• Section 1 - Purpose and Scope
• Purpose
• Scope
• Section 2 - Principles and Key Requirements
• Part A - Acceptable Use
• Personal Use
• Use of Devices
• Part B - Unacceptable Use
• Part C - Terms of Use
• Ownership, Privacy and Personal Information
• Availability and Reliability
• Security, Incident or Threat Response
• Access Management, Monitoring and Data Handling
• ICT Consumer Obligations
• Exceptions to This Policy
• Part D - Investigations and Consequences of Misuse
• Section 3 - Roles, Responsibilities and Accountabilities
• Chief Information Officer
• Information Technology Function Staff
• ICT Procurement and Licensing
• UQ Staff
• ICT Consumers
• Section 4 - Monitoring, Review and Assurance
• Section 5 - Appendix
• Definitions, Terms, Acronyms

Section 1 - Purpose and Scope

Purpose

(1) This Policy establishes the principles for accessing and using ICT resources and outlines:

1. the acceptable use requirements to ensure responsible, ethical, compliant and legal use of ICT resources;
2. uses of ICT resources which are unacceptable;
3. terms of use of ICT resources; and
4. the potential consequences from misuse of ICT resources or any breach of this Policy.

(2) This Policy complements other University policies and procedures. The obligations outlined in this Policy are in addition to those specified in other policies and procedures, such as:

1. Records Management Procedure;
2. Information Management Policy;
3. Cyber Security Policy;
4. Staff Code of Conduct Policy; and
5. Student Code of Conduct Policy.

Scope

(3) This Policy applies to ICT Consumers, regardless of their role or relationship with UQ, and regardless of the ownership of the device they use to access ICT resources. This includes, but is not limited to, UQ staff, students, contractors and UQ affiliates.

(4) The Policy covers all use of ICT resources to access, process and manage Information, and applies to ICT resources supporting or enabling research.

Section 2 - Principles and Key Requirements

Part A - Acceptable Use

(5) ICT Consumers must:

1. only use ICT resources for University-related activities, such as University work, study, research or other University activities, or for personal use permitted by this Policy.
2. keep their account login details for ICT resources, such as usernames and passwords, confidential and never share them. Account details other than passwords may be shared with ITS staff where required for work-related matters, including cyber risk management and system administration.
3. use strong passwords and follow UQ’s password guidance. Administrator and privileged accounts must use strong, unique passwords and be subject to enhanced security controls as determined by ITS.
4. only have access necessary to support their work, study or research or other legitimate University purposes. If an ICT Consumer believes they have access they shouldn’t, they must notify ITS, their Supervisor or HR immediately.
5. use ICT resources in a manner consistent with all applicable legislation and UQ policies and procedures.
6. use UQ email accounts for their intended University purpose and in accordance with the requirements outlined in the Email and Bulk Messaging Procedure.

(6) UQ will take appropriate steps to ensure Internet access is only granted to minors in compliance with legislative requirements and in accordance with the requirements on the Internet Access webpage.

Personal Use

(7) Personal use of ICT resources is only allowed where all of the following are satisfied:

1. incurs no or minimal cost to UQ;
2. does not disrupt, degrade or create risks to ICT resources;
3. complies with the applicable licensing agreements and usage restrictions noted in the UQ Software Catalogue;
4. does not involve the inappropriate use of UQ Information, research data, intellectual property, confidential information or systems intended for University business;
5. complies with UQ policies, procedures (such as the Staff or Student Codes of Conduct) and applicable laws;
6. for UQ staff, contractors and UQ affiliates, does not impact work responsibilities; or
7. for students, follows guidance on the Free Student Software for Personal Use webpage.

(8) The CIO or Vice-Chancellor may, at their discretion at any time, approve, revoke or vary the permission of any person to use ICT resources for personal use, whether or not the person has complied with clause (7). If an ICT Consumer wants to use ICT resources in a way that is not permitted by this Policy, they must seek authorisation under clause (14) of this Policy.

Use of Devices

(9) To safeguard UQ information and maintain ICT system integrity, devices used to access ICT resources must meet minimum security requirements appropriate to their context.

(10) While UQ-managed devices are preferred for work and research, personal devices (Bring Your Own Device or BYOD) or self-managed devices may be used where permitted by an appropriate manager (such as the head of organisational unit), and they comply with the mandatory requirements described in the following table.

(11) In addition, the CIO may authorise the blocking or limiting of access to certain ICT resources from a BYOD or self-managed device.

