Minimum Security Guidelines for NIU Owned Devices

Permitted Operating Systems 

Last reviewed date October 2025

All permitted operating systems, mobile devices and network connected IoT must be kept updated to the current vendor supported patch/update level and follow the NIU Vulnerability Management and Patch Management Policy.

• Windows 11 Enterprise versions that have not reached their end of service date.
• Windows 10  Enterprise 22H2 devices that have been documented and received Extended Security Updates (ESU).
• Windows Server versions 2025, 2022, 2019 and 2016 that have not reached their end of service/support date. 
• macOS 26 (Tahoe) and two previous versions macOS 15 (Sequioa) and macOS 14 (Sonoma)
• All other operating systems, or firmware levels for mobile devices and IoT, that the original vendor still supports and releases security updates for, are permitted. NOTE: Not all mobile devices or IoT are compatible with all connectivity or security controls.
• All operating systems, or firmware levels for mobile devices and IoT, that have reached end of support and do not receive regular security updates from the vendor must be decommissioned unless an exception has been requested and approved by the Office of Infomation Security and CIO.

Anti-Virus / Anti-Malware Software

• NIU security baseline requires the Microsoft Defender Suite on all devices supported by the product.
• NIU security baseline requires web traffic security to be enabled on the endpoints through Windows SmartScreen.

Local Firewalls

• NIU security baseline requires local device firewall to be enabled and configured to block unauthorized connections.

Disk Encryption

• NIU security baseline requires local device storage encryption on all devices.
• Windows Policies have been created for Microsoft BitLocker implementation on NIU-owned devices.
• On Apple devices: the built-in FileVault must be used to encrypt Mac laptops.
• Support from DoIT and administration of recovery keys is available for both BitLocker and FileVault. You must work with DoIT to implement this else you are responsible for managing your recovery keys.

Network Security

• Hard-lined devices and those on authenticated NIU Wireless adhere to strict security standards on both the network and client side. No NIU-owned devices should be connecting to NIU Guest wireless when it is possible to connect to NIU Wireless.

NIU Data Storage

• Every NIU employee has access to secure cloud storage with Microsoft OneDrive. Individual departments may also have access to network drives that are secured and maintained by DoIT.
• NIU data must not be stored on a personal device, unapproved AI tools, or non-NIU cloud services.
• Please review and adhere to all NIU policies on data protection, lifecycle, and privacy (e.g., HIPAA, FERPA, destruction schedules, etc.)

Administrator Privileges

• Users are not local admins on their machines by default. Users who require administrator access must have their supervisor's and DoIT's approval and get a separate administrative account according to these account and password guidelines.

Software Installation

• Do not install software from unvetted sources.
• Use the same best practices for software installation as you would on any NIU-owned device.
• Inform your local IT support whenever you need additional software installed.

Passwords

Passwords are critical to the security of your accounts, your devices, and the data you have access to. You must follow the account and password guidelines. Below are some best practices regarding passwords.

• Never re-use you NIU password for personal Internet sites or services
• Never share your passwords
• Create long passwords or pass phrases of at least 15 characters. 
• Use multifactor authentication whenever possible
• Use a password manager to securely store and access passwords.  Though the University does not recommend any one solution, here are some examples of free password managers for personal use:
  • Password Safe: https://www.pwsafe.org
  • KeePass: https://keepass.info/