Badge Access Control Policy 

 

Purpose  

This Badge Access Control Policy outlines how badge access control systems at the university will be configured and accessed, as well as who is allowed to access badge access control systems. 

 

Scope 

This policy covers any badge access control system at the university. 

 

Policy 

Single system for the university 

There will be a single badge access control system for the university.  Installing a separate badge access control system requires written approval from the Chief Information Security Officer and that approval must be renewed annually. 

Network placement 

All elements of badge access control systems will be attached to the university network with guidance from the ITS Networking team.  The ITS Networking team has purpose-built subnets for housing all elements of badge access control systems.   

Configuration requirements 

All elements of a badge access control system must be configured to: 

  • Only be accessed via encrypted authentication; 
  • Not use any default passwords; 
  • Have any service accounts configured following the service account requirements in the Password Standard; and 
  • Install new firmware and software within 60 days of release. 

Access to badge access control systems 

Entering user rights into the badge access control system will be coordinated by the WesCard Office.  The Office of Residential Life is responsible for determining user rights for residential buildings.  Public Safety is responsible for determining user rights for academic and administrative buildings. 

Public Safety will have access to all usage logs generated by the badge access control system. 

Exceptions 

All exceptions to this policy require written approval from the Chief Information Security Officer.  All exceptions require annual renewal. 

 

Appendix 

Definitions and Terms 

Information Technology Resources (ITRs) – This includes, but is not limited to, end-user computing devices, services, networks, email, software, printers, scanners, video distribution systems, telephone systems, fax systems, and other computer hardware and software, whether owned by the university or contracted by the university from a third party. 

 

Revision History 

August 2024 – Policy adopted