• Section 1 - Key Information
• Section 2 - Purpose
• Section 3 - Scope
• Section 4 - Key Decisions
• Section 5 - Policy Statement
• Section 6 - Procedures
• Part A - Equipment Eligibility, Entitlement and Funding
• Part B - Acquisition and Non-Standard Equipment
• Part C - Asset Registration and Deployment
• Part D - User and Manager Responsibilities
• Part E - Security, Software and Compliance
• Part F - Hybrid Work, Off-Campus Use and Travel
• Part G - Support, Repair and Replacement
• Part H - Lifecycle, Leasing, Refresh and Specialist Equipment
• Part I - Transfer, Return and Offboarding
• Part J - Decommissioning, Reuse and Disposal
• Part K - Monitoring, Audit and Non-Compliance
• Section 7 - Definitions
• Section 8 - Authority and Associated Information

Section 1 - Key Information

Section 2 - Purpose

(1) Application of this Policy does not create an entitlement to a University device, computer or other equipment. Equipment allocation remains subject to eligibility, business need, funding and approval requirements.

(2) This Policy sets out how La Trobe University provides, purchases, configures, manages, supports, replaces, reuses and disposes of computers and related end-user technology.

(3) The Policy aims to provide staff and students with secure, reliable and appropriate technology while ensuring University equipment and information are managed consistently, sustainably and cost effectively.

Section 3 - Scope

(4) This Policy applies to University-owned, University-leased and University-managed end-user computing equipment, including:

1. desktop computers, laptops, workstations, tablets and other general-purpose computing devices, monitors, docking stations, keyboards, mice and associated peripherals;
2. devices purchased from central, local, research, grant, project or other University-controlled funds;
3. fixed, portable, shared, pool, loan, teaching, laboratory, specialist and high-performance end-user computing devices;
4. all campuses and locations, including devices used away from campus, at an alternative work location or while travelling; and
5. all staff, students, honoraries, affiliates, contractors, consultants, visitors and third-party service providers who are issued with, use, administer or manage in-scope devices.

(5) This Policy does not apply to:

1. servers, data-centre infrastructure and network appliances;
2. audio-visual and teaching-space equipment, except where a general-purpose computer forms part of that environment;
3. embedded systems, Internet of Things devices, laboratory instruments or operational technology, except for a connected general-purpose workstation; and
4. personally owned devices except where they access University information or systems under an approved arrangement.

(6) Where a device falls within more than one category, Information Services will determine the applicable management, security and support requirements.

Section 4 - Key Decisions

Section 5 - Policy Statement

(7) The University is committed to maintaining a secure, efficient, accessible and standardised end-user computing environment. The following principles govern the provision and management of end-user computing devices:

1. Standardisation: Devices must be selected from the University's approved device catalogue and acquired through authorised procurement arrangements unless a documented exception has been approved.
2. Business need: Equipment will be allocated according to demonstrated teaching, research, accessibility or operational requirements. Preference, seniority or funding availability alone does not create an entitlement to non-standard or additional equipment.
3. Lifecycle management: Devices must be managed through their full lifecycle, including planning, acquisition, registration, deployment, support, refresh, reuse, return and secure disposal.
4. Central management: In-scope devices must be enrolled in approved University management platforms and configured with required security, software, compliance and inventory controls where technically possible.
5. Privileged access: Standing local administrator or equivalent privileged access on University-managed devices is restricted to authorised Information Services support personnel and approved service providers who require it to perform authorised support or administration duties. End users must not be granted standing privileged access except through the approved exception process.
6. Security and compliance: University-managed devices may provide Information Services with information about their security, software, configuration and operational status so the University can identify security risks, respond to incidents, investigate issues and meet audit or regulatory requirements.
7. Information protection: Device controls, handling requirements and permitted use must align with the classification, sensitivity and regulatory requirements of the University information being accessed, processed or stored.
8. Security monitoring: University-managed devices may provide Information Services with information about their security, software, configuration and operational status so the University can identify and respond to security risks, investigate incidents and manage the University's technology environment.
9. Software control: Software may only be installed or used where it has been approved and obtained through authorised University channels. Software that creates additional security, privacy, remote-access or data-transfer risks must not be installed or used without prior approval from Information Services.
10. University ownership: All equipment purchased, leased or funded by the University remains University property unless formally disposed of or transferred under an approved process.
11. Supportability: Non-standard or specialist equipment must have an agreed support model, funding source, lifecycle plan and risk treatment before acquisition.
12. Sustainability: The University will seek to extend useful device life where safe and supportable, redeploy equipment where practical and use approved environmentally responsible disposal arrangements.
13. Monitoring: The University may collect device, software, compliance and usage information reasonably required to manage assets, protect University systems, optimise licences, meet legal obligations and plan lifecycle replacement.
14. University intervention: The University may update, restrict, isolate, lock, recover, reassign or securely erase a device where reasonably necessary to protect University information, systems or services, manage risk or meet legal and contractual obligations.

