• Section 1 - Key Information
• Section 2 - Purpose
• Section 3 - Scope
• Section 4 - Key Decisions
• Section 5 - Policy Statement
• Conditions and requirements of use
• Section 6 - Procedures
• Part A - User Approval and Access
• Part B - Accounts, Credentials and Authentication
• Part C - Devices and Equipment
• Part D - Software, Applications, Cloud and AI Services
• Part E - Information Handling and Storage
• Part F - Email, Messaging, Collaboration and Social Media
• Part G - Networks, Connectivity and Remote Access
• Part H - Privileged and Administrative Access
• Part I - Remote Work, Travel and Public Environments
• Part J - Unacceptable Use
• Part K - Access, Monitoring and Privacy
• Part L - Reporting, Protective Action and Cooperation
• Part M - Non-compliance and Exceptions
• Section 7 - Definitions
• Section 8 - Authority and Associated Information

Section 1 - Key Information

Section 2 - Purpose

(1) This Policy establishes the conditions and requirements for the acceptable, responsible and secure use of La Trobe University information, accounts, devices, networks, systems, applications, communication services and other Information Services assets and services.

(2) The Policy supports lawful, respectful and productive use of University technology and seeks to protect the University, its community, information and services from misuse, disruption, unauthorised access, data loss and other harm.

(3) This Policy gives contemporary effect to user obligations across University-managed devices, personally owned devices, cloud services, collaboration platforms, artificial intelligence tools, remote work and other modern technology environments.

(4) This Policy must be read consistently with the Use of Computer Facilities Statute 2009. Nothing in this Policy limits or overrides that Statute.

Section 3 - Scope

(5) This Policy applies to:

1. staff;
2. students;
3. Council members;
4. contractors, consultants and service providers;
5. volunteers, visitors, affiliates, honorary, emeritus and adjunct appointees; and
6. other people or non-human identities provided with access to University Information Services assets or services.

(6) This Policy applies to all use of University Information Services assets and services, whether access occurs:

1. on or off campus;
2. within or outside Australia;
3. through a University-managed device or an approved personally owned device;
4. through a University account, credential, network or internet service;
5. through a cloud, software-as-a-service or third-party platform;
6. through email, messaging, collaboration, telephony, social media or contact-centre services; or
7. through artificial intelligence, automation, integration or application programming interfaces.

(7) University Information Services assets and services include, but are not limited to:

1. user accounts, identities, credentials and authentication services;
2. computers, laptops, mobile devices, peripherals and removable media;
3. wired and wireless networks, internet access and remote access services;
4. software, applications, platforms, cloud services and storage;
5. email, messaging, collaboration, telephony and audio-visual services;
6. teaching, research and administrative systems;
7. University social media or online accounts;
8. data, records and information stored, processed or transmitted using University services; and
9. any other technology resource owned, licensed, operated, managed or made available by or on behalf of the University.

Section 4 - Key Decisions

Section 5 - Policy Statement

Conditions and requirements of use

(8) Only authorised Users may access or use University Information Services assets and services.

(9) Access is provided for legitimate University teaching, learning, research, administrative, operational or approved related purposes and remains subject to the requirements set by the relevant information, system, service or resource owner.

(10) Access to University Information Services assets and services must be provided in accordance with the principle of least privilege. Users must only be granted the minimum access required for their authorised role, study, research or activity. Privileged or administrative access is not part of standard end-user access and must not be provided merely for convenience, user preference, seniority or general software-management purposes.

(11) Users are personally responsible for their use of University Information Services assets and services and must:

1. comply with applicable laws, the Use of Computer Facilities Statute 2009, University policies, standards, procedures and contractual obligations;
2. act lawfully, ethically, respectfully and consistently with University values;
3. protect University information, devices, accounts, credentials and services;
4. use only approved technology, software, applications and services for University activities;
5. follow reasonable directions issued by Information Services, Cyber Security and authorised University officers;
6. complete required information security and acceptable-use training;
7. promptly report suspected misuse, loss, theft, data exposure, security events or other concerns; and
8. cooperate with authorised investigations, recovery activities and compliance reviews.

(12) Users are responsible for activity conducted using their University account, credential, authenticated session or assigned device, except where the activity is confirmed to have occurred without their knowledge or control.

