Account and Data Retention- Standard

This Standard supports and supplements the University of Central Oklahoma’s (“University” or “UCO”) Information Security Policy. The standard is mandatory and enforced in the same manner as policy. It will be periodically reviewed and updated as necessary to meet changes in operational, legal, and regulatory requirements.


In order to maintain current, relevant, and accurate data and accounts, UCO retains user accounts and associated data for a period of time specified herein. Accounts and associated data may be deleted from UCO information systems after the relevant retention standard has expired.

 

Account and Data Retention- Standard

‌Purpose

‌This Standard supports and supplements the University of Central Oklahoma’s (“University” or “UCO”) Information Security Policy. The standard is mandatory and enforced in the same manner as policy. It will be periodically reviewed and updated as necessary to meet changes in operational, legal, and regulatory requirements.

‌In order to maintain current, relevant, and accurate data and accounts, UCO retains user accounts and associated data for a period of time specified herein. Accounts and associated data may be deleted from UCO information systems after the relevant retention standard has expired.

Scope

This Standard applies to:

  1. All divisions, colleges, and units established by the University that exercise any information technology (IT) function relating to the mission of the University except for those specifically exempted in writing by the senior leadership (as defined in the information security policy) of the University.

  2. Faculty, staff, students, academic and administrative units, affiliated entities, agents, contractors, vendors, volunteers of the University, members of the community who use and/or administer University computer and telecommunications systems, or any information system or system asset (as defined in the information security policy) that connects directly or indirectly to any University owned, leased, contracted, or operated computer or telecommunication system.

‌Standard Details

  1. USER ACCOUNT:

    An identity account that is used for the purposes of identification, authorization, access, and or accounting to UCO systems. This applies to both standard user accounts as well as administrator accounts.

  2. USER DATA AND RELATED SYSTEMS:

    1. P: Drive

    2. One Drive

    3. Drop Box

    4. Email

    5. Other UCO systems as identified

  3. RETENTION PERIODS:

    1. Non-student accounts will be DISABLED at the time of separation OR at 120 days of inactivity. Associated data will be deleted 365 days after the related user account becomes inactive.

    2. Student accounts will be DISABLED at 365 days of inactivity. Associated data will be deleted 365 days after the related user account becomes inactive.

  4. NOTIFICATIONS:

    1. The supervisor of a non-student account that is scheduled for deletion will receive an email 30, 15, 7, and 3 days prior to, and the day of the scheduled deletion, indicating that a user account related to an area under their supervision is scheduled for deletion along with any next steps. If no supervisor is listed, a service desk ticket will be created to resolve the issue.

    2. Student accounts will receive an email to their secondary email address on file (if available) when their account becomes disabled and the date that their account and data are scheduled for deletion. An email will be sent 30, 15, 7, and 3 days prior to, and the day of the scheduled deletion, indicating that their user account and related data are subject to deletion.

Standard Violations

  1. Failure to comply with this standard or other University policies will result in disciplinary action, up to and including termination of employment and/or enrollment. All persons to whom these policies, standards, and guidelines are applicable, as stated above, are responsible for adhering to these rules.

  2. All supervisory personnel are responsible for ensuring that these policies, standards, and guidelines are adhered to within their respective areas of responsibility. Any user may report University policy or law violations to their immediate supervisor, representative faculty, or school personnel or using UCOMMENT.

‌Change Log

 

Version

Date

New

Original

 

 

 

 

 

 

 

 

 

‌Approvals

 

Approved By

Date

Description

Jeff Miller

February 9,

2023

Initial Policy Release
Print Article