Acceptable Use Policy

Overview

The University of Oklahoma Foundation, Inc. (Foundation)’s purpose of an Acceptable Use Policy is to support the established culture of openness, trust and integrity. This document ratifies the Foundation’s commitment to protect its data and establishes the responsibilities of all users of its systems and information.

Scope

This policy applies to the use of information, electronic and computing devices, software, email, network, data transfers, and cloud resources (“systems”) to conduct Foundation business or interact with networks and business systems, whether owned or leased by the Foundation, the employee, or a third party.

Policy – Acceptable Use

General Use and Ownership

Foundation information, no matter where it is (including but not limited to storage on electronic or computing devices owned or leased by the Foundation, a Foundation employee, or a third party) at all times remains the sole property of the Foundation. As a result of the foregoing, all parties must ensure that proprietary and confidential information is protected.
All system users have a responsibility to report the theft, loss, or unauthorized disclosure of Foundation information as soon as they are made aware of them. System users must take reasonable measures to protect Foundation-owned or provided devices, internet, email, and other IT services from unauthorized access or theft. Personal use of Foundation-owned and provided devices by system users is discouraged and controls may be in place or put in place to block access to non-authorized resources. Employees must not install or use unauthorized software or hardware on Foundation-owned or provided devices. Employees must not willfully violate policies and standards set forth by the Foundation. Any Internet capable device that is independently purchased, leased or otherwise obtained outside of IT procurement, or was initialized, connected or otherwise installed without purview of IT, must be pre-approved by the IT Department and the network settings must be verified for proper configuration by the IT department.
System users must minimize the use or sharing of Foundation proprietary or confidential information to only those circumstances in which such sharing is essential to the fulfillment of assigned job duties and/or tasks. The Foundation reserves the right to monitor and review employees' use of company-owned or provided devices, internet, email, and other IT services for compliance with this policy and applicable laws and regulations. System users should not have any expectation of privacy when using Foundation-owned or provided devices, internet, email, and other IT services.

Security and Proprietary Information

All mobile and computing devices that connect to the Foundation’s internal network must comply with the “principle of least privilege / minimum access” by ensuring that only the minimum viable system and service account privileges that support the intended function are configured and allowed. All passwords must comply with the standards put forth by Foundation IT. Data must be handled according to its Security Designation as more fully described in the Information Classification Definitions. Providing access to another individual, either deliberately or through failure to secure access, is prohibited.
System users must use their own login and password to access Foundation owned or provided systems and must log off or lock their systems and devices when not in use to prevent unauthorized access.
Suspected security breaches should be reported to the Foundation IT department as soon as the system user is made aware of them.

System and Network Activities

The Foundation IT team and its delegated contractors are authorized to perform controlled security related activities which may contradict prohibited activities below. These activities are conducted with prior notification, authorization, and with the expertise to perform a business-related task within a specific role.

The following activities are strictly prohibited, with no exceptions:

  1. Violations of the Foundation’s Code of Ethics & Standard of Conduct, intellectual property protections, laws and regulations the organization is bound to.
  2. Violating the Foundation’s Annual Conflicts of Interest and Confidentiality Statement.
  3. Posting, viewing, printing, storing or using Foundation resources to send obscene or offensive material.
  4. Unauthorized use of digital material and media, unlicensed software, accessing data without the appropriate permissions, escalating privileges without permission, exporting software, technical information, encryption software or technology, introducing malicious code into the network or Foundation devices.
  5. Revealing your account password to others or allowing use of your account by others.
  6. Failing to use an approved virtual private network (VPN) when using public or unsecured Wi-Fi.
  7. Effecting security breaches or disruptions of network communication.
  8. Facilitating unauthorized systems access through malicious intent or negligence.
  9. Unauthorized digital attack methods not limited to: Attempting to identify, exploit, or disrupt vulnerabilities in Foundation systems or networks through scanning, interception, denial-of-service attacks, spoofing, privilege escalation, malware, or other unauthorized techniques.to achieve any exploitation goal.
  10. Circumventing user authentication or security of any host, network or account.
  11. Storing or copying Foundation data on personal devices or personally managed hosted platforms (e.g., Google Drive, personal Box accounts, etc.).
  12. Introducing honeypots, honeynets, or similar technology on the Foundation network except as provisioned and administered by the Foundation IT department.
  13. Interfering with or denying service to any user (for example, denial of service attack).

Foundation Email

Misuse of email resources is prohibited. These activities may include but are not limited to the following:

Mass forwarding of SPAM, sending unsolicited messages, unauthorized advertising to individuals or entities, any form of harassment, forged header or authentication information, "chain letters", phishing, externally forwarding confidential information, and any unlawful scheme of any type.

These actions will be considered a serious violation and may lead to legal and/or disciplinary action by the Foundation.

Personal use of email resources is discouraged and not supported but Foundation IT staff and is subject to technical monitoring and safeguards put in place by the IT department, and retention of personal items in email resources is not guaranteed.

Policy Compliance

Compliance Measurement

The Foundation Technology team will verify compliance with this policy through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the policy owner.

Exceptions

Any exception to the policy must be documented and approved by the Foundation Vice President overseeing the department in which the employee works and reported to the Foundation IT department.

Enforcement

Violations of this policy are considered a significant offense, and appropriate disciplinary actions will be taken by Foundation management.

Amendments

This policy may be amended at any time by the Foundation. Any amendments to this policy will be communicated to employees in a timely and effective manner.

Review Change

This policy will be reviewed on as needed basis to be determined by the Senior AVP, Chief Information Officer. The Chief Operating Officer and/or the Senior AVP, Chief Information Officer should review policy changes with the President and Chief Executive Officer and if approved, present any proposed changes to the Board for subsequent approval.

Last updated: 8/25/26