(13) Limited and incidental personal use is permitted where it is lawful, reasonable, does not interfere with work, study or University operations, does not create material cost or risk, does not breach another University requirement and does not imply University endorsement.

(14) Users must not expect the University to retain, recover or protect personal content stored on University systems, and limited personal use does not create a guarantee of privacy.

(15) The University may restrict categories of use, devices, systems, roles or locations where this is reasonably required to manage operational, legal, security, privacy or safety risk.

Section 6 - Procedures

Part A - User Approval and Access

(16) Access must only be provided to an identifiable and authorised User or approved non-human identity.

(17) Users must only access information and services required for their authorised role, study, research or activity.

(18) Users must not:

1. access, attempt to access or retain information, systems or services without authority;
2. use another person’s account, credential or authenticated session;
3. allow another person to use their account, credential or authenticated session;
4. attempt to obtain, activate, retain, share or exercise privileged or administrative access beyond what has been specifically approved, including by creating local accounts, using another person’s privileged credentials or bypassing an approved elevation or software-deployment process;
5. continue using access after the authorised purpose has ended.

(19) Access may be modified, suspended or withdrawn when a User’s role, enrolment, appointment, relationship or business need changes or ends.

Part B - Accounts, Credentials and Authentication

(20) Users must protect passwords, passphrases, authentication factors, tokens, certificates and other credentials.

(21) Users must:

1. use unique credentials and approved authentication methods;
2. approve multi-factor authentication requests only when personally initiated;
3. report suspicious authentication prompts or suspected compromise immediately;
4. use a separately assigned privileged account or approved controlled-elevation mechanism for privileged activity and must not use a standard end-user account for administrative access;
5. securely store and use recovery codes and authentication devices.

(22) Passwords and authentication factors must not be shared, written in insecure locations, transmitted through unapproved channels or reused in a way that creates material risk.

(23) University-issued authentication devices, security keys, tokens and recovery credentials must not be shared, transferred or used by another person.

(24) Shared, generic, service and non-human accounts may only be used where formally approved and must have a documented owner and purpose. Non-human identities must use appropriately protected credentials, be limited to the minimum required access, be periodically reviewed and be disabled when no longer required.

Part C - Devices and Equipment

(25) University-managed devices must be used in accordance with the End-User Computing and Device Management Policy.

(26) Users must take reasonable care of University equipment and must:

1. keep devices physically secure;
2. make devices available for updates, audit, repair, replacement or return when requested;
3. promptly report loss, theft, damage or suspected compromise;
4. use approved storage and backup locations for University information; and
5. return University equipment when requested or when their entitlement ends.

(27) Users must not:

1. disable or interfere with device management, encryption, endpoint protection, monitoring, updates or other security controls;
2. remove asset labels or make unauthorised hardware modifications;
3. install unsupported or unauthorised operating systems;
4. share assigned devices with unauthorised people;
5. sell, lend, gift, dispose of, reassign, relocate or otherwise transfer University equipment to another person or location without authority and completion of any required asset-management or ASK IS process; or
6. use University equipment as the primary repository for personal files or personal services.

(28) Personally owned devices used to access University information or services must comply with the Bring Your Own Device Standard and applicable University security, access, authentication and device-management requirements. The University may restrict or withdraw access from any personally owned device that is unsupported, compromised, insecure or otherwise non-compliant.

(29) University information must not be stored on personally owned devices unless expressly authorised and protected in accordance with the Bring Your Own Device Standard and applicable information handling requirements.

Part D - Software, Applications, Cloud and AI Services

(30) Software, applications, cloud services, browser extensions, plugins, bots, integrations and artificial intelligence tools used for University activities must be approved through applicable University processes.

(31) Users must not:

1. install or use unlicensed, malicious, unsupported or unauthorised software, applications, browser extensions, plugins, scripts or tools;
2. use personal cloud storage, personal email or unapproved messaging services for University information;
3. activate free, trial or click-through services for University activities without approval;
4. connect unapproved integrations, agents, bots or plugins to University systems or information;
5. use corporate cards, local funds or other means to bypass technology approval processes; or
6. leave fixed equipment at its assigned University location unless its relocation or removal has been approved and coordinated through an ASK IS request
7. move, relocate, disconnect or remove fixed University equipment from its assigned location without prior approval and coordination through an ASK IS request, including taking desktop computers, monitors, docking stations or associated peripherals to an alternative work location or home.
8. circumvent software restrictions, licence controls or application security controls.

