Information Technology (IT) Regulations

The School will take all lawful measures to protect and restore the security of its IT facilities, including data, hardware, and software. Any breach of IT regulations or related provisions will be addressed through the School’s processes, which may include disciplinary action. The School may access IT facilities for investigation as permitted by law. Penalties for breaches may include withdrawal of services, disciplinary action, legal enforcement, or termination of contracts for third parties. Offensive materials will be removed, and any suspected unlawful activity will be reported to the police or relevant enforcement agencies. The School will also report breaches of third-party regulations to the relevant organisation and recover any costs incurred due to infringements.

Subject to any liability the School cannot exclude or limit by law, the School is not liable for any loss or damage arising from the use or withdrawal of its IT facilities, including data and equipment.

All users must adhere to cyber security best practices at all times. When creating passwords, use strong password guidelines. If available, register for and utilise 2-factor authentication. Change your password immediately if you suspect it has been compromised. Avoid using the same password or pattern across multiple sites. Never leave logged-in computers unattended, and ensure you log out properly when finished. If using a password manager, do not log in on School IT equipment. Report any suspected security incidents or compromises involving your credentials, device, data, or IT facilities to dataprotection@lsi.ac.uk immediately.

The School’s IT facilities include:

• Hardware and software provided by the School (e.g., PCs, laptops, tablets, smartphones, printers, operating systems, web browsers, online services).
• Software or online services arranged by the School (e.g., special deals for students on commercial application packages).
• Data provided or accessed through the School (e.g., online journals, data sets, citation databases).
• Network access provided by the School (e.g., Wi-Fi, Ethernet, mobile).
• IT credentials issued by the School (e.g., School login or other tokens).

All use of these facilities is subject to external and internal regulations, including data protection, copyright, and defamation laws, as well as School policies.

Users must read, understand, and adhere to these regulations fully. Ignorance of the law does not excuse unlawful conduct. When accessing services from abroad, users must comply with both local and English laws, alongside School regulations. For third-party online services, users should follow the respective terms and conditions, whether accessed directly, through the School, or via agreements like those with Jisc. Violations of law or third-party regulations will be considered breaches of these IT regulations.

Users must not compromise the IT infrastructure's integrity. Specifically, you must not:

• Damage, reconfigure, or move equipment.
• Risk damaging the infrastructure by being careless with food or drink near computers.
• Load software onto School equipment unless authorised.
• Reconfigure or connect equipment to the network, such as adding Wi-Fi access points or repeaters.
• Set up servers or services on the network, including game servers, file-sharing services, or websites.
• Deliberately or recklessly introduce malware.
• Attempt to disrupt or bypass IT security measures.

Additionally, users must:

• Take all reasonable precautions to avoid introducing malware.
• Keep anti-virus software up to date and active, and perform regular scans of your computer.

The School monitors and logs IT facility usage for the following reasons:

• Ensuring the effective operation of IT facilities.
• Managing School activities during employee absences.
• Addressing data subject requests.
• Detecting, investigating, or preventing misuse or breaches of School regulations.
• Investigating alleged misconduct.
• Complying with legal and audit requirements, including PCI-DSS and Prevent Duty.
• Meeting lawful requests from law enforcement or government agencies for crime detection, investigation, or national security.

For further details, contact the authority mentioned in these regulations.

Users must not monitor IT facility usage without explicit authorisation from the Chief Technology Officer. This prohibition includes:

• Monitoring network traffic
• Discovering network devices
• Capturing WiFi traffic
• Installing key-logging or screen-grabbing software that affects other users
• Accessing system logs, servers, or network equipment

To access IT facilities, users must protect their IT credentials, which may include usernames, passwords, email addresses, smart cards, or other identity hardware issued by the School.

Follow these guidelines to safeguard your credentials:

• Never write them down or store them in unprotected files.
• Do not disguise or hide your real identity when using IT facilities.
• Do not share your credentials with anyone. No one is authorised to ask for your password.

Do not attempt to impersonate others, obtain or use someone else's credentials, or corrupt or destroy anyone else’s credentials.

Under the Data Protection Act, all users (staff, students, etc.) must protect sensitive or confidential information. This includes:

• Records with personally identifiable information (PII) such as student records, personnel records, medical records, disciplinary records, and recruitment records.
• Commercially sensitive information or intellectual property of the School, such as exam papers, research documentation, etc.
• Sensitive information from third parties provided to the School for specific purposes.

If your role involves handling such information, familiarise yourself with relevant legislation, data and cyber protection regulations, and School policies, such as the Research Ethics and Governance Code of Practice. Adhere to all provisions to ensure the confidentiality and protection of this information.

All devices used to access protected data must:

• Have a password, PIN, biometric, or other secure access mechanism upon startup.
• Be set to sleep or hibernate within 15 minutes of inactivity and require re-authentication upon waking.
• Not have security codes revealed to others unless required by a legal investigation.
• Not be shared unless designated as a shared device by the School.
• Be secured against loss or theft; report any loss or theft immediately to your line manager and the IT Service Desk. The IT Service Desk will then remotely erase all School-related data if possible.
• Be returned to your line manager for a reset if the device is to be replaced or is no longer needed, to ensure all settings and data are deleted.

• Do not connect School-owned devices to unsecured or unknown Wi-Fi networks. Ensure the network name is correct and not a misleading imitation (e.g., 'Eduroam' rather than '_!Eduroam').
• Avoid working in public locations where your screen is visible and refrain from discussing confidential information in public.
• Always lock your computer or device when left unattended, even briefly.
• Do not access protected information on personal devices or any device not provided by the School, as these may not be free from malware and could retain sensitive data in their history.

