Brooklyn College follows the information technology and security policies set by the City University of New York. They apply to all faculty, staff, students, and everyone using a CUNY account or device a CUNY college network. This page summarizes the ones you are most likely to need and links to the official CUNY policies.
Policies every employee should know:
Acceptable Use of Digital Assets and Resources
(updated 2/13/2024)
The main rulebook for using CUNY computers, accounts, networks, software and data.
- Use CUNY technology for your authorized work. Limited, reasonable personal use is allowed if it does not interfere with your job or CUNY operations.
- Do not expect privacy. Anything in your CUNY account, including personal messages, is subject to CUNY review and may be released under the Freedom of Information Law.
- Do not share your account or password or use anyone else’s. The one exception is temporary access for another CUNY employee while you are on leave.
- Use your CUNY account, not a personal one, for college business. Turn on multi-factor authentication, lock your screen when you step away and keep software up to date.
- Get software approved by the campus CIO or designee before you acquire it.
- Do not use CUNY systems for harassment, a false identity, partisan political activity, a personal business, or streaming and downloading large media files for personal use.
- Complete cybersecurity awareness training when directed, and report security concerns to the college CIO.
Password Standard
(updated 4/3/2025)
Minimum rules for every CUNY password.
- At least 13 characters, with an uppercase letter, a lowercase letter, a number and a special character.
- Must not contain your first name, last name or username, and cannot repeat any of your previous 12 passwords.
- Must be different from the passwords you use on personal, non-CUNY sites.
- Expires at least every 180 days. Multi-factor authentication is required.
- Never share it, and change it at once if you suspect it has been compromised.
- Your computer must lock after 15 minutes of inactivity.
- Recommended: use a passphrase of several mixed words, use a password manager, and do not save CUNY passwords in a web browser.
Data Classification Standard
(updated 8/28/2024)
Sorts all university data into three categories so you know how carefully to handle it.
| Category | What it means | Examples |
| Confidential | High risk if exposed; strongest protection | Social Security, driver’s license, passport and financial account numbers; grades, class rosters and financial aid records tied to a student; health information; citizenship or immigration status; personnel evaluations and disciplinary records; payment card data; passwords |
| Sensitive/Internal | Moderate risk; the default for anything not clearly Confidential or Public | Internal email not approved for release; unreleased budget or personnel information; exam questions and answers; donor identities; FERPA directory information; IT system configurations |
| Public | Little or no risk if disclosed | Public website content, course catalogs, class schedules, academic calendars, press releases, university policies |
- If you are unsure, treat the data as Sensitive/Internal.
- A file takes the category of the most sensitive item in it.
Acceptable Use of University Data in the Cloud Standard
(updated 8/28/2024)
Sets which data may go into which online services, using the three categories above.
- Never put Confidential or Sensitive/Internal data in a personal account you signed up for yourself, such as personal Gmail, Google Drive or a personal Dropbox.
- Sensitive/Internal data may go into a cloud service only after CUNY’s cybersecurity team has reviewed and approved that service.
- Confidential data needs a separate review and approval, for that specific use, by the CUNY cybersecurity team and the University’s Chief Information Security Officer.
- Do not assume a CUNY-licensed service is approved for every kind of data. Check before you store student or employee records.
- Public data may be stored and shared in the cloud without restriction.
- A new cloud service that will hold college data needs IT and legal review and a contract with CUNY’s data-protection terms before you sign up.
Also see:
What files am I allowed to store in CUNY cloud services?
Can I use Google Forms or my personal Gmail for college business?
Email Auto-Forwarding Prohibition Standard
(updated 1/24/2025)
College email may not be forwarded automatically to a non-CUNY address.
- Do not create a rule that sends your college mail to Gmail, Yahoo or any outside account.
- You may forward a single message by hand if it contains no Confidential or Sensitive data and the original stays in your college mailbox.
- To read college mail on your phone, add your college account to the phone’s mail app instead of forwarding. Contact the IT Helpdesk for setup help.
- Why it matters: forwarded mail is harder to retrieve for public-records and legal requests, and can expose your personal account to legal disclosure.
Breach Response and Reporting Procedure
(updated 9/2/2025)
The steps CUNY and the college follow when Confidential or Sensitive data may have been exposed. It is written for the staff who run incident response, but it sets what everyone should do first.
- Report a suspected exposure at once. The college CIO, Legal Affairs, the area Vice President and the head of the department that owns the data must be told within 24 hours.
- Do not delete or destroy anything. Files, messages and devices must be kept as they are for the investigation.
- IT may disconnect an affected device or shut down an application. Neither may be restored until CUNY approves.
- Do not discuss the incident with anyone outside the response team. CUNY’s legal office decides whether affected people are notified.
IT Security Procedures, General
(6/25/2014)
Baseline rules for access to non-public university information such as Social Security numbers.
- Access non-public information only on a strict need-to-know basis for your job, and only with your own individually assigned user ID.
- Do not store Social Security, driver’s license or financial account numbers on a laptop, flash drive or other portable device without approval from the college’s Vice President of Administration and the University Information Security Officer. Approved copies must be encrypted.
- Do not post, display or mail a full Social Security number except where the procedures allow.
- Do not leave documents or devices holding non-public information unattended, and have them securely destroyed when their retention period ends.
- Reach administrative systems from off campus only through a secure connection such as VPN.
- This 2014 document’s password rules and its “non-public information” definition are superseded by the Password and Data Classification standards above.
If your job involves…
Buying software or working with vendors
- CUNY Service Provider Standard: security requirements for outside companies that handle CUNY data. Contact ITS before you buy or sign up for a service.
- Local Administrative Privileges: when administrator rights on a college computer may be granted.
Taking payments or handling financial records
- CUNY Payment Card Industry (PCI) Compliance Policy : rules for any office that accepts credit or debit cards.
- GLBA Financial Information Security Program Policy (PDF): safeguards for student financial information.
- Identity Theft Prevention Program: spotting and responding to signs of identity theft in student accounts.
Student records and public records
- FERPA: who may see student education records and when.
- FOIL Procedures: how public requests for college records are handled.
- Records Retention and Disposition Schedule: how long to keep each type of record before disposal.
- Policies on File Sharing and Copyright Infringement: sharing copyrighted material over CUNY networks.
More CUNY policies
- CUNY Security Policies and Procedures: the full, current list of security documents.
- CUNY IT Policies
- CUNY Policies and Resources: all university policies, including ethics, academic integrity and intellectual property.
- CUNY Statement on Accessibility
- CUNY Website Terms of Use