Section 6 - Procedures

Part A - Equipment Eligibility, Entitlement and Funding

(8) Information Services will maintain an approved catalogue of standard devices, peripherals, operating systems and configurations. The catalogue may be varied from time to time without amendment to this Policy.

(9) Standard equipment will be allocated according to the person's work, teaching, research, accessibility or operational requirements and the University's approved device standards and equipment profiles.

(10) Central funding provides for one standard computer for each eligible ongoing position. An additional computer, duplicate device or exception to this standard entitlement must have a demonstrated business, teaching, research, accessibility or operational need.

(11) Any exception to the standard one-computer-per-position entitlement must be fully funded by the requesting department and endorsed by Information Services and a member of the Senior Executive Group (SEG), or nominee.

(12) Standard specification equipment is provided from central funds managed by Information Services for:

1. full-time continuing staff;
2. staff appointed on a fixed-term basis for more than three years;
3. part-time staff employed at 0.4 EFT or more; and
4. Higher Degree by Research students.

(13) Equipment for the following groups may be provided and managed by Information Services, with the lease cost for the required period charged to the relevant department:

1. casual staff;
2. part-time staff employed below 0.4 EFT;
3. staff appointed on a fixed-term basis for less than three years; and
4. staff working in job-share arrangements.

(14) Equipment for CONAGOTHs, research activities funded from non-recurring funds, adjunct staff, honorary staff and emeritus staff must be funded by the relevant area.

(15) Equipment funded by an area under clause (14) remains the property of La Trobe University, will be recorded and managed by Information Services, and must comply with the University's Standard Operating Environment or be approved through the non-standard equipment process.

(16) Information Services will seek to reuse suitable existing equipment before purchasing or leasing a new device.

(17) Peripheral equipment and IT accessories that are not included with the standard equipment allocation, such as webcams, specialist keyboards, bags or similar items, may be purchased through the New Purchase Request form in Ask Finance. The purchase will be approved through the normal Finance workflow by the relevant work area's or department's financial delegate.

(18) Information Services may provide a functionally equivalent device rather than a particular brand, model or form factor.

Part B - Acquisition and Non-Standard Equipment

(19) End-user computing equipment required as part of a University project, refurbishment or new building must be funded as part of the relevant project.

(20) Where project-funded equipment is still required when it reaches the end of its initial lifecycle, replacement will normally be through the University's standard leased equipment model, subject to ongoing business need and the eligibility requirements in this Policy.

(21) Computers and other end-user computing equipment installed as part of a new teaching space or laboratory must initially be funded through the relevant project.

(22) Where teaching-space or laboratory equipment remains required at the end of its initial lifecycle, it will normally be replaced through the University's standard leased device model.

(23) Any additional equipment or variation from the University's standard equipment specification requires prior approval from Information Services and must be funded by the requesting department.

(24) Where a department requests a different type or specification of equipment before the end of an existing lease, the department must fund the full lease buyout or early termination cost and any additional costs associated with the replacement equipment or change in specification.

