Welcome to Penn State Athletics!

1. Approval and adoption and revision
   Approved by the Information Technology Manager on March 17, 2023.
2. Purpose
   To manage Penn State user accounts and access to Athletics network resources.
3. Scope
   This policy applies to all users, computers and communications devices owned or operated by Intercollegiate Athletics.  This policy also applies to any computer or communications devices that are present in an Athletics facility or Athletics operated network that are not owned or operated by Intercollegiate Athletics and have a need to communicate with any Athletics operated communications device.
4. Policy
   1. Account Creation
      1. Account creation in the Enterprise Active Directory is only performed by the Penn State Accounts department and is not directly managed by Athletics IT.
      2. All classification of accounts is determined by Penn State Accounts.
      3. Access to ICA resources requires Athletics IT employees to place user accounts into appropriate Group Policy Security Groups.
   2. Account Removal
      1. Resignations
         1. User accounts are maintained by Penn State Accounts and will be disabled according to the current Penn State policies.
         2. Access to Athletics resources will be removed by removing the user’s inclusion in the appropriate Group Policy Security Groups.
      2. Terminations
         1. Terminated employees will have their account disabled at the time indicated by Human Resources.
         2. User accounts are maintained by Penn State Accounts and will be disabled according to the current Penn State policies.
         3. Access to Athletics resources will be removed by removing the user’s inclusion in the appropriate Group Policy Security Groups.
5. EAD Organizational Unit Structure
   1. User Accounts are maintained by Penn State Accounts.
   2. To control resource availability for ICA, users are placed into security groups.
      1. Athletics Employees are placed into a top-level security group that controls access to computer logins, wireless connectivity, and VPN access.
      2. Employees are placed into a departmental security sub-group that controls access to certain departmental resources such as video shares or remote terminal applications.
6. Monthly Audits
   On a monthly basis, ICA Human Resources provides a list of current Athletics employees. Athletics IT will make any changes required.

1. Approval and adoption and revision
   Approved by the Information Technology Manager on March 21, 2023.
2. Purpose
   To obtain all network access requests in electronic format and to properly handle expired accounts.
3. Scope
   This policy applies to all users, computers and communications devices owned or operated by Intercollegiate Athletics. This policy also applies to any computer or communications devices that are present in an Athletics facility or Athletics operated network that are not owned or operated by Intercollegiate Athletics and have a need to communicate with any Athletics operated communications device.
4. Policy
   1. Network Access Requests
      All requests for network access are created via the Request for Network Access online form that formally submits the request to the Athletics IT support staff. Employees shall not request access for themselves. Newly hired employees will have their access request filed by their direct supervisor. 
   2. Wired & Wireless Access
      1. All Athletics-issued devices excluding mobile devices may connect to the Athletics networks through ethernet or wireless connectivity. All requests for physical connections are subject to section 4.1 of this policy. Devices which utilize wireless connectivity will be preconfigured through OS imaging software prior to deployment of the device.
      2. Remote access to the Athletics network will be controlled through one or more VPNs in which EAD security groups will be utilized. In the case of Athletics-controlled VPNs, personal devices will not be allowed to connect. If a remote VPN operated by Penn State is used to access Athletics networks, Penn State policies apply regarding device usage.
      3. Athletics will utilize a variety of software to monitor network connections and traffic in conjunction with Penn State’s automated solutions.
      4. Unauthorized devices connecting to the Athletics networks will be disconnected.
      5. Traffic on Athletics networks may be monitored and analyzed for security purposes.
5. Enforcement
   Granting of the requested network access will be done exclusively by the Athletics IT department.

