Information Technology Access Control Policy

Title

University of North Carolina at Chapel Hill Policy on Information Technology Access Control

Introduction

Purpose

The University of North Carolina at Chapel Hill (“University”) has a strong interest in the integrity, confidentiality, and availability of University information and systems. Access controls protect University information by only allowing authorized people to access systems. Following this policy minimizes risk to the University resulting from unauthorized use of resources. Access control at the University happens through procedures and standards that follow this policy. The University has a layered approach to securing information systems. Access controls cover many topics. Physical controls protect IT devices. Technical and other controls protect the information on them.  

Scope

People and units at the University responsible for managing IT systems or University Data must follow this Policy. 

Policy

Policy Statement

Access controls for University information systems must balance making it difficult for unauthorized people to access our systems and easy for authorized people to use these systems. Procedures supporting this Policy should consider both business and security needs for all ways of access to each program or system. 

Access control sits beside other University Policies and IT Standards (see references below). This Policy is supporting rather than taking the place of any related University Policies, Standards, or Procedures. 

Access Rights Management

Access Controls: IT Access controls consider separation of duties (making sure it takes more than one person to do important things). Controls protect the data from mishandling and protect the system from unauthorized changes. Mission critical systems and Tier 2 or Tier 3 (Sensitive Information) systems must always have correct security controls in place. Access controls should be stronger for higher tiers of data. The Information Security Control Standard describes that. 

Processes used to give access must consider all ways access is granted. That may be quite a lot of ways with systems with many parts (“distributed systems”). 

Access Review: Have documented ways to regularly review access rights as often as it makes sense to do. Reviews for Privileged user accounts must be documented and happen regularly, following strong procedures.  

Access Termination: Have documented ways to make sure that access to systems is taken away when people are no longer allowed to use the system. When someone leaves the University for any reason, or they change job or other role, their access rights must change correctly. Those changes may be made automatic. 

Authorization: Standards or Procedures must require formal and documented ways that access requests are approved. However the approval happens, the review considers: "need to know" principles; classification of the information in the system; and contract or other legal requirements for access to system and data. When you give a user access, consider the whole range of data and functions they will have access to. 

Emergency Access: Each University business unit must have documented ways to provide needed emergency access to Mission Critical systems and applications. 

Remote Access: Tier 2 or 3 information (Sensitive Information) that can be accessed away from the University must have the same protection as information at the University. This applies to remote access to University systems, and access to remote third-party systems from any location. 

Physical Access

Standards must address requirements for the physical security of University information systems. Custodians of those systems will follow those standards. 

Tier 2 or Tier 3 information (Sensitive Information) and Mission Critical systems must be protected physically. Access to areas in which they are stored must be controlled by the technical unit or individual responsible for the area. Only authorized people may be in secure areas and only when they have a business reason to be there. 

For shared areas, containing Tier 2 or 3 information (Sensitive Information), like data centers, the IT Guardian (See University Data Governance Policy) or their delegate must have documented processes or Procedures for giving permission to be in those places (including badge access). The IT Guardian or their delegate must also have a documented way of reviewing who has that permission and if they still need it. 

Access Audit and Review

Keep records of who users are and how they are allowed access to systems following the University’s current Records Retention Schedule and any other requirements that apply. Consider the business need for logs when deciding how long to keep them. 

Make audit processes focus on how sensitive the data is. Look for ways to spot suspicious data-access activities. Investigate bad situations with important data. Respond to weaknesses you find. Consider the overall approach to security of system access. 

Exceptions

Exceptions to this Policy may be made by the Vice Chancellor for Information Technology and Chief Information Officer (CIO) or their delegate(s) in writing. Exceptions may also be in the Standard for Information Technology Access Control or other related supporting Standards or Procedures. 

Definitions

Access: Ability and means to communicate or interact with a system, to use system resources to handle information, to gain knowledge of the information the system contains, or to control system components and functions. 

Access Controls: Access controls determine who is allowed to have an account on UNC-Chapel Hill's IT systems, what they are allowed to do with their account, and how they can access the systems they have permission to use. Access controls are designed to protect people and information. 

Authentication: Verifying the identity of a user, program, process, or device, often before they are allowed to use resources in an information system. 

Authorization: Access privileges given to a user, program, device, or process or the act of giving those privileges. Privileges are no longer "authorized" when a user leaves a role upon which the permission was based (for example, leaving a job or changing to a new job with different responsibilities). 

Mission Critical: Any resource that is critical to the mission of the University. Mission critical resources can usually be down for no more than three consecutive hours. The business unit that owns the resource decides if it is mission critical is mission critical. If it is, information security policies and standards apply. This is to make sure the resource remains available. If the resource is not marked mission critical, it is not a priority for being restored if there is an incident or outage. Once designated as mission critical, heightened information security policies and standards apply to make sure that the system remains available. If a business unit does not designate a system as mission critical, it may not be a priority to take care of problems immediately. 

Role: A description of function. When someone or something is given a role, they are given certain rights that belong to that role. When the entity leaves the role, those rights are removed. The rights given are consistent with functions the entity needs to perform the expected tasks. 

Sensitive Information: Information classified as Tier 2 or Tier 3 in the UNC-Chapel Hill Information Classification Standard. 

University Data: Any data or information the University may have a responsibility to protect or disseminate. 

Related Requirements

External Regulations and Consequences

Failure to comply with this policy may put University information assets at risk and may have disciplinary consequences for employees, up to and including termination of employment. Students who fail to adhere to this policy may be referred to the UNC-Chapel Hill Office of Student Conduct. Contractors, vendors, and others who fail to adhere to this policy may face termination of their business relationships with UNC-Chapel Hill.

Violation of this policy may also carry the risk of civil or criminal penalties.

University Standards and Procedures

Contact Information

Policy Contact

Unit: ITS Policy Office

Phone: 919-962-HELP

Email: its_policy@unc.edu

Report a Violation: 919-962-HELP

100% helpful - 1 review
Print Article

Details

Article ID: 131248
Created
Thu 4/8/21 9:04 PM
Modified
Thu 12/14/23 12:05 PM
Responsible Unit
School, Department, or other organizational unit issuing this document.
Information Technology Services
Issuing Officer
Name of the document Issuing Officer. This is the individual whose organizational authority covers the policy scope and who is primarily responsible for the policy.
Issuing Officer Title
Title of the person who is primarily responsible for issuing this policy.
Vice Chancellor for Information Technology and Chief Information Officer
Next Review
Date on which the next document review is due.
12/13/2026 12:00 AM
Last Review
Date on which the most recent document review was completed.
12/13/2023 12:00 AM
Last Revised
Date on which the most recent changes to this document were approved.
11/01/2019 4:13 PM
Effective Date
If the date on which this document became/becomes enforceable differs from the Origination or Last Revision, this attribute reflects the date on which it is/was enforcable.
12/15/2020 10:51 AM
Origination
Date on which the original version of this document was first made official.
04/24/2018 12:00 AM

Related Articles (1)

To guide University Constituents in preserving the integrity, confidentiality, and availability of University information and information systems. Access controls are intended to minimize inappropriate exposure of University information by limiting system access to authorized individuals.