07.100.05 Employees' Incidental Personal Use of Electronic Resources

CIO

Approved by the CIO August 1, 2019; Approved by Board of Trustees August 3, 2007; revised July 18, 2007; reformatted May 25, 2005; approved by Board of Trustees October 28, 2004; revised October 23, 2003; effective January 18, 2002; replaced policy ITS 1.00

UNC System Office Policy Manual, Chapter 1400 “Information Technology";       International Organization for Standardization ISO/IEC 27002

Policy 07.100 Responsible Use of Information Technology Resources

Information Technology Services

Policy Details:

1. Purpose

   This policy provides notification to employees and sets forth the university’s expectations regarding the personal use of information technology resources. The university owns the information technology resources provided to employees, which include computers, software, servers, Networks, personal devices and other technology. Accordingly, this equipment constitutes State of North Carolina property. Employees have no ownership interest in the information technology equipment and no expectation of privacy for information sent or received through this equipment. Incidental personal use is allowed in limited circumstances as described in this policy.

2. Policy

   1. The information technology equipment and services provided to employees—including information sent or received through this equipment—are for official university business. Employees may use this equipment for minimal personal communications as long as this usage does not interfere with their work obligations; interfere with the work of other employees or students; interfere with obligations of the university; result in a direct cost to the university; state or imply university sponsorship or endorsement; result in commercial gain or profit other than allowed under the university’s intellectual property policies and external professional activities for pay; or impact the integrity or viability of the equipment or the Networks to which it is attached.

   2. Employees have no expectation of privacy with regard to this equipment or information.

   3. The university may monitor or review employees’ personal usage and the information sent or received to ensure compliance with this policy and consistency with Policy 07.100.04 Privacy & Confidentiality.

   4. In the event that the university is notified of an actual or potential claim, grievance, lawsuit or other legal action, the general counsel shall notify in writing the relevant employees and the IT Security Officer to preserve any and all electronically stored information, which may include personal information contained, maintained and stored on the university’s information technology resources. Employees are required to cooperate in all such directives and must not delete, overwrite or otherwise destroy any such electronic information. This obligation overrides the records retention schedule.