Part B - Unacceptable Use

(12) ICT Consumers must not:

1. use ICT resources to collect, access, use, modify, share or disclose another person’s personal information unless authorised, lawful, for a UQ-related purpose and consistent with the Privacy Policy;
2. install or use software or other ICT components on a UQ-owned device or ICT resource unless the software or ICT component is appropriately licensed, authorised and used in accordance with applicable licence terms;
3. install software licensed to UQ on a non-UQ-owned device unless the installation and use is permitted by the licence terms and allowed under this Policy;
4. store personal files or information on ICT resources unless permitted under this Policy and UQ’s storage guidelines;
5. use UQ login credentials for personal use, except where personal use is allowed under this Policy;
6. lease, rent, share, lend or grant use of their UQ login credentials to access ICT resources or for any other purpose;
7. use an account or permissions from one role (such as staff) to perform activities for another role (such as student), unless you have approval;
8. allow another person to use ICT resources through an account or session they have authenticated to, except where necessary for teaching, presentations or other authorised University activities;
9. use or access ICT resources for personal profit, private business or commercial purposes (except where authorised as part of UQ work); or
10. use or access ICT resources for any other purpose determined by the CIO, Chief Operating Officer or Vice-Chancellor to be unacceptable use or misuse.

(13) Unless for legitimate research or academic purposes, ICT Consumers must not use ICT resources to access, store, transmit, create or share restricted content or for other unacceptable purposes including (but not limited to):

1. for gambling purposes;
2. in an unlawful manner, for any unlawful activity or to access or store infringing material, including in a manner that constitutes an infringement of copyright;
3. to access, store or transmit pornographic, racist, violent, or any other unacceptable material;
4. to engage in conduct that harasses, stalks, intimidates, or causes harm to another person, including through doxing or the unauthorised disclosure of confidential or personal information;
5. to access, store or transmit material that encourages, promotes or incites criminal activity;
6. in a way that is not consistent with UQ's codes of conduct for UQ staff, contractors, UQ affiliates and students;
7. to create, install or deploy malicious software;
8. to exploit vulnerabilities, attempt to or circumvent security controls or hack into ICT resources; or
9. in a way that is not consistent with the terms under which access to ICT resources or information has been provided.

(14) Where an ICT Consumer believes they have a valid purpose to use ICT resources to access, store or transmit restricted content, including for reasonable legitimate researching or teaching purposes, the use must be enabled in accordance using the process determined by the CIO or Chief Operating Officer.

Part C - Terms of Use

Ownership, Privacy and Personal Information

(15) UQ provides ICT resources to support its operations. Some ICT resources are owned by UQ. Others, such as internet access, licensed software and third-party services (including SaaS), are provided by third parties and have their own terms of use. ICT Consumers must comply with those terms in addition to this Policy.

(16) When you use ICT resources, you should not expect your activity or information to be private. You accept that:

1. your personal information (which may include sensitive information) may be collected, used and disclosed as part of your and UQ’s use of the ICT resources, including as needed for the operation, maintenance and support of the ICT resources; and
2. UQ may monitor your use of ICT resources, and may collect, use and disclose your personal information, as reasonably required to provide and manage the ICT resources and manage compliance with this Policy, including for the purposes and in relation to the matters contemplated in Part D of this Policy.

(17) Personal use may result in UQ holding some of your personal data (including data, files and other information, including personal information) that is not related to UQ activities. UQ reserves the right to delete this information at any time and does not guarantee it will be stored. While this information is held in ICT resources on UQ’s systems, it will be managed in accordance with:

1. this Policy;
2. relevant legislation;
3. UQ’s other policies and procedures including the Information Management Policy and the Privacy Policy, the Data Breach Policy and related procedures.

Availability and Reliability

(18) UQ aims to provide reliable ICT resources but cannot guarantee they will always be available or free from technical issues or defects.

Security, Incident or Threat Response

(19) If a risk to ICT resources is identified, the University will take reasonable and lawful steps to protect its systems and information. This could include restricting access, monitoring usage or making changes without prior notice.

(20) ICT Consumers must promptly report actual or suspected cyber security incidents, breaches, or suspected breaches. Clause (34) has further details about making reports.

Access Management, Monitoring and Data Handling

(21) UQ monitors and retains information about the use of ICT resources and information held in them to manage and operate those resources. Specifically:

1. UQ reserves the right to monitor, restrict, terminate or suspend access (where reasonably required) to and usage of ICT resources, including email, storage and network use, for the purposes as described in this Policy.
2. UQ may block connections from or access to sites, or connection requests from visitors.
3. Some monitoring, activities and usage may be recorded to assist with managing cyber security, managing risk, meeting UQ’s legislative obligations, managing consumption, performing general maintenance, and enhancing user experience.
4. UQ will meet its data retention obligations under the Telecommunications (Interception and Access) Act 1979 (Cth).

ICT Consumer Obligations

(22) ICT resources are provided to ICT Consumers subject to compliance with all relevant laws and University policies and procedures. By using UQ’s ICT resources, ICT Consumers must:

1. comply with all applicable laws and University policies and procedures.
2. adhere to the Staff Code of Conduct Policy and Student Code of Conduct Policy.
3. manage information in accordance with the Information Management Policy, Privacy Policy, and supporting procedures.
4. comply with any separate contractual arrangements and terms and conditions that govern access to some third-party ICT applications, ICT services and information, which may apply in addition to this Policy.
5. change their password and notify ITS as soon as possible if they believe their UQ login credentials (UQ username or password), including MFA, have been compromised.

