1. Purpose
The purpose of these regulations is to ensure the safeguarding of information security and IT services at AHO.
2. Scope
The IT regulations apply to all use of AHO's IT resources. The regulations also apply to the use of third-party IT resources through the user's affiliation with AHO.
AHO's IT resources include all IT equipment, software, storage and processing resources, user services, applications, systems, operational services, support functions, networks, and other IT-related resources made available to users at any given time.
The regulations also cover the use of other organisations' and institutions' IT resources that users gain access to through their affiliation with the school.
Be aware that the rules in the IT regulations also apply when the user utilises private equipment on AHO's network and when AHO's IT resources are accessed from locations outside the school's premises, for example, from home or while travelling.
3. Identity
By "user account," we mean in these regulations the personal account that AHO assigns to named individuals.
User accounts for employees are created based on information about the employee in AHO's payroll and personnel system SAP-DFØ, while user accounts for students are created based on information about the individual student in the administrative system Felles studentsystem. Individuals who are not employees or students at the school but require access to the school's IT resources are registered as affiliated users in SAP-DFØ. Visitors may be granted limited access as guest users.
Username and password entitle you to use AHO's IT resources in accordance with the guidelines and rules applicable at AHO at any given time. The IT resources each user is granted access to depend on their role and affiliation and the access rights associated with that role.
You may not lend or share your login details or access card with others, nor attempt to gain access to systems using someone else's password or username. You must also ensure that you do not use the same password for your AHO account and other services you use.
4. Use of the school's IT resources
AHO's IT resources must only be used for their intended purpose. AHO's IT resources are intended to support the school's activities, and you are responsible for using them in a manner that is reasonable and related to AHO's mission. If you handle confidential information, you must follow the guidelines on confidentiality. You may not use AHO's email or storage services for business activities or private communication and storage. Employees are allowed to connect their private email addresses and storage areas on their AHO devices.
The use of AHO's IT resources must be responsible. This means, among other things, that defamatory or discriminatory statements must not be published or distributed, nor should privacy be violated. Confidential information must not be disseminated, nor should IT resources be used to carry out, encourage, or contribute to illegal activities. It is also not permitted to use the school's IT resources for commercial purposes.
Usage not related to the school's mission, such as private use, is generally permitted as long as it consumes minimal resources, does not hinder other users in performing their tasks, and does not violate other points in the IT regulations.
Access to and use of AHO's IT resources must align with AHO's mission. IT resources may not be used for anything incompatible with AHO's mission and values.
The assessment of whether a particular use is acceptable will always be based on a concrete evaluation of events and actions in light of the school's tasks and priorities. The evaluation is based on three aspects:
- Actual usage
- The purpose of this usage
- The resources consumed
IT resources must not be used in a way that could degrade or compromise their integrity. This provision includes all actions that alter the properties, functionality, or availability of an IT resource without a service-related need or without consent or agreement with the service manager.
An obviously unacceptable way to use IT resources in this context is deliberately damaging them physically or destroying their content or properties. In addition, usage that exposes a resource to vulnerability or breaches of security, allowing unauthorised use of AHO's IT resources, is prohibited. Examples include "lending" your user account with password or opening attachments clearly sent to misuse AHO's IT resources. Users are obligated to follow instructions and directives regarding the use of IT resources.
The management and enforcement of internal guidelines and regulations, including the IT regulations, at AHO are responsibilities assigned to line managers at all levels. Additionally, many employees are delegated such tasks and responsibilities through their job descriptions or other means, including employees in the school's IT organisation. Instructions and directives issued by these individuals, based on the IT regulations or other rule sets, must be followed by each user. Disagreements about the interpretation of provisions must be referred to the authority overseeing the relevant rule set for a final decision.
Where required, users must correctly identify themselves. The right to use AHO's IT resources is a privilege granted to those with a specific affiliation with the school. This right is personal and cannot be shared or transferred to others. Different users have different rights and access levels. Correct identification is a central part of behaving properly as a user. Large parts of the IT services require proper identification for access and security purposes.
5. Information Security
When performing work, you must only use applications and services that AHO has made available for the purpose. Employees are obliged to comply with the employer's directives on the use of – and prohibition of – applications.
Employees who need to use new systems, services, or applications must clarify this with their manager and the IT/Information Security Officer and must always follow the acquisition routine for systems and services. Students must go through their course coordinator/supervisor.
The use of private devices for students follows the requirements AHO has set for student PCs. Logging into your AHO account on publicly accessible devices, such as internet cafés or public libraries outside AHO, is prohibited.
All users of AHO's IT resources must report via AHO's digital service desk any incidents or conditions that could threaten IT security or breach privacy. This also includes vulnerabilities or breaches you discover in systems or services. If you receive suspicious emails, report these to our digital service desk. The same applies if you lose devices.