(25) Where equipment is funded from research or other non-recurring funds, the equipment must normally be purchased rather than leased.

(26) Research-funded equipment must still comply with this Policy, including the University's standard or non-standard equipment approval processes.

(27) Research-funded equipment remains the property of La Trobe University and will be recorded, secured and managed by Information Services in the same way as other University end-user computing equipment.

(28) All equipment must be acquired through approved procurement arrangements and suppliers in accordance with the Procurement Policy and Procedure.

(29) Local, grant, research or project funding does not remove the requirement to comply with approved technical, security, asset, support and procurement requirements.

(30) A request for non-standard or specialist equipment must document:

1. the teaching, research, accessibility or operational requirement;
2. why the approved standard equipment is insufficient;
3. technical specifications and software or peripheral dependencies;
4. information security, privacy and data-handling requirements;
5. compatibility with University platforms and management tools;
6. warranty, repair, support and supplier arrangements;
7. lifecycle, replacement and disposal funding; and
8. the proposed support classification, including any limitations.

(31) Approval of non-standard equipment does not automatically require Information Services to provide full support. The approved support arrangement must be recorded as fully supported, best-efforts support, supplier-supported, locally supported or restricted-use.

Part C - Asset Registration and Deployment

(32) All in-scope equipment must be recorded in the authorised asset management system before, or as part of, deployment. Asset records must identify the device, assigned user or location, ownership, funding source where required, lifecycle status and relevant support information. Asset records must be updated when equipment is reassigned, relocated, replaced, placed in storage, returned or otherwise changes lifecycle status.

(33) Information Services or an authorised service provider must deploy devices using approved configurations and software. Users must not self-deploy University equipment, create or activate local administrator accounts, or alter the approved security configuration unless expressly authorised through an approved Information Services process.

(34) Devices must, where technically possible:

1. be connected to the University's approved device management systems;
2. use an operating system that is supported and approved by Information Services;
3. use the security settings required by the University, including password, screen-lock, firewall and device-protection settings;
4. use encryption where required to protect University information stored on the device;
5. use University-provided endpoint protection and security software;
6. automatically receive required operating system, application and security updates;
7. allow Information Services to remotely configure, secure, isolate, lock or erase the device where required;
8. provide Information Services with information needed to manage the device, including its software, security and compliance status; and
9. use the University's approved sign-in arrangements, including University accounts, passwords and multi-factor authentication where required.

Part D - User and Manager Responsibilities

(35) Users are responsible for:

1. taking reasonable care of equipment and protecting it from loss, theft, damage and unauthorised access;
2. using equipment in accordance with the IS Acceptable Use Policy, Information Security Policy and other applicable requirements;
3. not sharing assigned equipment with unauthorised people;
4. not removing asset labels, making unauthorised hardware or software modifications, attempting to obtain or use administrator privileges, or using another person’s privileged credentials;
5. not moving, relocating, disconnecting or removing fixed equipment from its assigned University location without prior approval and coordination through an Ask IS request. This includes desktop computers, monitors, docking stations, fixed workstations and associated peripherals. Fixed equipment must not be taken to an alternative work location, including a person’s home, unless expressly approved by Information Services;
6. immediately reporting loss, theft, suspected compromise or unauthorised access, and promptly reporting damage or malfunction, through the approved University reporting channel;
7. making equipment available for updates, audits, maintenance, repair, replacement or recall;
8. storing University information only in University-approved storage locations and systems, such as University-managed OneDrive, SharePoint, Teams, approved network storage and approved University business systems, unless another storage location has been specifically approved;
9. returning equipment when requested or when their employment, appointment, enrolment or engagement ends or changes.
10. using their University account, password and multi-factor authentication as required, and not sharing passwords, approval requests, authentication codes or other sign-in information with another person.

(36) Line Managers are responsible for confirming business need, approving standard equipment within budget, initiating equipment recovery for departing or transferring personnel and supporting stocktake and asset reconciliation activities.

