| Policy Approval Authority | President |
| Responsible Division | Division of Information Policy |
| Responsible Officer(s) | Director of Information Security |
| Contact Person | Bob Barton |
| Primary Audience |
Faculty
Staff Student Administration |
| Status | Active |
| Last Review Date | 07-19-2021 |
| Policy Category/Categories |
Information Technology
|
University email services are provided as a tool to facilitate communication in the furtherance of academic and business endeavors. The purpose of this policy is to augment and supplement other university policies, to describe permitted uses of University email, and to describe when certain email features are required to be used.
The policy also notes that, under the Illinois Freedom of Information Act, 5 ILCS 140 (“FOIA”) and State Records Act, 5 ILCS 160, electronic/digital files are considered the same as paper files. Thus, university emails, both sent and received, are subject to record retention procedures and considered public documents subject to inspection, unless exempted by law.
Compliance with this policy helps NIU:
This policy applies to all business and employment users of NIU email services. This includes, but not limited to university faculty, staff, affiliates, third-party support contractors, and all others granted access to NIU email resources for university use. This does not include student Z-ID email use. If a student is also an employee, this does include the use of the student employee email account.
All users of NIU email services bear responsibility for the appropriate use and protection of NIU email and the data therein. Based on job function and information classification categories defined in the Information Security Policy, some users have a greater burden of responsibility and accountability of data than others.
All students and employees of the university are assigned an official university email account. The official university email account is to be used for all official University email correspondence. For example, official communications from University offices, such as the President’s Office, Human Resources, the Provost Office, the Office of Information Security, and others, will be directed to the official email account.
Accordingly, all users shall be presumed to have received all official University email messages sent to their official University email account and are themselves responsible for being aware of those communications.
If an individual has both a student and employee affiliation, the University may assign a separate email account for each affiliation. Email services should be provided only while a user is employed by or enrolled at the University. Exceptions may be granted for conditions such as email extensions for emeritus status, retirements, etc.
Email accounts that are granted to retirees will be a new email account that is separate from their prior official employee email account.
An email alias based on the individual’s name that is registered with the university, will be assigned to this official email account. The individual may request a change to their email alias, but that change must reflect their given or preferred name. The university reserves the right to reset any alias that does not meet these criteria. To learn how to request a change to your email alias, login to the Division of IT support portal and search the knowledgebase.
An email may be considered a “university record” as it may convey approval or denial of a decision, contain evidence of receipt or expenditure of funds, document the official position of the university, or otherwise evidence the official transaction of the business of the university. Therefore, it is important for employees to identify emails that constitute records.
Employees are required to preserve email content that constitutes a university record, in a manner consistent with records of a similar nature.
It is the responsibility of all users to review and follow the guidance on records management found at the Ethics and Compliance Office Records Management.
Users should not assume that email content will remain private or confidential. A user’s expectation of privacy in the electronic environment is addressed by the University’s Privacy Policy. Access to email or the entire mailbox by someone other than the user may be permitted as described in that Policy. In addition, email may be discoverable in litigation or through a FOIA request, and can be altered or forwarded by a recipient without the sender’s knowledge.
The University’s policy on privacy in the electronic environment, including email.
For anyone that wants to convey a greater degree of confidentiality awareness within the text of an email, it is recommended but not required, that the following disclaimer be included in the email signature. For those including a disclaimer, the notice should appear directly below the personalized signature in 10pt Arial Regular dark gray font.
Disclaimer: This e-mail message, including any attachments, is for the sole use of the intended recipient(s). Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please inform the sender and destroy all copies of the original message immediately.
Please note that use of such a notice does not prevent discovery of the email for FOIA, legal or investigative purposes.
For departments or individuals that frequently communicate with or about sensitive or restricted information (see policies below), or that are bound by regulations like Health Insurance Portability and Accountability Act (HIPAA) or the Family Educational Rights and Privacy Act (FERPA) to enforce a reasonable degree of confidentiality for both internal and external recipients, it is recommended that those departments or individuals use the disclaimer together with O365 encryption options as appropriate.
Use of email to communicate restricted data to external third parties is strictly prohibited without appropriate security layers such as email encryption. Common examples of restricted information that require encryption in email include social security numbers, credit card numbers, student grades and education records, personnel records, individual donor gift records, financial records, and protected health information subject to HIPAA.
