In this article
- Purpose
- Definitions
- Requirements
- Implementation
- Applies to
- Procedures
- Responsibilities
- Resources
- Contact
- History
Purpose
The University of Maryland (“UMD” or the “University”) provides an institutional email system to promote secure communication and collaboration, allow for business continuity, and maintain effective handling of institutional data. The use of email systems to conduct University Business is subject to federal, state, and local legal, regulatory, and statutory requirements, including but not limited to the Family Educational Rights and Privacy Act (FERPA) and the State of Maryland’s public records laws. Noncompliance with these laws and regulations could result in a loss of federal funding, as well as civil and criminal penalties, and/or have a severe adverse impact on UMD’s mission, safety, finances, or reputation. This standard sets forth fundamental requirements for the appropriate use of email systems to conduct University Business. Compliance with this standard is necessary for the University to meet all the requirements of the USM IT Security Standards(Opens in a new window) and the UMD Policy on Acceptable Use of Information Technology Resources(Opens in a new window).
Definitions
| Term | Definition |
|---|---|
| University Business | The work performed on behalf of the University by its personnel (including faculty, staff, student employees, and other persons whose conduct falls under University operations), whether or not such persons receive compensation for performing this work. |
| Institutional email | The UMD email system/platform provided and maintained by the Division of Information Technology (username@umd.edu) enabled by G Suite for Education. |
| Approved email system | The institutional email and any administrative, academic, or programmatic unit’s email system with a waiver. |
Requirements
- The University requires its personnel to use an approved email system to conduct University Business. Specifically, all email sent by University personnel regarding University Business must be sent from an approved email system.
- Email is an inherently insecure medium for transmitting private or confidential information. Email should not be used to transmit data with a risk category of high (Category 4) as defined by the University of Maryland’s Data Classification Standards(Opens in a new window).
- As state employees, UMD personnel should not use an approved email system for private gains or personal matters that create or appear to create a conflict of interest or an endorsement by the University. Employees are strongly encouraged to use a separate, non-UMD email system for personal matters.
- There are significant differences in the agreement language and the data collected between a typical consumer Gmail and the UMD G Suite for Education accounts. Therefore, automatically forwarding emails and documents from an approved system to another email account/platform (e.g., @gmail.com, @yahoo.com, etc.) is prohibited. This practice greatly elevates the risks of sharing information that is protected as confidential by federal and/or state law or the University’s contractual obligations.
- University personnel may enable a UMD email account on multiple devices including mobile phones. To prevent accidental use of personal email addresses, it is strongly recommended that an approved email system is used as the default outbound setting on devices.
Implementation
- Each University administrative, academic, and programmatic unit must establish priorities and timetables to decommission their legacy email systems and transition their users to the UMD email system before June 30, 2020. The plan must be communicated to the Division of Information Technology at emailconsolidation@umd.edu before November 30, 2019.
- Subject to approval by the respective relevant unit heads and deans, the use of legacy email addresses of the form @[unit].umd.edu may continue for both inbound and outbound email as long as this email is sent and delivered by an approved email system.
Applies To
All members of the University Community who conduct University Business via email. Excludes TERPmail, which is the University of Maryland’s institutional student platform for communicating academic information and providing cloud storage and productivity and collaboration tools. All students and accepted applicants may be granted a TERPmail address (username@terpmail.umd.edu).
Procedures
Waiver
A unit that has unique business requirements that cannot be met by the Institutional email must submit a waiver form(Opens in a new window) explaining, in detail, how conformance with this standard would be noncompliant with federal or state laws. For example, University personnel conducting classified work are required to use an email system that meets federal government statutory or contractual requirements in specific situations. Waivers must be requested by a unit head responsible for overseeing the administrative, academic, or programmatic unit and approved by the respective Dean or Vice President. Waivers to this security standard may be granted for up to 3 years’ duration (with the option for renewal). Consistent with the University’s UMD Policy on Acceptable Use of Information Technology Resources(Opens in a new window), a waiver may be revoked at any time by the VP/CIO.
Violation
Failure to comply with this standard constitutes a violation of the UMD Policy on Acceptable Use of Information Technology Resources(Opens in a new window).
Review
The VP/CIO or a designee will initiate a review and necessary revisions of this standard as needed, with appropriate input from the Division of Information Technology staff and the IT Council.
Responsibilities
| Position/Office | Responsibilities |
|---|---|
| Vice president/chief information officer |
|
| Division of Information Technology |
|
| IT Council | Reviews and makes decisions related to this standard. |
| University administrative, academic, and programmatic units |
|
| Faculty, staff, and student workers conducting business on behalf of the University |
|
Resources
- State of Maryland Information Technology Security Manual(Opens in a new window)
- USM IT Security Standards(Opens in a new window)
- USM Regents Policy on USM Institutional Information Technology Policies(Opens in a new window)
- UMD Policy on Acceptable Use of Information Technology Resources(Opens in a new window)
- UMD FERPA Training(Opens in a new window)
- UMD Student Privacy(FERPA explained)(Opens in a new window)
- University of Maryland’s Data Classification Standards(Opens in a new window)
Contact
For questions or comments or complaints about the IT Standard, training or technical help, contact the Division of Information Technology by phone at 301.405.1500 or by email at itsupport@umd.edu(Opens in a new window) or by website at it.umd.edu(Opens in a new window).
History
Recommended by the IT Council and issued by the VP/CIO on: 10/01/2019.