecticut Student Code.

        Policy History

        Revised 01/24/2019

        Adopted 08/01/2018 [Approved by the Board of Trustees]

         

        Procedures for Students

        The University grants students excused absences from class or other organized academic activities for observance of a sincerely held religious practice or belief as a religious accommodation, unless the accommodation would create an undue hardship.

        Students whose religious holidays are not recognized by the University’s calendar should provide the instructor or academic activity organizer with the dates they will be absent in advance of the absence.

        Students requesting a religious accommodation should make the request directly to their instructor with as much notice as possible. Students anticipating an absence or missed coursework due to a sincerely held religious practice or belief should use best efforts to inform their instructor in writing no later than the third week of class, or one week before the absence if a conflict occurs during the first three weeks of class. Being absent from class or other educational responsibilities does not excuse students from keeping up with any information shared or expectations set during the missed class(es). Students are responsible for obtaining the materials and information provided during any class(es) missed. The student can work with the instructor to determine a schedule for making up missed work.

        Procedures for Faculty / Course Instructors in Responding to Student Requests

        Course instructors are strongly encouraged to make reasonable accommodations in response to student requests to complete work missed by absence resulting from observation of religious holidays.  Such accommodations should be made in ways that do not dilute or preclude the requirements or learning outcomes for the course.

        Course instructors should bear in mind that religion is a deeply personal and private matter and should make every attempt to respect the privacy of the student when making accommodations (for example, it is not appropriate to announce to the class that a student is doing a presentation or making up an exam at a later date because of their religious observance). Course instructors should not ask a student for proof that their religious practices or beliefs are sincerely held or for determining a religious accommodation.

        Examples of religious accommodations include: rescheduling of an exam or giving a make-up exam for the student in question; altering the time of a student’s presentation; allowing extra-credit assignments to substitute for missed class work or arranging for an increased flexibility in assignment due dates; and releasing a graduate assistant from teaching or research responsibilities on a given day.

        The student should be given the opportunity to complete appropriate make-up work that is equivalent and intrinsically no more difficult than the original exam or assignment. Students who receive an exemption on religious grounds cannot be penalized for failing to attend class on the days exempted. The instructor may, however, appropriately respond if the student fails to satisfactorily complete any alternative assignment or examination.

        If there are concerns about the requested accommodation, the instructor should consult their department head (or dean in non-departmentalized schools) for assistance and determination of whether a reasonable accommodation can be provided. If an agreement cannot be reached after consulting with the department head (or dean in non-departmentalized schools), the department head will advise the dean and refer the matter to the provost or designee, who will make the final determination following consultation with the Office of the General Counsel.

        Procedures for Faculty and Staff Requesting Religious Accommodation

        Employees requesting a religious accommodation should make the request directly to their supervisor with as much notice as possible. Employees may be required to use accrued time (vacation or personal) as part of the religious accommodation. If the supervisor determines that the request may pose an undue hardship for the department and/or interfere with the employee’s essential job functions, or if the supervisor otherwise has questions or concerns about the accommodation request, the supervisor should contact the Department of Human Resources at 860-486-3034 or hr@uconn.edu (Storrs and Regionals); 860-679-2426 (UConn Health).

        Contacts:

        Students, Faculty and Staff who have questions or concerns regarding the University of Connecticut Religious Accommodations Policy may contact the Office of Institutional Equity (OIE):

        Storrs and Regionals: equity@uconn.edu or (860) 486-2943

        UConn Health: equity@uconn.edu or (860) 679-3563

        Related Policies and Guidance:

        Frequently Asked Questions Regarding Religious Accommodations

        Policy Against Discrimination, Harassment, and Related Interpersonal Violence

        Religious Holidays: Faculty and Staff Resource Guide

        [1] Connecticut General Statutes, section  10a-50 provides in relevant part:

        Absence of students due to religious beliefs. Any student in an institution of higher education who is unable [due to religious beliefs] to attend classes on a particular day or days or at a particular time of day shall be excused from any examination or any study or work assignments on such particular day or days or at such particular time of day. It shall be the responsibility of the faculty and of the administrative officials of each institution of higher education to make available to each student who is absent from school because of such reason an equivalent opportunity to make up any examination, study or work requirements which he has missed because of such absence on any particular day or days or at any particular time of day. No special fees of any kind shall be charged to the student for making available to such student such equivalent opportunity. No adverse or prejudicial effects shall result to any student because of his availing himself of the provisions of this section.

        ClinicalTrials.gov

        Title: ClinicalTrials.gov
        Policy Owner: Research Compliance Services, Office of the Vice President for Research
        Applies to: Employees, Faculty, Students, Other
        Campus Applicability:  All Campuses
        Effective Date: May 25, 2018
        For More Information, Contact Office of the Vice President for Research
        Contact Information: (860) 486-3001
        Official Website: http://research.uchc.edu/

         

        REASON FOR POLICY

        The purpose of this policy is to ensure investigators at the University comply with the requirements for registering and reporting results of clinical trials at ClinicalTrials.gov.

        The University is committed to the mission of public availability of clinical trial information and to complying with the related requirements of the Food and Drug Administration (FDA), National Institutes of Health (NIH), the Centers for Medicare and Medicaid Services (CMS) and other federal agencies and departments for using ClinicalTrials.gov.  Investigators for certain clinical trials are required to register and report results at ClinicalTrials.gov for certain clinical trials, including those involving the FDA, NIH, and CMS.  The International Committee of Medical Journal Editors (ICMJE) also imposes a similar requirement as a condition for seeking publication in participating journals.