(37) Warranty repairs and repairs resulting from normal fair wear and tear will be managed through Information Services.

(38) Where a repair is not covered by warranty, the cost of repair will be charged to the area to which the equipment is allocated.

(39) Deliberate misuse, fraud, serious misconduct or repeated negligent loss or damage may also be managed under the relevant University staff, student or conduct process.

(40) Users must connect and operate University equipment in accordance with manufacturer, electrical safety and Information Services requirements. Unapproved adapters, storage devices, networking devices or other peripherals must not be connected where they may create a safety, security, compatibility or support risk.

Part E - Security, Software and Compliance

(41) Users must not disable, remove, interfere with or bypass University device management, security, monitoring, encryption, update or access controls.

(42) University-managed devices must use the University's approved sign-in and access arrangements, including University accounts and multi-factor authentication where required.

(43) Local administrator or equivalent privileged access on University-managed devices is restricted to authorised Information Services support personnel and approved service providers who require the access to perform authorised support or administration duties. End users must not be granted standing or persistent privileged access.

(44) An exception may only be approved where the requester demonstrates that the required activity cannot reasonably be performed through standard services, approved software deployment methods, temporary elevation technology or assistance from Information Services. The exception must:

1. identify the specific user, account, device, privileges, permitted activities, business requirement and approval duration;
2. be supported by the user’s manager and relevant system or service owner; 
3. be risk assessed and formally approved by the Chief Information Security Officer and the accountable Information Services service owner, or their specifically authorised delegates, through the approved privileged-access exception process;
4. provide only the minimum privileges required;
5. use a separate privileged identity or an approved controlled-elevation technology;
6. be time limited and include an expiry date;
7. be logged, monitored and subject to periodic review; and
8. be revoked immediately when the approved need ends or the conditions of approval are breached.
9. Funding availability, user preference, convenience, software installation frequency, technical proficiency or seniority do not, by themselves, justify privileged access.

(45) University-managed devices must allow Information Services to regularly check for known security weaknesses and apply security updates, configuration changes or other fixes where required. Users must make their devices available and take reasonable actions requested by Information Services to address an identified security risk.

(46) Information Services may remove, block, restrict or disable unapproved, unsupported or high-risk software where reasonably necessary to protect University information, devices, systems or services.

(47) Software must only be obtained, installed and used through approved University channels and in accordance with applicable software, licensing and security requirements. Users must not install or use unlicensed, unauthorised, unsupported, malicious or otherwise unapproved software.

(48) Approval to obtain or use software does not grant authority to install it using privileged access. Software requiring administrator privileges must be installed through an approved Information Services deployment or support process unless a specific privileged-access exception has been approved.

(49) High-risk software must not be installed, enabled or used on a University-managed device without prior written approval from Cyber Security and Security Operations within Information Services.

(50) High-risk software includes, but is not limited to:

1. screen-sharing and remote-control software;
2. remote-access and remote-administration tools;
3. virtual private network clients not provided or approved by the University;
4. tunnelling, proxy, traffic-redirection or network-bypass tools;
5. software that enables unattended access to a device;
6. peer-to-peer file-sharing software;
7. network scanning, interception or packet-capture tools; and
8. any other software identified by Cyber Security and Security Operations as presenting an elevated security, privacy, data-transfer or network risk.

(51) Approval must be documented, identify the business, teaching, research or operational purpose, and may include conditions relating to configuration, duration, Users, devices, information access, monitoring, network connectivity and removal.

(52) The University may measure software installation and usage for licence compliance, cost optimisation and security. Unused or unauthorised software may be removed or reclaimed.

(53) Users must not interfere with, disable or obstruct approved monitoring, logging, detection, vulnerability management, backup, recovery or security and device-status information capabilities.

(54) Devices that are unsupported, non-compliant, compromised, unlocatable or present an unacceptable risk may be restricted, isolated, blocked, remotely locked, wiped or removed from service.

