The use of desktops, laptops, mobile, and other Endpoint Devices (hereafter referred to as Endpoint Devices) are integral to a modern working environment. Many Endpoint Devices are increasingly mobile, which significantly increases the risk to the security of Brown University data both contained on and accessed by these devices. This policy addresses that risk by establishing the responsibilities of both Users and the Office of Information Technology (OIT) to maintain the security of University data that is stored, accessed, or transmitted via Endpoint Devices.

This policy applies to all members of the Brown community who have authorization to access University data (i.e., Users); and to any Endpoint Device, whether personally or Brown-owned, that is used to store, access, or transmit University data.

Guiding Principles:

• Best practices of security and access management
• Partnership and awareness of community needs
• Stewardship of University resources and data
• High standards of professionalism and conduct to be able to manage machines

All members of the community who use an Endpoint Device to access University data are responsible for securing such devices, regardless of ownership, against data compromise according to this policy. Security standards for devices can be found at Security Standards for Desktop, Laptop, Mobile and Other Endpoint Devices.

All software installed on Brown-owned Endpoint Devices must be suitably licensed for use. Installation or use of any software in violation of its license, or of pirated software, is not allowed.

All Brown-owned Endpoint Devices must be properly enrolled in an OIT approved IT Security and Device Management System, where technically possible.

Non-business use of a Brown-owned Endpoint Device is not prohibited. Any such use must comply with the University Code of Conduct, Code of Student Conduct and the Acceptable Use Policy.

Employees may choose to use personally owned devices for University business. However, employees do so entirely at their own expense with no reimbursement from the University, and should have no expectation of support from Brown personnel for such devices.

In compliance with the terms of the Electronic Information Access Policy, Brown reserves the right to access and review any Brown-owned Endpoint Device, without advance notice.

Brown will comply with applicable law and applicable Brown policies before accessing, reviewing, using or disclosing any content, activity or data that is stored on a Brown-owned Endpoint Device, but users must be mindful of this limited expectation of privacy in any information or activity conducted, sent, performed or viewed on or with any Brown-owned Endpoint Device.

If an employee uses a personal Endpoint Device to conduct Brown business, the employee must provide a copy of the Electronic Information that relates to Brown if requested for the purposes of an investigation, or in accordance with a Litigation Hold.

For the purpose of this policy, the terms below have the following definitions:

All individuals to whom this policy applies are responsible for becoming familiar with and following this
policy. University supervisors and employees with student oversight duties are responsible for promoting the understanding of this policy and for taking appropriate steps to help ensure and enforce compliance with it.

User Responsibilities: When using an Endpoint Device, whether personally or Brown-owned, to access University data or resources, all Users must be aware of, agree to, and adhere to the following:

• Comply with the Brown University Acceptable Use Policy.
• Meet the minimum security standards for Desktop, Laptop, Mobile and Other Endpoint Devices.
• Comply with the requirements described in the Brown University Litigation Hold Policy.
• Report a known or suspected compromise of any Endpoint Device, that may contain University data or has stored credentials providing access to University data, to the Information Security Group (ISG) immediately.
• Report theft or loss of any Endpoint Device that may contain University data or has stored credentials providing access to University data, to Brown’s Department of Public Safety and ISG immediately.
• Delete all University data from all personally owned devices upon termination of employment or relationship with Brown University.

In addition, if using a Brown-owned device, the User must be aware of, agree to, and adhere to the following:

• Follow Brown’s procurement policies for Brown-owned Computers and Cellular Devices.
• Only allow authorized individuals to use Brown-owned Endpoint Devices; Brown-owned Endpoint Devices may only be used by those individuals with a legitimate business need and may only be used by individuals authorized to access University data.
• When a Brown-owned Endpoint Device reaches its end of useful life and will no longer be used, work with ITSC/DCC to ensure that all devices get securely wiped and disposed of, especially those devices storing Brown University data as specified in the Electronic Equipment Disposition Policy and the companion document, Data Removal Recommendations.
• Not use the Brown-owned Endpoint Device for political purposes or for personal economic gain.

OIT Responsibilities: OIT shall publish and maintain up-to-date minimum security standards for Endpoint Devices and shall assist Users in understanding those requirements.

Failure to comply with this and related policies is subject to disciplinary action, up to and including suspension without pay, or termination of employment or association with the University, in accordance with applicable (e.g., staff, faculty, student) disciplinary procedures; or for non-employees may result in the suspension or revocation of the User’s relationship with Brown.

Brown University is a community in which employees are encouraged to share workplace concerns with University leadership. Additionally, Brown’s Anonymous Reporting Hotline allows anonymous and confidential reporting on matters of concern online or by phone (877-318-9184).

The following information complements and supplements this document. The information is intended to help explain this policy and is not an all-inclusive list of policies, procedures, laws and requirements.