• Always encrypt protected information before sending it electronically.
• Send the encryption key through a separate channel, such as SMS.

• Do not store protected information on removable or portable devices (e.g., laptops, tablets, smartphones, USB sticks) unless encrypted. Keep the encryption key secure and out of sight when not in use.
• Avoid storing protected information in personal cloud services (e.g., Dropbox, Google Drive) not provided by the School.
• Do not leave confidential paper documents on desks overnight. Lock them away when not in use.
• Collect printed documents immediately. Shred paper with protected information when no longer needed.

Please consult the School's Data Protection Policy for comprehensive information on the legal and regulatory requirements that must be followed. Adhere to all stipulations set out in the policy to ensure compliance with data protection laws and other relevant regulations.

To publish information, all users must adhere to the School’s regulations and policies, including these IT regulations. If you have any questions, consult the authority mentioned in these IT regulations.

Specifically:

• Do not make statements that purport to represent the School without written approval from the Marketing Department.
• Do not publish information on behalf of third parties using the School's IT facilities without approval from the Director of Operations.

Infringement of copyright or violation of software licences is strictly prohibited. Users must comply with copyright and licensing regulations when using the School's electronic resources. It is essential to familiarise yourself with the specific regulations from the respective providers.

Almost all published works are protected by copyright. Just because material (such as images, text, music, or software) is accessible online does not mean you can use it freely. You are responsible for ensuring that you have the right to use copyrighted material.

For any doubts or questions regarding copyright or licensing, consult the authority mentioned in these IT regulations.

Users must not access, delete, modify, or disclose information belonging to others without their consent or written permission from the School’s Data Protection Officer. For any questions, contact the authority mentioned in these regulations.

Certain exemptions apply:

• Access by IT or Compliance Staff: Authorised IT or compliance staff may access private information under specific circumstances defined by institutional or legal processes.
• Information Retrieval: If a School employee who created or manages information is unavailable, the department head may request the retrieval of the information. Care must be taken to avoid accessing private data or compromising account security.

Users must adhere to the licensing and usage conditions for the School's library and other resources. Specifically:

• Do not share licensed materials with anyone other than authorised users.
• Do not upload content from licensed materials to social media sites.
• Do not alter or create new versions of licensed materials without permission.
• Do not tamper with copyright notices in licensed materials.
• Do not use licensed materials for commercial purposes.
• Do not extensively or systematically download, reproduce, or distribute licensed materials.

The School may update its terms of use without prior notice. Continued use of the library and resources after changes signifies acceptance of the new terms. The School is not liable for misuse of its resources. If you violate copyright or licensing regulations and the School faces a claim, you must indemnify the School. Breaching these terms may result in suspension or exclusion from using the library and other resources.

The Chief Technology Officer is responsible for these regulations and may delegate this authority to others.

The School’s IT facilities are provided to support School work. Personal or third-party use of these facilities must be avoided. The School disclaims any liability for issues arising from such use.

Users of the School’s IT facilities are provided access through usernames, passwords, security keys, and tokens. These credentials are for individual use only and must not be shared unless explicitly authorised. Access to the School's Online Library and electronic resources is restricted to authorised users, who must not share their access credentials. Attempting to use IT facilities without proper authorisation may be a legal offence under the Computer Misuse Act. For any doubts about authorised use, contact servicedesk@lsi.ac.uk.

The School’s IT facilities must be used reasonably, lawfully, and with proper etiquette. Abusive, inconsiderate, discriminatory, or similar behaviour will not be tolerated and may result in enforcement action.

Specifically, do not:

• Cause undue offence, concern, or annoyance to others.
• Create or transmit defamatory, fraudulent, obscene, or offensive material.
• Send spam or unsolicited bulk emails.
• Interfere with others' legitimate use of IT facilities.
• Occupy specialist facilities unnecessarily if others need them.
• Recklessly consume excessive IT resources, such as processing power, bandwidth, or paper.
• Create, download, store, or transmit unlawful, indecent, offensive, threatening, or discriminatory material.

A security incident is any event that breaches these regulations or information protection procedures. A security weakness could lead to an incident if not addressed.

Report any security incident or weakness immediately to management upon becoming aware or suspicious of it. This includes any concerns about breaches or vulnerabilities. 

Such incidents and weakenesses include not only obvious thefts but also the following examples:

• Breaches of Confidentiality:

  • Accessing information you should not (e.g. payroll details).
  • Finding personal information in an unsecured email attachment.
  • Losing or having a laptop, phone, or access badge stolen.
  • Discovering confidential papers on an unattended desk or printer in a public area.
  • Finding an open window or unset alarm upon arriving at the office.

• Breaches of Integrity:

  • Noting incorrect records in a database.
  • Discovering that a file on the shared drive will not open.
  • Finding that paper records are missing from their expected location.

• Breaches of Availability:

  • Encountering an unavailable system or application.
  • Being unable to find important information, such as a contract.

This list is not exhaustive.

Report any suspected breach immediately to dataprotection@lsi.ac.uk. Provide as much detail as possible about what you have observed.

While the School supports freedom of speech and expression, users should consider the following before posting on social media:

• Think carefully before publishing: Social media is public and content may be permanently visible. Once posted, it cannot be removed.
• Follow standard rules: All posted content must adhere to the same rules and laws as other published materials, including confidentiality, intellectual property, and defamation laws.
• Avoid damaging the School's reputation: Association with the School is easily visible online. Ensure that any opinions or comments are clearly personal and avoid posting anything offensive, derogatory, inappropriate, abusive, discriminatory, or harassing.