OIT Public Knowledge - Cybersecurity Baseline: Guidance for Campus Users

Note: The Cybersecurity Baseline is expected to be issued summer 2026 with an effective date at the end of December. See this webpage for more information about the rule.

Anyone with access to university IT resources, including students, faculty, staff and third-party entities, must comply with RUL 08.00.20 – Cybersecurity Baseline. The rule sets campuswide baseline controls that must be met to protect university data and IT resources.

This article will help campus users better understand their responsibility in following the rule.

Personal Devices

It is important for employees to understand how this rule impacts their personal devices. If you use a personal device for university business, your device must meet these controls. Opting for university-owned and managed devices over personal ones can help ensure you are complying with this rule.

Access Control

Be mindful of how you share Google Drive files. Limit access to only those who need it, and avoid giving full-university access unless necessary.
Do not share university files with your personal Google account.
Never publish sensitive data on public websites. Anyone with access to sensitive university data has an obligation to protect it from unauthorized disclosure.
For more information, see these tips on access control.

Cybersecurity Awareness and Training

Protecting university data is a shared responsibility. Annual Data Security Training is important to ensure campus users understand their role. Per the Cybersecurity Baseline, anyone with a university account who is not strictly a student is required to complete the training.

Identity and Authentication

See Identity and Authentication Rule: Guidance for Campus Users for more information.

Incident Response

If you think a cybersecurity incident has occurred, report it immediately.

Security in Physical Space

Be aware of your surroundings.
Make sure no sensitive (Yellow or higher) information is visible in your work space.
Never leave devices unattended in public. If you leave a device in your work space, be sure it is properly secured.

Patch Management

Install device and app updates as soon as possible. Turn on automatic updates to make it even easier. These updates protect from bugs and vulnerabilities.