It is the responsibility of all users to review the information on how to use NIU’s O365 email encryption features.
It is the responsibility of all users to review and follow the Information Security Policy and the Data Classification Guidelines.
It is the responsibility of all users to report email incidents to the Office of Information Security. Email incidents include, but are not limited to, all types of phishing attacks, unauthorized access, or changes to your email account by a third party, accidental data disclosure to unintended parties, and all types of email threats of potential harm to person or property.
All email incidents or threats of a criminal nature that involve potential harm to person or property, which includes extortion, must be immediately reported to NIU PD by calling the non-emergency phone number 815-753-1212. If it is an emergency, please call 911.
All other email incidents must be reported to the Office of Information Security for investigation and remediation.
It is the responsibility of all users to review the Information Security page for additional details about email security and current threats.
Official email services are provided to allow conduct of university business. Personal use of your official email account is not permitted, except for de minimis use. De minimis use may include occasional, sporadic use that does not interfere or detract from the performance of work responsibilities, and is not in violation of university policy, such as the engagement in prohibited political activity.
For more information on what constitutes prohibited political activity please review the Ethics and Accountability in the Workplace Policy
Due to the inherent risks of email use to university resources, data, and reputation, personal use is specifically discouraged for the following types of activities:
Using a personal email account, or any other non-DoIT approved email system, to conduct NIU business is unauthorized.
Retirees that have been granted a retiree email account, may use that account for personal use. Those retirees that continue to do important work for the university are bound by all applicable policies including this policy.
The Division of Enrollment Management Marketing and Communications has created a standardized email signature template for all faculty and staff to use. A consistent branded email signature strengthens the university’s visual identity and supports wider branding efforts. All signatures should conform with the Northern Illinois University standardized email signature.
For those including the confidentiality notice above, the notice should appear directly below the personalized signature in 10pt Arial Regular dark gray font.
Manual or automatic forwarding or moving university email that contains private or restricted information as defined by the NIU data classification guidelines, to any destination, internal or external, other than where it was originally sent is only permissible for valid business purposes and where appropriate security controls such as encryption are in place.
In addition, any records (including emails) that relate to the transaction of NIU or State of Illinois business (i.e. public records) are subject to the Illinois Freedom of Information Act (FOIA), regardless of whether those records are stored in NIU email accounts or in personal and non-NIU email accounts.
If an employee forwards, transacts, or otherwise transfers their university e-mail to non-NIU email accounts, those other accounts become subject to searches for public records that are responsive to FOIA requests.
All employees are expected to cooperate with the University on responding to FOIA requests and conducting good-faith searches for records that may be responsive to FOIA requests, including searching of their personal and non-NIU email accounts.
All employees should use department approved and standardized automatic replies when necessary. Automatic replies should direct the sender as to how they may be assisted while you are unavailable. Managers working with a departing employee will want to make sure an appropriate autoreply message is created for that departing employee’s email account.
Automatic replies should only be sent to internal email accounts unless approved by the department head. Automatic replies to external recipients should only state that you are unavailable and should direct the external recipient as to how to get assistance. Automatic replies to external recipients should not include details as to the duration, reasons, or whereabouts of your absence.
Mass electronic communications, by definition, are email sent in large quantities, and are recognized as an efficient, cost-effective, and environmentally-friendly use of technology for facilitating communication within the NIU community. Mass electronic communications messages can be sent to a list of email addresses or mobile phone numbers of a pre-defined target group.
The approval and distribution of all mass electronic communications, including surveys, shall comply with the policy on mass email communications.
All “commercial messages,” which are defined as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service,” must comply with the CAN-SPAM Act. The main requirements of the law are:
For more information on CAN-SPAM, please visit the Federal Trade Commission.
It is the responsibility of all users to review and follow all university policies. Failure to comply with this policy may result in disciplinary actions, costly data breaches and damage to the university’s reputation.
Any questions regarding compliance should first be discussed at the department level. Questions that cannot be answered at the department level should be directed to DoIT via the IT portal.
Procedural History of the PolicyPolicy submitted 04/23/2021
Revised 07/19/2021
Policy Library
815-753-5560
policy-library@niu.edu