(55) Non-leased equipment that is no longer supported by the manufacturer or software vendor and consequently presents a security or operational risk to the University must either:

1. be upgraded or replaced at the cost of the area responsible for the equipment; or
2. be decommissioned by Information Services.

Part F - Hybrid Work, Off-Campus Use and Travel

(56) University equipment may be used away from campus where this is consistent with the person’s role, approved work arrangements and applicable information security requirements.

(57) Equipment used away from campus remains University property and must remain available for management, security updates, support, audit, return and replacement.

(58) The University funds and provides standard hardware and equipment for use at La Trobe University office and campus locations. Hardware or duplicate equipment for alternative work locations, including working from home, is not provided or funded by the University. Fixed equipment assigned to a University location, including desktop computers, monitors, docking stations and associated peripherals, must not be removed or taken to an alternative work location without prior written approval from Information Services and an approved Ask IS request.

(59) Users working from an alternative work location are responsible for providing and maintaining home-office equipment not supplied by the University, subject to any approved workplace adjustment or other formal arrangement. Equipment personally purchased by a staff member does not become University-owned or University-supported equipment simply because it is used for University work.

(60) Users must take reasonable precautions when transporting equipment and must comply with any restrictions applying to international travel, sensitive data, high-risk locations or export-controlled technology.

(61) Users must not disable approved backup, synchronisation, recovery or resilience mechanisms where these are required to protect University information or support restoration after loss, compromise or disruption.

(62) Personally owned devices approved to access University information or systems must comply with minimum security requirements specified by Information Services which may include supported operating systems, screen lock controls, encryption, endpoint protection, multi-factor authentication, conditional access and enrolment in approved management platforms.

Part G - Support, Repair and Replacement

(63) Repairs and modifications must only be performed by Information Services, an authorised service provider or a supplier approved by Information Services.

(64) Users must not arrange unauthorised third-party repairs or modify device hardware, firmware or security settings.

(65) Information Services will determine whether equipment should be repaired, replaced, redeployed or retired having regard to warranty, age, condition, supportability, security, performance, business need and total cost.

(66) Temporary or loan equipment may be supplied where available but is not guaranteed and may not match the user’s usual model or configuration.

(67) All repairs that are not covered by warranty will be charged to the area to which the equipment is allocated.

(68) Any modification, expansion or upgrade to University equipment after it has been deployed must be approved by Information Services and funded by the area to which the equipment is allocated. This includes, but is not limited to, additional or upgraded memory (RAM), storage, graphics or video cards, or other internal hardware components.

Part H - Lifecycle, Leasing, Refresh and Specialist Equipment

(69) Information Services will maintain lifecycle standards for device categories. Lifecycle periods are operational standards and may be changed without amendment to this Policy.

(70) Replacement is based on supportability, security, warranty, condition, performance and business need and is not automatically triggered by preference, accounting depreciation or the release of a newer model.

(71) Devices may be redeployed or reused where they remain secure, supportable and fit for purpose.

(72) Specialist, research, laboratory, operational technology or legacy devices that cannot meet standard requirements must have:

1. a documented business owner and technical owner;
2. a current risk assessment and approved exception;
3. appropriate compensating controls, which may include network segmentation or restricted access;
4. a defined support arrangement;
5. a remediation, upgrade or replacement plan; and
6. an expiry date and periodic review of the exception.

(73) Where a department requests that leased equipment be replaced, changed or returned before the end of the agreed lease term, the department must fund the full lease buyout or early termination cost.

(74) At the end of a device lease, Information Services will make and document at least three attempts to contact the equipment user and their budget holder to arrange replacement and return of the equipment. If no response is received, the budget holder will be advised that the equipment remains outstanding. Where leased equipment is not returned and there is no legitimate reason for the lack of response, such as an extended period of approved leave, any costs charged to the University by the leasing provider will be passed on to the relevant department.

(75) Any leased equipment that is not returned, or that is returned damaged beyond fair wear and tear, may result in costs being charged to the department to which the equipment was allocated. All leased equipment and accessories provided at deployment, including power supplies, docking stations and any other leased components, must be returned at the end of the lease lifecycle.

