Responsible use of IT Resources at Østfold University College
The IT resources at Østfold University College should be used for activities related to teaching, research, studies, and administrative work. They should not be used for commercial purposes or activities unrelated to the operations at the University College.
Users must conduct themselves as good representatives of the University College and must not offend or harass others. Adherence to common standards of conduct is expected. Improper, offensive, or otherwise inappropriate behavior may result in disciplinary actions.
No one should make changes to equipment oweneb by Østfold University College without explicit permission from the department of ICT. It is not allowed to remove fixed equipment (or cables).
User Account (Username and Password)
You are responsible for all use made with your account at Østfold University College. Your password verifies your identity as the legitimate user of your account. This password is personal and should not be shared with others or written down visibly (e.g., on a sticky note under the keyboard). If you suspect that your password may have been compromised, it should be changed immediately via the password service, and you must contact IT Support about the incident.
It is not allowed to lend your account or your PC/MAC/Tablet/Mobile/ (equipment owned by Østfold University College) ++ to others. Always remember to lock your screen and office door when leaving your IT equipment. Most of our IT services require the use of MFA (multi-factor authentication) to gain access, and all of our users are required to use suitable tools (e.g., mobile phone) for this purpose.
Access Card (Employee Card and Student Card)
Your access card is personal and must be kept secure, with the PIN code kept confidential. Lending your card to others is strictly prohibited. Usage monitoring is conducted solely for emergency purposes, and the data is automatically deleted after a short retention period. Allowing unauthorized individuals into restricted areas is not permitted, and you may be held accountable for their actions. If your access card is lost, report it immediately to the Service Desk so that access can be blocked and a replacement card can be issued to you.
Email Usage Guidelines
Your Østfold University College email account is intended for work or study-related activities and should be used sparingly for personal purposes.
All employees and students are expected to stay informed about university operations by regularly reading official emails and checking our website for news and updates.
Please remember that sensitive information should not be sent via email in plain text.
Emails with large user groups as recipients should not be used as a channel for discussions and other exchanges of opinions. Only employees are allowed to send emails to our email lists, and this should only be done when important information needs to be communicated.
It is not allowed to act anonymously, under a false name, or under a pseudonym when sending emails or using other communication channels. It is not allowed to send content that is offensive and/or defamatory.
Storage and Copying
Data storage should be done in accordance with our data classification guidelines and the storage guide. It is especially important that personal data is stored in accordance with the rules in the General Data Protection Regulation (GDPR). See more information about this on our privacy pages.
Your own private data should not be stored on our storage solutions.
Unauthorized downloading and copying of licensed software is not allowed.
Collection, storage, and distribution of information that violates Norwegian law should not occur.
User data will be deleted when students and employees are leaving the College in accordance with privacy legislation.
Rules on Access
The content of emails and data stored in an individual’s file area is considered the individual’s private property and will be treated in accordance with the Regulations on the Employer’s Access to Email and Other Electronically Stored Material. See also the Data Protection Authority’s pages on access to files and email. This means that the employer/institution only in special situations has the right to open and read this material, and as far as possible, only after prior notice.
All data files will be periodically checked for viruses and harmful content. In case of detected errors, it may be necessary to manually search the user’s data areas.
Equipment owned by Østfold University College
For equipment (PC/MAC/Tablet, mobile, etc.) owned by the University College, it is not allowed to install software that is not part of the software portfolio without explicit approval from the Department of ICT. If new software is needed, the IT procurement procedure should be followed.
For security reasons, employees should not have administrative rights on HiØ-owned equipment. However, in special cases, temporary access can be requested by contacting IT Support.
Private Equipment
The use of personal devices at the College is permitted, provided they are securely managed and kept up to date with antivirus software, operating system updates, and other necessary software.
Employees should primarily use equipment owned by the College.
IT Security
All use of IT resources at the College must comply with our Information Security and Privacy Management System.
Users at the College should not on their own initiative conduct mapping or testing of possible weaknesses in our IT systems and/or networks, or otherwise engage in “hacking activities” against internal or external systems. It is not allowed to gain unauthorized access to other users’ data, software, or storage areas.
Any security incidents or suspicions of such should be reported to IT Support.
In the event of severe IT incidents or significant breaches of privacy regulations, the CISO (Chief Information Security Officer) should be contacted directly.
Ownership
The University College owns all software and content that has been developed using the University’s IT resources and/or connected to the University’s data network, cf. the Copyright Act § 39, with the exceptions that fall under the Act on the Right to Inventions made by Employees.
Violation of IT Regulations
Violations of the IT regulations may result in sanctions and will be determined in accordance with the nature and extent of the violation. Actions or incidents that involve violations of Norwegian law will be reported to the police and may thus lead to prosecution or civil litigation. This also applies to misuse that causes economic loss or liability to the University College.