Badge Access Control Policy
Purpose
This Badge Access Control Policy outlines how badge access control systems at the university will be configured and accessed, as well as who is allowed to access badge access control systems.
Scope
This policy covers any badge access control system at the university.
Policy
Single system for the university
There will be a single badge access control system for the university. Installing a separate badge access control system requires written approval from the Chief Information Security Officer and that approval must be renewed annually.
Network placement
All elements of badge access control systems will be attached to the university network with guidance from the ITS Networking team. The ITS Networking team has purpose-built subnets for housing all elements of badge access control systems.
Configuration requirements
All elements of a badge access control system must be configured to:
- Only be accessed via encrypted authentication;
- Not use any default passwords;
- Have any service accounts configured following the service account requirements in the Password Standard; and
- Install new firmware and software within 60 days of release.
Access to badge access control systems
Entering user rights into the badge access control system will be coordinated by the WesCard Office. The Office of Residential Life is responsible for determining user rights for residential buildings. Public Safety is responsible for determining user rights for academic and administrative buildings.
Public Safety will have access to all usage logs generated by the badge access control system.
Exceptions
All exceptions to this policy require written approval from the Chief Information Security Officer. All exceptions require annual renewal.
Appendix
Definitions and Terms
Information Technology Resources (ITRs) – This includes, but is not limited to, end-user computing devices, services, networks, email, software, printers, scanners, video distribution systems, telephone systems, fax systems, and other computer hardware and software, whether owned by the university or contracted by the university from a third party.
Revision History
August 2024 – Policy adopted