Part I - Transfer, Return and Offboarding

(76) Equipment is assigned to a person, role, service or location and must not be permanently transferred to another person or organisational unit without updating the asset record and obtaining any required approval.

(77) Equipment must be returned by the date directed by the University when:

1. employment, appointment, enrolment or engagement ends;
2. a person transfers, is seconded or change’s role and the equipment is no longer required;
3. equipment is recalled, replaced or reaches end of support;
4. the business need or entitlement ceases; or
5. the University otherwise reasonably requires its return.

(78) Returned equipment must include all University-provided or leased accessories, power supplies, docking stations, peripherals and other components issued with, or subsequently assigned to, the user or equipment.

(79) Information Services may disable or restrict access associated with equipment that is not returned, cannot be located or remains assigned to a person whose relationship with the University has ended.

(80) Any costs incurred by the University because leased equipment or associated accessories are not returned may be charged to the department to which the equipment was allocated.

Part J - Decommissioning, Reuse and Disposal

(81) Equipment must not be temporarily or permanently relocated between workspaces, buildings, campuses or organisational areas without following the approved Information Services relocation process. An Ask IS request must be submitted where Information Services assistance, asset-record updates or technical validation is required.

(82) Equipment must only be decommissioned or disposed of through an approved University process.

(83) Before reuse, sale, donation, recycling or disposal, University information must be securely erased or storage media physically destroyed in accordance with approved standards. Software licences and management profiles must also be removed or reassigned as appropriate.

(84) Equipment should be considered for internal redeployment or approved reuse before disposal where it remains secure, supportable and economical.

(85) Disposal must use approved environmentally responsible arrangements and comply with the Asset Management Policy, Asset Management Procedure - Disposal/Sale and applicable financial, privacy, security and records requirements.

(86) University equipment must not ordinarily be sold or transferred to its assigned user. Any exceptional transfer must be approved under Section 4 and must address valuation, secure data removal, software licensing, financial, tax and disposal requirements.

(87) Information Services may recover and repurpose equipment that has not been used for three months where there is no demonstrated ongoing business, teaching or research requirement for the equipment. Information Services will make reasonable efforts to confirm whether the equipment is still required before recovering it.

(88) Information Services may recover and repurpose equipment that has not been used for three months where there is no demonstrated ongoing business, teaching or research requirement for the equipment. Information Services will make reasonable efforts to confirm whether the equipment is still required before recovering it.

(89) A computer allocated directly to an individual user must not be transferred directly to another user. The computer must first be returned to Information Services so that University information can be securely erased, the device can be checked and updated, and the asset record can be amended before it is issued to another user.

(90) Shared, hot-desk, laboratory and departmental loan equipment may be reassigned without full return to Information Services where Information Services confirms that appropriate data-security, device-management and asset-management arrangements remain in place. These arrangements will be assessed on a case-by-case basis.

(91) Computers that have not been used or connected to University management services for six months are considered dormant equipment. Dormant equipment may no longer contain current software, security updates or configuration and may require the operating system and software to be reinstalled before the computer can be returned to use. Any costs associated with restoring dormant equipment to service may be charged to the area responsible for the equipment.

(92) Information Services will determine whether end-user computing equipment is reused, repurposed, redeployed, salvaged, recycled or disposed of, considering security, supportability, condition, value, sustainability and University requirements.

Part K - Monitoring, Audit and Non-Compliance

(93) The University may collect and use device information reasonably necessary to:

1. manage and secure devices;
2. maintain hardware and software inventories;
3. verify compliance with University requirements;
4. manage warranties, repairs and support;
5. optimise software licences and technology costs;
6. investigate security or acceptable-use incidents;
7. plan lifecycle replacement and service capacity; and
8. meet legal, regulatory, contractual, audit and records obligations.

(94) Information collected from University-managed devices may be used to identify and respond to security incidents, manage security weaknesses, investigate incidents, support recovery and meet audit, legal or regulatory requirements.

