Service Administrator Account Policy

Purpose 

The purpose of this policy is to ensure that Southwestern Oklahoma State University (SWOSU) services, whether cloud-based, hosted, or hybrid, have the proper maintenance of administrative accounts of those services, as well as the password requirements for those same administrative accounts. 

Scope 

This policy applies to cloud-based services, hosted services, hybrid services, or applications provided by or on behalf of SWOSU (hereinafter referred to as "services"). These services include but are not limited to Microsoft O365, Canvas, Zoom, TeamDynamix, Adobe, and LinkedIn Learning. 

Statement 

Southwestern Oklahoma State University (SWOSU) provides technology and network resources for the use of its students, faculty, staff, or agents to support its academic and administrative functions. Access to these critical resources promotes the University's academic and research objectives. All individuals managing these services must ensure that technology and network resources are supported, configured securely, and made available to users of SWOSU. 

Policy 

The administrative accounts should be maintained as follows: 

• Administrative accounts should be appointed and created by the department that owns the service.  

• Administrative accounts should be reviewed annually. 

• Administrative accounts that have not been used in the last six months or more, at the time of review, should be removed. 

• Administrative accounts shall be combined with multi-factor authentication, if available. 

• No accounts shall be shared. 

• No daily-use accounts should have administrative privileges. Users should utilize a technician or dedicated admin accounts. 

• Administrative account usernames and/or passwords shall not be shared with anyone. 

• Along with the administrative accounts used by the department, the SWOSU ITS department shall have access to an administrative account, of their own, for the service.  

• All services shall have an allocated ITS technician for the software. The allocated ITS technician shall have an administrative account.  

• In addition, administrative access shall be granted to the ITS Director or the ITS Assistant Director. 

Administrative accounts should have password requirements as follows: 

• Accounts should have passwords of 12 random characters.  

• Account passwords should include lower case characters (a), upper case characters (A), numbers (1), and symbols (! $ = > , &). 

• Account passwords should not include names or usernames. 

• No passwords should be shared among accounts. 

• Passwords should have a change requirement every six months. 

Enforcement 

Individuals who violate this policy may be subject to disciplinary action based on associated handbooks. When appropriate, SWOSU may restrict a violator’s access to SWOSU resources pending further investigation of a possible violation of this policy. Individuals who violate security policies, standards, or security procedures are subject to disciplinary action up to and including dismissal but may also include criminal or civil legal actions. 

Incident Reporting  

Violations of this policy should be reported to the SWOSU ITS Helpdesk via phone at (580) 774-7070 or via email at helpdesk@swosu.edu or Submit a Helpdesk Ticket: https://support.swosu.edu/TDClient/162/Portal/Requests/TicketRequests/NewForm?ID=egAOjxsvhjU_&RequestorType=Service 

Policy Review 

ITS Operations Administrator will be responsible for reviewing and updating this policy at least annually. 

Revision & Approval History