        APPLIES TO

        All University faculty, employees, students, postdoctoral fellows, residents and other trainees, and agents who supervise or conduct clinical trials needing to be registered at ClinicalTrials.gov.

        POLICY STATEMENT

        It is the responsibility of the Principal Investigator (or other equivalent individual) supervising or conducting a clinical trial that must be registered at ClinicalTrials.gov to ensure that the registration, results reporting, related consent form and other applicable requirements are met with the required timeframes.  Any failure to fulfill these requirements may result in limitations on publications or grant submissions or other sanctions.

        The University’s Protocol Registration and Results System (PRS) Administrator within Research Compliance Services is available to provide assistance in navigating the PRS system, administering requests by ClinicalTrials.gov, and with compliance questions related to these requirements.

        ENFORCEMENT

        Violations of this policy may result in appropriate disciplinary measures in accordance with University By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, the University of Connecticut Student Code, and other applicable University Policies.

        Authority

        42 CFR part 11 (FDA)

        NIH Policy on the Dissemination of NIH-Funded Clinical Trial Information (NIH)

        Medicare Clinical Trial Policies (CMS)

        Clinical Trials (ICMJE)

        Policy History:

        Adopted: 5/25/2018 (Approved by President’s Cabinet)

        Purchasing through Collaboration Contracts

         

        Title: Purchasing through Collaboration Contracts
        Policy Owner: Procurement Services
        Applies to: Faculty and Staff
        Campus Applicability: All campuses, including UConn Health
        Effective Date: November 1, 2017
        For More Information, Contact Matthew Larson, Director of Procurement Services
        Contact Information: (860) 486-2616
        Official Website: https://procurement.uconn.edu/

        REASON FOR POLICY

        Most of UConn’s purchases are made simply to acquire good or services.  But in some instances purchases are made in the context of a broader collaboration with another higher education institution, a nonprofit organization, or an industry partner. This Policy is established pursuant to Section 2(b)(1)(C) and Section 3 of Public Act 17-130, which authorizes UConn to develop policies for purchases that are made as part of a Collaboration Contract (defined below).

        The purpose of this Policy is to establish a framework for procedures pursuant to which UConn can enter into Collaboration Contracts.  Collaboration Contracts assist UConn in pursuing its teaching, research, clinical, public service, and economic development missions. Those missions are vital to discovery, innovation, and job creation in the State of Connecticut. Making purchases effectively and prudently in the context of Collaboration Contracts will help UConn to fulfill its missions. It will also help UConn more successfully compete with other institutions for Collaboration Contracts.

        APPLIES TO

        Faculty and staff on all campuses, including UConn Health.

        DEFINITIONS

        “Collaboration Contracts” are contracts described in Section 2(b)(1)(C) of Public Act 17-130, which are contracts in which the other party agrees to provide UConn with at least two of the following: (i) philanthropic support, (ii) sponsored research, (iii) research collaborations, (iv) employment opportunities for students, or (v) some other substantial value to UConn or the state.

        “Collaborator” is UConn’s counterparty under a Collaboration Contract.

        “Purchase” is the purchase of equipment, supplies, or services, or the lease of personal property.

        “Simplified Acquisition Threshold” is a threshold set by the Federal Government for purchasing goods and services in a simplified manner that, as stated in Section 13.002 of the Federal Acquisition Regulations, “[p]romote[s] efficiency and economy in contracting” and “avoid[s] unnecessary burdens.” The Simplified Acquisition Threshold is set in Subpart 2.1 of the Federal Acquisition Regulations and is currently $150,000.

        POLICY STATEMENT

        1. The President or the President’s designee shall adopt procedures for entering into Collaboration Contracts, including identifying Collaborators. Such procedures shall be consistent with this Policy.
        2. UConn shall enter into Collaboration Contracts and make Purchases from Collaborators in a manner consistent with applicable law, provided that the following shall be exempt from CGS §10a-151b(b) and regulations adopted pursuant to CGS §4e-47:
          1. Purchases through a Collaboration Contract under which both (i) the Collaborator’s contributions have substantial market value and (ii) such market value, plus any other benefits the Collaboration Contract will provide UConn, is expected to exceed UConn’s expenditures.
          2. Purchases up to the Simplified Acquisition Threshold. UConn shall request quotations from at least three prospective vendors before making such purchases.
        3. The procedures adopted pursuant this Policy shall include a method for reporting any contract exempted under Paragraph B of this Policy that is entered into or amended. As required by Section 3(b) of Public Act 17-130, not later than January 1, 2018, and annually thereafter, such report shall be submitted to the joint standing committees of the General Assembly having cognizance of matters relating to higher education and government administration.

        ENFORCEMENT

        Violations of this Policy may result in appropriate disciplinary measures in accordance with University Laws and By-Laws, General Rules of Conduct for All University Employees, applicable collective bargaining agreements, and the University of Connecticut Student Code.

        PROCEDURES/FORMS

        Procurement- Sourcing Procedure 3.1

        POLICY HISTORY

        Approved by the Board of Trustees, November 1, 2017