(95) Monitoring and management activities must be proportionate and undertaken in accordance with the Privacy Policy, Information Security Policy, Records Management Policy and applicable law.

(96) Non-compliance with this Policy may result in the restriction or withdrawal of equipment or access and may be managed under applicable staff, student, contractor, security or conduct processes.

Section 7 - Definitions

(97) For the purpose of this policy and procedure:

1. Approved device catalogue: The current range of device models, configurations and peripherals approved by Information Services for University use.
2. Budget holder: The person responsible for the relevant University cost centre, department, project, grant or other funding source.
3. Central funding: Funding managed by Information Services for standard end-user computing equipment provided to eligible users under this Policy.
4. Device persona: An approved equipment profile based on a defined teaching, research, accessibility or operational use case.
5. Dormant computer: A University computer that has not been actively used or connected to University device-management services for six months.
6. End user: A person who uses a device to perform their ordinary University role, teaching, study, research or operational activities and who is not exercising an authorised Information Services support or administration function.
7. End-user computing device: A general-purpose computing device used directly by an individual or group, including desktop computers, laptops, workstations, tablets, mobile computing devices and associated peripherals.
8. Fixed equipment: University equipment assigned to and intended to remain at a designated workspace, room or University location, including desktop computers, fixed workstations, monitors, docking stations and associated peripherals.
9. High-risk software: Software that creates or materially increases remote access, privileged access, network connectivity, traffic redirection, information transfer, monitoring or security-control bypass capability. This includes screen-sharing, remote-control, remote-administration, non-University VPN, tunnelling, proxy, peer-to-peer and similar software.
10. Information Services: The University organisational function responsible for enterprise information technology services.
11. Lease lifecycle: The agreed period for which equipment is leased before it must normally be returned, replaced or otherwise managed under the University's leasing arrangements.
12. Non-standard equipment: Equipment, configurations, operating systems or peripherals that are not included in the approved device catalogue or do not meet the applicable standard.
13. Non-warranty repair: A repair that is not covered by the manufacturer's, supplier's or leasing provider's warranty, including damage, alterations or failures excluded from warranty coverage.
14. Privileged access: Access that permits a person or account to install software, change security or system configurations, manage other accounts, bypass standard controls, access protected system functions or otherwise exercise elevated administrative permissions.
15. Security and device-status information: Information about a device's software, security settings, compliance, activity and operational status that is used to manage security risks, identify threats, investigate incidents and support recovery or audit requirements.
16. Specialist equipment: Equipment required for a specialised teaching, research, accessibility, laboratory, operational or high-performance use case.
17. Standard Operating Environment (SOE): The approved operating system, standard applications, security controls and technical configuration used on University-managed end-user computing devices.
18. Standing privileged access: Privileged access that remains continuously assigned or available to a person or account, rather than being issued temporarily for a specific approved task.
19. Supportable: Able to be securely managed, maintained, repaired and supported through an approved University, supplier or local support arrangement.
20. University equipment: Equipment owned, leased, funded or otherwise controlled by La Trobe University, regardless of funding source or assigned location.
21. User: Any person issued with or authorised to use University equipment. 

Section 8 - Authority and Associated Information

(98) This Policy is made under the La Trobe University Act 2009.

(99) Associated information includes:

1. Ask Finance – New Purchase Request process or guidance
2. Asset Management Policy
3. Asset Management Procedure - Disposal/Sale
4. End-User Device Standard
5. End-User Device Management Procedure
6. Hybrid Working and Alternative Work Location Procedure
7. Information Security Policy
8. Information Security Standard
9. IS Acceptable Use Policy
10. Privacy Policy
11. Procurement Policy
12. Procurement Procedure
13. Records Management Policy
14. Workplace Adjustment (Staff) Policy

(100) Where an inconsistency arises between this Policy and a law, regulation, University statute, delegation or higher-order University policy, the higher-order requirement prevails.