Showing posts with label policy. Show all posts

Update to CSU Policy for Electronic and Digital Signatures

by Anonymous in , , , , , , ,

An important update to the CSU Policy for Electronic and Digital Signatures was released today, which provides some clarification for the use of electronic signatures in signing contracts and other internal and external documents.

Some notable changes includes the following language:

Electronic signatures may be used for bilateral contractual and legal documents, unilateral contracts and other University controlled documents, internal campus and Chancellor's Office forms and approvals, and external forms and approvals. 
Campuses must develop policies and procedures to identify, evaluate, and document who may use simple electronic and digital signatures and where simple electronic signatures are permitted and digital signatures are required.

Campus and Chancellor's Office policies and procedures for electronic signatures must meet CSU electronic and digital signature standards and may be used for transactions between the CSU and outside parties only when approved by the campus Vice President for Administration/CFO and when both parties have agreed to conduct transactions by digital means.

Campus and Chancellor's Office procedures must document the person by CSU position who is authorized to sign, approve, and/or prevent unauthorized actions from being taken as a result of an electronic signature.

Both the policy and the CSU Electronic and Digital Signature Standards and Procedures, 8100.S01 define the differences between electronic and digital signatures. In addition, 8100.S01 describes a risk assessment methodology that campuses may use to assess its procedures relating to electronic and digital signature.

Have questions about the differences between electronic and digital signature, and which method is appropriate? Please contact CSUCI Information Security. 

Who Owns Your Computer?

by Anonymous in , , ,

I recently received a question from a faculty member that gave me the opportunity to explain better CI's responsibilities and obligations for campus-owned computers. To paraphrase her question:

If I use my faculty startup funds to purchase a laptop or iPad, does that become property of the university? And, is the entire computer searchable under the Freedom of Information Act, or only the files/documents pertaining to work and the university? I am looking to use start-up money to replace my home laptop, which I use 99% of the time for teaching and research. However, I do store personal items on the computer (family photographs, music,  personal email, etc.), so I would like to understand the nuances of university ownership of any computers I purchase with my research start-up money. 
Here's my reply, which is valid for any computer purchased with California State University funds, regardless of the source.

Start up funds are state resources, so any equipment purchased with them is property of the State of California. Technically, you are not using the funds to purchase a laptop or iPad – you are requesting that the funds be used to purchase a computer which is then assigned to you for your use. It’s probably more than you want to read, but if you’re interested, the full policy that addresses the use of any campus computer is here - https://www.calstate.edu/hrs/policies/policies_internet_use.shtml. Bottom line - for most purposes you can treat it as your computer, but really it’s a university resource as long as university funds are used to purchase it. Storing some photos or using your computer to buy something on Amazon is not a problem – It’s called “incidental use” and it’s explicitly permitted under CSU policy.

There are a few ways documents could be searched on your computer. The California Public Records Act (our version of the federal “Freedom of Information”) states that nearly anything you create as part of your employment is available upon request (including email and other things you might consider private, with just a few exceptions). However, these requests generally have to be somewhat specific, e.g “Every document that Professor X has regarding her Intro to Algebra Class”). So I’m not aware of any case where your personal items like family photos would be part of the search.  Caroline Doll is our campus expert on CPRA so she may have additional comments.

However, there are at least 3 other situations that I can think of where we have to search computers. These are all pretty rare, but here you go. One is when there is litigation – a judge can require that we search a computer or even turn over the entire contents as part of the evidence in a legal case. Second, if for some reason the university police have cause to believe that the computer was used for a crime (even if not by you) they could ask us to search it or they could confiscate it. Third, if your computer got “hacked” we might need to search it to try to determine what had happened and also to see what information might have been compromised. As I say, these are rare, but they do occur now and then. And we would certainly do our best in such a case to respect the user’s privacy and just look for the information that we needed, but of course it’s not always easy to determine that until you look.

Thanks for offering me the opportunity to provide this clarification. When you’re ready to purchase you can find models and pricing here - http://www.csuci.edu/tc/compquotes/. Your department coordinator should be familiar with the process.