5.1. Preventing and Detecting Information Security Incidents
AHO's IT systems are configured to log activities and create backups. Logs are used to detect attacks or deviations from internal rules and procedures and to uncover or detect breaches of security in the IT systems.
6. Disclosure of Information and Data
Disclosure of user data, information, logs, and/or traffic data to external parties, including the police and prosecuting authorities, only occurs when authorised by law.
7. Access to Email and Files
Under certain conditions, AHO may access email and personal areas in AHO's services, cf. the Working Environment Act § 9-5 and the Regulation on Employer's Access to Email and Other Electronically Stored Material.
8. Correspondence, Case Management, and Archiving
As a public institution, we are subject to an archiving obligation under the Archive Act § 6. Use email only for communication and not for long-term storage and/or archiving of information. For long-term storage of non-archival information, employees may use SharePoint/OneDrive/Box.
9. Special Provisions on Processing Personal Data
If you handle personal data at AHO, it is your responsibility to ensure that you are familiar with current privacy regulations and AHO's own guidelines for processing personal data.
10. Termination or Change of User Relationship
10.1. Retention, Disclosure, and Deletion of Data
When you are no longer affiliated with AHO, it is your responsibility to ensure that all your own data is removed from AHO's IT resources. Information and data that must be retained by the organisation must be transferred to a designated system and/or storage area with proper access control. This must be done in consultation with your immediate supervisor. When the affiliation with AHO ends, access to the user account will be closed, and data will be deleted within three months after the account is closed.
10.2. Return of Equipment
When a user leaves AHO, all IT equipment provided must be returned to IT before the final settlement is paid.
11. Availability and Maintenance of Daily Operations
AHO may temporarily suspend user accounts or access to systems and/or services if necessary to prevent or resolve operational disruptions or information security incidents. Systems and/or services may be unavailable to many or all users for periods if necessary to perform essential maintenance tasks to ensure stability and security. Whenever possible, advance notice will be given via operational messages made available to users via email, the digital service desk, or when logging into the relevant service.
12. Criminal Offences
If there is suspicion that AHO's IT resources are being used to carry out or attempt to carry out criminal acts, AHO may report this on its own initiative even if AHO is not the injured party.
Actions or incidents that violate Norwegian law will be reported and may lead to criminal prosecution or civil litigation. Examples include using AHO's IT resources for criminal acts such as granting outsiders access for unlawful exploitation or copyright infringement, such as illegal downloading of films, software, or other material.
13. Sanctions
In the event of a breach of these regulations and related rules, appropriate action will be considered. Use of AHO's IT resources that results in violations of Norwegian law may lead to actions by the police and prosecuting authorities, in addition to independent sanctions by AHO. Examples of such sanctions include restrictions on access to IT resources.
AHO cannot deprive users of rights or hold them accountable for actions that are directly caused by failures in AHO's IT services and/or resources. This does not apply if the user deliberately exploited the failure.
The form of reaction will be assessed based on the severity of the breach and whether there have been previous violations. Examples of possible sanctions include temporary suspension of access to parts of or all of AHO's IT resources.
Other possible sanctions include warnings, disciplinary actions under the Civil Servants Act, exclusion from studies and exams under the Universities and Colleges Act, etc. Decisions on temporarily suspending student accounts and/or access to services will be handled as individual decisions under the Public Administration Act.
If a student is due to sit an exam during the period when their account and/or relevant access is suspended, and the exam is digital, AHO must either provide alternative access to the exam platform or find another appropriate solution to enable the student to sit the exam. The same applies to compulsory coursework.
14. Appeals
Decisions on temporarily suspending student accounts and/or access to services may be appealed to AHO's Student Affairs Board within three weeks of the decision being communicated to the relevant party, cf. Universities and Colleges Act § 5-1 (1). Other individual decisions may be appealed within three weeks from the decision date. The Ministry of Education is the appellate body.
15. References
- Act of 15 June 2018 No. 38 on the Processing of Personal Data (Personal Data Act)
- Act of 10 February 1967 on the Procedure in Administrative Cases (Public Administration Act)
- Act of 1 April 2005 No. 15 on Universities and Colleges (Universities and Colleges Act)
- Act of 16 June 2017 No. 67 on State Employees etc. (Civil Servants Act)
- Act of 1 January 1999 on Archives (Archive Act)
- Regulation of 2 July 2018 No. 1108 on Employer's Access to Email and Other Electronically Stored Material
- Regulation of 25 June 2004 No. 988 on Electronic Communication with and in Public Administration (eGovernment Regulations)
- Information Security Management System at AHO
- Local regulations, guidelines, procedures, etc. at AHO