Guiding Principles for Our Work:

• We (IT) will respect the confidentiality, integrity, and security of the information contained in the electronic communications, records, and applications we manage directly.  Given this, division leadership, in particular, the CIPO, is required to carefully guide the selection and stewardship of the College’s information systems with particular attention to protecting individual privacy and rights as members of the College community.
• We will not monitor or review individual users’ content unless directed as noted here.
• We will monitor the systems we manage directly for performance. As needed, we may need to address malware, viruses, or other issues that will impact the performance and security of College systems, and in that process, we may need to review – and remove – impacted files.
• Unless an investigation involves an incident that may have resulted from the functioning of IT systems, we will not expand the scope of our investigatory work beyond the specific information requested.  Our investigations into the functioning of IT systems will be guided by best practices in the IT systems and security field.
• Should we support an investigation requiring examination of IT-stewarded resources, we will hold the process, information, and resulting findings in strictest confidence.
• We will encourage full transparency of the investigation and our process with those whose information may be accessed unless such will jeopardize the investigation.

IT will support investigations that:

• Respond to a subpoena
  • Authorization by College’s legal counsel required
• Involve an alleged violation of law
  • Authorization by either Security & Protective Services as the liaison to law enforcement or the College’s attorneys required
• Involve a legal claim either against the College or against a member of the College community who is defended by College legal counsel
  • Authorization by College’s legal counsel required
• Involve an alleged violation of College policy
  • Authorization is through Human Resources in the case of an allegation involving a current or former College employee
  • Authorization is through Student Affairs in the case of an allegation involving a current or former College student

Procedure & Release of Findings

The procedure(s) we use when an investigation is undertaken depends on the nature and scope of the request.  There will be times when we will not be able to fully assist with an investigation or request, for example, when systems are outside IT’s direct management (e.g., 3^rd party managed applications, social media sites). 

What we do and what information is released depends on what content is requested, the format of storage, whether IT has access to the information (for example, 3^rd party managed applications require the investigation be conducted by the 3^rd party provider), and the specificity of the request. We consider and we ask requestors to consider and document in their request:

1. Is the request required by and consistent with law or in response to a lawful demand?
2. Is there a demonstrated reason to believe that violation of law may have occurred?
3. Is there a demonstrated reason to believe that violation of College policy may have occurred?
4. Is there a life or safety emergency?
5. Is there a compelling circumstance, including substantial risk of harm or liability to the College or a member of the College community?
6. Is the information essential to maintain the normal operation of the College?
7. Is the information essential to meeting a time-dependent, critical operational circumstance, including external or regulatory audit requirements?

Responsibilities within IT

The CIPO has responsibility for fulfilling the request with assistance of IT staff, denying the request, or conferring on the request as needed with appropriate senior staff, the President, or/and College legal counsel as appropriate.

Internal Documentation

IT will fully document the request, including written documentation provided by requestor(s), and will maintain a secure repository of such requests, documentation, communications, data, and reports.

Ed: 11 January 2021