Run an operating system supported by the manufacturer or an ITS-approved support mechanism.
Receive applicable security updates.
Maintain supported versions of applications, libraries, runtime environments, and firmware where they affect the security of the system.
Remove unsupported software when it is no longer operationally necessary.
Maintain firmware at a supported security level when vendor updates are available.

End-of-life operating systems must not be used without an approved exception or documented compensating controls.

2. Endpoint Protection

University-managed Windows, macOS, Linux, server, or other supported endpoints must use University-approved endpoint protection where technically supported.

Required capabilities may include:

Anti-malware protection
Real-time protection
Endpoint detection and response
Behavior monitoring
Cloud-delivered protection
Security telemetry
Centralized alerting
Tamper protection

University-owned systems must be enrolled in the University's designated endpoint security platform when supported.

Required endpoint protection must not be disabled or removed without ITS authorization.

3. Authentication

Systems must require authentication before providing access to non-public information, administrative functions, or restricted services.

Systems must:

Use individual identities whenever technically feasible.
Restrict administrative privileges.
Enforce least privilege.
Remove or disable unnecessary accounts.
Disable or secure default accounts.
Change vendor-default credentials before production use.
Use University-managed identity services when technically supported and appropriate.

4. Multifactor Authentication

Multifactor authentication must be used when technically supported for:

Remote administrative access.
Privileged access.
Cloud administrative interfaces.
Remote access to University systems.
Other access identified by IT Security as presenting elevated risk.

Administrative interfaces exposed to the Internet must use multifactor authentication unless explicitly approved otherwise.

5. Privileged Access

Administrative privileges must be limited to individuals with an authorized operational requirement.

Where technically feasible:

Separate administrative and normal user accounts should be used.
Administrative accounts should not be used for routine email or web browsing.
Privileged access should be logged.
Remote administrative access should be restricted to authorized networks, VPN services, privileged access systems, or other ITS-approved mechanisms.
Privileged credentials should be protected using approved credential-management technologies.

6. Encryption

University-managed portable computing devices storing University information must use full-disk encryption when technically supported.

Devices containing Restricted University information must use encryption appropriate to the classification and regulatory requirements applicable to the information.

Removable media containing Restricted information must be encrypted unless an approved exception exists.

7. Secure Configuration

Systems must be configured to reduce unnecessary exposure.

At minimum:

Default passwords must be changed.
Unnecessary user accounts must be disabled or removed.
Unused applications should be removed.
Automatic security updating should be enabled when appropriate.
Built-in operating-system security protections should remain enabled.
Vendor-provided security configuration recommendations should be implemented where appropriate.

8. Network Services

Devices must not provide unauthorized network infrastructure services.

This includes unauthorized:

DHCP services
DNS services
Routers
Wireless access points
Network bridges
VPN concentrators or gateways
Proxy services
Network address translation services
Remote-access gateways

Network infrastructure services must be coordinated with ITS.

9. University Security Management

University-owned endpoints must participate in applicable centralized University security services when technically supported.

Depending upon the system, these may include:

Endpoint detection and response
Endpoint management
Vulnerability management
Asset inventory
Patch management
Configuration management
Security logging
Compliance monitoring

Systems must not intentionally block communication with required University security services.

10. Specialized, IoT, and Embedded Devices

IoT, laboratory, research, facilities, security, instructional, and embedded devices that cannot satisfy normal endpoint requirements must use compensating controls appropriate to their risk.

Possible controls include:

Dedicated network segmentation
Restricted VLAN placement
Network access control
Firewall or access-control lists
Restricted Internet communication
Explicit allowlisting of communication destinations
Enhanced network monitoring
Removal or blocking of unnecessary protocols
Restricted management interfaces
Physical protection

Default passwords must be changed whenever the device permits them to be changed.

11. Remote Vendor Access

Vendor or third-party remote access to University-connected systems must:

Be authorized by the responsible University department.
Use University-approved secure access mechanisms.
Use individually attributable accounts when technically feasible.
Use multifactor authentication when supported.
Be limited to systems necessary for the service being provided.
Be enabled only when required when technically feasible.
Be disabled when the vendor relationship or operational need ends.

Persistent unrestricted inbound vendor access should not be permitted unless specifically justified and appropriately secured.

12. Prohibited Conditions

The following conditions are prohibited unless specifically authorized:

Vendor-default administrative passwords.
Unsupported Internet-facing operating systems.
Unauthorized network infrastructure.
Unauthorized wireless access points.
Intentional disabling of required endpoint protection.
Intentional circumvention of University security monitoring.
Unencrypted transmission of Restricted information when secure alternatives are available.
Unrestricted Internet exposure of administrative interfaces without appropriate safeguards.
Systems actively participating in malicious activity.

13. Noncompliance

Immediate Risk

Systems presenting an immediate threat may be quarantined or disconnected without advance notice.

Examples include:

Active malware.
Command-and-control communication.
Credential theft activity.
Active exploitation.
Significant unauthorized scanning or attacks.
Systems causing material disruption of University network services.

Significant Risk

Systems with serious vulnerabilities that do not present an immediate active threat may be given a remediation period appropriate to the risk.

Routine Noncompliance

Lower-risk configuration issues may be addressed during normal remediation and maintenance activities.

Network access may be restored when ITS determines that the condition causing the restriction has been adequately remediated or mitigated.

14. Revisions

IT Security may revise technical requirements when necessary to address:

Newly identified threats.
Changes in University technology.
Vendor end-of-support dates.
Changes in recognized security practices.
Regulatory or contractual requirements.
Significant changes in University risk.

More Info

ITS Minimum Security Standard for Network-Connected Devices

1. Supported Operating Systems and Software