Review: Email

Back to IT Policy Task Force home

---

Existing UO email related policies
Use of E-mail for Official University Communication

Related policies at other institutions
OSU Guidelines for Release of E-mail Addresses
University of Colorado System – Use of Electronic Mail
Duke University Group Email Policy
Tufts Email Policy
University of Washington Separate Work and Personal Email Files
Florida State University – Statement on Generic or Group Email Accounts

Areas to consider for email policy

Policy

• spam/phishing
  • incoming
  • outgoing
• where should your email be? dept or uoregon?
• forwarding off-campus (FERPA, sensitive info, etc.)
• sending sensitive info (SSNs etc.) via email
• public record implications/FOIA/civil discovery (articulate with records retention)
  • need to include definition of public record & interpret (with legal) in the policy
  • deletion of mail
  • appropriate capture for retention—header, footer, addressees, etc.
  • personal responsibliity—creator is responsible for retention
  • E-Mail Manual for State Archives
  • look at Erin’s e-mail policy template for CAS
• access by supervisors/managers; terminated employees with mixed student-employee use
• other communication tools—IM, IRC, Jabber, forums,
• mailing lists
• personal use

Practice

• size of attachments
• spam filtered by default or not?
• attachments/defanging
• blocking/unblocking
• practice of using generic/group accounts

NOTES

(JES) Some additional resources to be aware of:

National Institute of Standards and Technologies (NIST) Guidelines
on Electronic Mail Security (Special Publication 800-45A), Draft, August 2006

This is the standard that federal agencies are facing under FISMA
for electronic mail, but it may well become a de-facto industry-wide
standard articulating widely accepted and expected controls and
solutions beyond federal government.

University of California Electronic Communications Policy

I believe the University of California has some of the best examples
of well written higher education IT policy documents out there… For
example, note their change in title (email to electronic
communications), and note also their approach to handling and
reporting non-consensual access to electronic mail.

I think UC’s approach to considering electronic communications as
more than just email is probably worth considering, since unlike the
old days, today electronic communications go beyond just email to
include things like instant messaging, video conferencing, VoIP, etc.

Educause Resource Center E-mail Policies

---

Back to IT Policy Task Force home