1. Approval and adoption and revision
   Approved by the Information Technology Manager on March 20, 2023.
2. Purpose
   This document will describe the policies regarding the distribution and use of cellular devices by Intercollegiate Athletics (ICA) employees.
3. Scope
   This policy applies to all cellular devices owned, operated or managed by Intercollegiate Athletics.
4. Policy
   1. Device Deployment
      1. An ICA employee must receive approval from the appropriate Management Team representative or Sport Administrator to receive a cellular device. The approval must be forwarded to the IT department before a cellular device can be issued.
      2. ICA will provide employees with an AT&T issued cellular device as per our agreement with AT&T.  Employees who wish to choose a phone beyond the offered models (higher memory, larger screen size, different manufacturer) must receive approval from the appropriate Management Team representative or Sport Administrator, as the costs increases significantly with these additions.
      3. All Athletics-issued Apple devices will be managed by the Penn State JAMF service.
         1. Devices will be required to adhere to best practices for security purposes.
         2. Devices will have preinstalled software and settings that Athletics IT and Penn State deem necessary for operation.
      4. Android mobile devices currently are not managed centrally by an MDM.
   2. Billing
      1. Monthly service charges will be directly billed to the ICA finance office and paid by individual department budgets. App purchases are not included in the monthly service charges and are billed directly to the employee.
      2. ICA issued devices will be upgraded at no cost to the employee but to the department, no less than the renewal date of the individual phone contract. Employees will be notified by the IT department when their upgrade is due. The old phone must be returned to the IT department within a week of the receipt of upgrade. The security code, pin and all cloud-based logins must also be removed upon return of the phone.
      3. A base-model protective case can be purchased with the device. The cost of the case will be directly billed to the department.
      4. All accessories, other than the department issued case, will be the financial responsibility of the individual user and are not to be paid for using purchasing cards or directly billed to the account. This includes car chargers, Bluetooth devices, charging cases etc.
   3. Ownership & Data
      1. A device purchased by ICA is ICA property. The device must be turned in to IT or HR on the last day of employment or immediately upon request.
      2. Due to litigation holds in place for Athletics, data must be preserved at all times including when the phone is returned to HR or the IT department. The device must not be reset prior to returning the device to IT. The security code, pin and cloud-based logins must also be removed upon return of the phone.
      3. The use of a cell phone by an employee is for the benefit of the University, rather than the convenience of the employee.
   4. Compliance
      1. To comply with all Penn State and NCAA regulations, certain staff positions may be required to utilize an Athletics-issued cell phone.
      2. To comply with all Penn State and NCAA regulations, usage logs from cell phones may be passed on to Penn State and Athletics Compliance departments on a monthly basis.
   5. This policy is subject to change by ICA at any time.

5.0        Cross References
Other Policies in this Manual should also be referenced, especially the following:

FN21 Non-Office Telecommunications Services (Formerly BS19)

1.0        Approval and adoption and revision

Approved by the Information Technology Manager on March 28, 2023.

2.0        Purpose

To provide the authority for authorized members of the Office of Information Technology and the University’s Security Office to conduct a security audit on any system within Intercollegiate Athletics in accordance with University Policy AD95.

Audits may be conducted to:

• Ensure integrity, confidentiality and availability of information and resources
• Investigate possible security incidents and ensure conformance to the Intercollegiate Athletics security policies
• Monitor user or system activity where appropriate (e.g. system compromise is suspected, policy violations are suspected, complaints have been received, etc.).
• Ensure validity of user accounts

3.0          Scope

This policy applies to all computer and communications devices owned or operated by Intercollegiate Athletics.  This policy also applies to any computer or communications devices that are present in an Athletics facility or Athletics operated network that are not owned or operated by Intercollegiate Athletics.

4.0          Policy

When requested, and for the purpose of performing an audit, any access needed will be provided to members of the Athletics or University security teams.  Users and/or support personnel must ensure that any hardware or software installed for the purposes of filtering traffic such as a firewall appliance or personal firewall software allow unrestricted traffic to and from all systems authorized to conduct security audits at the departmental or University Security Office levels.

This access may include:

• User level and/or system level access to any computer or communications device
• Access to information (electronic, hardcopy, etc.) that may be produced, transmitted, or stored on Intercollegiate Athletics equipment or premises
• Access to work areas (offices, cubicles, storage areas, etc.)
• Access to interactively monitor and log traffic on the Intercollegiate Athletics network

At no time shall anyone other than those authorized within Athletics or the University be permitted to scan computers or devices connected to an Athletics operated network or capture (e.g. sniff) any traffic on an Athletics operated network.

5.0          Enforcement

Anyone found violating this policy will be subject to disciplinary action by his or her Administrative unit, Intercollegiate Athletics, or the University.

Athletics or University Security Office personnel will immediately terminate network access to any system found to be scanning systems or capturing traffic in violation of this policy.  Individuals found to be in violation of local, Commonwealth or Federal regulations or laws will be referred to the University Security Office for case disposition.​