��߲ݴ�ý Computer Account Management Account Password Policy

Policy title ��߲ݴ�ý Computer Account Management Account Password Policy	Category Administration Human Resources Information Technology
Owner CS/IT	Approved by Administrative Council

Purpose of this policy

Individual computer accounts are at the foundation of ��߲ݴ�ý University’s data security and data access control strategy. ��߲ݴ�ý provides all faculty, staff and students with individual computer accounts. These accounts allow access to a wide variety of computing resources and are used to provide granular control over the access granted to institutional services and data. Account credentials, i.e. username and password, secure user access to these accounts.

This policy provides guidance for assuring that ��߲ݴ�ý account passwords comply with appropriate security standards.

Application of this policy

This policy applies to all ��߲ݴ�ý accounts provided to faculty, staff, students, contractors and volunteers and impacts all systems and services requiring authentication via user ��߲ݴ�ý account credentials.

Exceptions to this policy may be authorized only by the Director of Information Services Infrastructure with the advice and recommendation of the ��߲ݴ�ý Unix Systems Administrator and the express approval of the Vice President for Finance and Administration.

Policy statement

��߲ݴ�ý Account Password Requirements

��߲ݴ�ý account passwords must comply with the following structural requirements:

Passwords are case sensitive.
Minimum password length is 12 characters
Maximum password length is 28 characters
Passwords must include at least one character from each of these character types:
- Upper case letters
- Lower case letters
- Numerals
Passwords MAY contain symbols, but limited to the following six (6) ! . , / ~ =
Other symbols or spaces MAY NOT be included.

In addition, your ��߲ݴ�ý account password(s) should not contain your ��߲ݴ�ý username, common dictionary words, common phrases or references (for example, “PrairieWolf” or “GoBigRed”) or use the same character three or more times consecutively.

CSIT will conduct periodic password security audits to test the strength of ��߲ݴ�ý account passwords and will notify account holders of any passwords determined to be too weak.

��߲ݴ�ý Account Password Aging

��߲ݴ�ý account passwords may remain in use no longer than 120 days. Seven days prior to the expiration of the 120-day limit, ��߲ݴ�ý account holders will receive email reminders that their account password must be changed. Reminders will continue until the account password has been changed.

If an account password has not been changed prior to the end of the 120-day period, the user account will be locked and login will be prohibited. The account will be required to reset the account password to regain access to the account.

��߲ݴ�ý account password resets and password changes should be performed through links on the CSIT web site at .

Review

This policy shall be reviewed at least annually or as required to assure consistent application to any new services or resources.

���߲ݴ�ý

���߲ݴ�ý Computer Account Management Account Password Policy

��߲ݴ�ý

��߲ݴ�ý Computer Account Management Account Password Policy