Exceptions to This Policy

(23) If you believe you cannot meet the requirements set out in this Policy, you must seek an exception in accordance with the Cyber Security Exceptions Procedure. Consequences for misuse are outlined in Part D.

Part D - Investigations and Consequences of Misuse

(24) The CIO may enable access to ICT resources, including information, accounts and email accounts, where reasonably required to support an investigation conducted by an appropriate University authority, such as the Integrity Unit, Academic Registrar, Chief Human Resources Officer, or other designated authority, as relevant to the context. This may include investigations into alleged misuse of ICT resources, breaches of University policies or procedures, cyber security incidents, legal or regulatory matters, or other matters being investigated by an appropriate University authority.

(25) In some circumstances, such as emergent operational or security threats and impacts, the CIO may directly authorise relevant ITS staff to investigate and undertake actions that are necessary to mitigate or resolve the threat or risk.

(26) Misuse of ICT resources may result in termination, limitation, or suspension of an ICT Consumer’s access to ICT resources, or the removal of specific content. In addition, instances of misuse may be reported to other relevant third parties, as appropriate to the circumstances.

Section 3 - Roles, Responsibilities and Accountabilities

Chief Information Officer

(27) The CIO is responsible for:

1. authorising or approving the termination, limitation, suspension, or removal of ICT Consumer access or content, or assigning these actions to appropriate staff; and
2. ensuring this Policy and any procedure under it is enforced and maintained.

IT Policy, Risk and Assurance Committee (IT PRAC)

(28) IT PRAC is responsible for reviewing reports related to risk and assurance matters that arise under this Policy.

Information Technology Function Staff

(29) IT function staff are responsible for:

1. provisioning ICT resources (such as ICT Consumer accounts, file storage, access to systems);
2. monitoring the use of ICT resources and information to:
   1. ensure compliance with this Policy;
   2. detect unauthorised use or misuse; and
   3. identify security risks;
3. providing information about alleged misuse when directed by the CIO;
4. enforcing this Policy technically, including:
   1. preventing and monitoring access to inappropriate content; and
   2. suspending or terminating access when directed by the CIO; and
5. understanding their obligations and complying with documents in the Local IT Document Library.

ICT Procurement and Licensing

(30) ICT Procurement and Licensing staff (within ITS) are responsible for:

1. maintaining the UQ Software Catalogue; and
2. providing procurement support for the use and acquisition of ICT resources (including software, ICT components and third party services).

UQ Staff

(31) UQ staff who are the head of a UQ organisational unit are responsible for ensuring processes are in place:

1. for onboarding and offboarding (also known as separation) users of ICT resources within their organisational unit, including processes to help ensure individuals do not continue to have access after they no longer need it; and
2. for access to ICT resources to be reviewed when a person’s role, duties or organisational unit changes, and for ITS or the relevant system owner to be advised if access needs to be created, changed or removed outside standard UQ access processes; and
3. ensuring UQ staff, contractors and UQ affiliates within their organisational unit complete any mandatory training about this Policy designated by the CIO or other relevant senior UQ management.

(32) Supervisors of HDR students are responsible for:

1. ensuring HDR students appropriately store their research data and other research information in designated storage locations (including as set out in the pages linked in this paragraph); and
2. facilitating the handover of any UQ-owned research data and other research information prior to the HDR student completing or ceasing their studies.

ICT Consumers

(33) ICT Consumers are responsible for being aware of and complying with this Policy and its related procedures.

(34) ICT Consumers must report incidents relating to ICT resources and information, either via a Service Desk request, to the Cyber Security Operations Centre or another appropriate reporting channel. Such incidents may include cyber incidents, unauthorised access or perceived unauthorised access.

Section 4 - Monitoring, Review and Assurance

(35) User access to ICT applications and ICT services is subject to regular audit to ensure compliance with UQ’s security and access management requirements.

(36) The Manager, IT Policy, Risk and Assurance (or other UQ staff the CIO authorises):

1. is responsible for maintaining, reviewing and supporting implementation of this Policy, and ensuring it remains current.
2. will facilitate quarterly reports to IT Policy, Risk and Assurance Committee on:
   1. compliance with this Policy;
   2. progress on any relevant implementation activities; and
   3. associated IT documents supporting the enacting of this Policy.

(37) Breaches of this Policy:

1. may be reported to:
   1. Information Technology Services (by submitting a support request); or
   2. in accordance with the Staff Code of Conduct Policy or Student Code of Conduct Policy.

1. may also:
   1. be reported to UQ’s appropriate authorities to deal with misconduct or to appropriate external authorities in accordance with relevant legislation; and
   2. depending on the circumstances, result in UQ disciplinary or civil or criminal proceedings.

Section 5 - Appendix

Definitions, Terms, Acronyms