(32) Users must not install, enable or use screensharing, remote-control, remote-administration, non-University virtual private network, tunnelling, proxy, traffic-redirection, unattended-access or similar high-risk software without prior written approval from Cyber Security and Security Operations within Information Services.

(33) Artificial intelligence and automated tools must be used in accordance with the Responsible AI Adoption Policy and applicable standards.

(34) Users must not enter confidential, sensitive, personal, health, regulated or otherwise restricted University information into an unapproved artificial intelligence service.

(35) Users remain accountable for reviewing and validating artificial intelligence outputs before relying on, publishing or sharing them and must comply with applicable copyright, privacy, academic integrity, records and disclosure requirements.

(36) Artificial intelligence must not be used to impersonate, deceive, discriminate, harass, cause harm or make a significant decision without appropriate human oversight.

Part E - Information Handling and Storage

(37) University information must be stored, handled, shared, retained and disposed of in accordance with the Information Security Policy, Data Governance Policy, Privacy Policy, Records Management Policy and approved information-classification requirements.

(38) Users must:

1. use approved storage, collaboration and communication services;
2. verify recipients and permissions before sharing information;
3. limit access to those with an authorised need;
4. protect sensitive information from unauthorised viewing, listening, copying or disclosure;
5. securely dispose of information when authorised; and
6. report accidental or suspected disclosure promptly.
7. not download or retain University information locally unless expressly authorised, particularly where approved online storage or systems are available or where the information is sensitive or restricted.

(39) Users must not:

1. send University information to personal email accounts;
2. store University information in personal file-sharing or storage services;
3. copy information to removable media unless authorised and appropriately protected;
4. connect unknown, untrusted or unauthorised removable media or storage devices to University-managed equipment.
5. disclose information to an unauthorised person or third party; or
6. use University information for a personal, commercial or unrelated purpose.

Part F - Email, Messaging, Collaboration and Social Media

(40) University communication services must be used responsibly, professionally and for authorised purposes.
The privacy, confidentiality and integrity of email and messaging services cannot be guaranteed, and users must handle University information accordingly.

(41) Users must not:

1. send unsolicited bulk communications or use distribution lists for unrelated purposes;
2. automatically forward University email to personal accounts;
3. send misleading, deceptive or impersonated communications;
4. harass, threaten, bully, discriminate against or intimidate another person;
5. disclose confidential information in an inappropriate channel;
6. record, transcribe, capture or analyse meetings, calls, screens or conversations, including through artificial intelligence assistants or automated bots, without authority, appropriate notice and any required consent;
7. share meeting links, collaboration spaces or files with unauthorised people;
8. use University accounts to represent personal views as official University positions; or
9. use University communication services in breach of applicable messaging, marketing or anti-spam requirements.

(42) Staff must not use University email accounts as their primary contact point for personal matters or for activities unrelated to their University role, except for limited incidental personal use permitted under this Policy.

(43) Users responsible for University social media or online accounts must protect credentials, use approved account-management practices and comply with University communication and records requirements.

Part G - Networks, Connectivity and Remote Access

(44) Users must use University networks, internet and remote access services in a manner that does not compromise security, performance, availability or the rights of others.

(45) Users must not:

1. connect unauthorised network equipment, wireless access points, routers or other devices;
2. bypass network access, filtering, segmentation or security controls;
3. scan, probe, test, intercept or monitor systems or communications without authority;
4. provide network access to an unauthorised person;
5. use University services to attack, disrupt or interfere with another system or service; or
6. connect a device known or reasonably suspected to be compromised.

(46) Users must not use peer-to-peer, torrenting, high-risk file transfer, traffic-redirection or similar services on University-managed devices or networks unless expressly authorised for a legitimate University purpose.

(47) Security testing, vulnerability research or activities that would otherwise be restricted may only be undertaken where specifically authorised for legitimate teaching, research, security or operational purposes and appropriate controls are in place.

Part H - Privileged and Administrative Access

(48) Standing privileged or administrative access is restricted to authorised Information Services support personnel and approved service providers who require it to perform authorised support, security or system-administration duties. End users must not be granted standing privileged access except under a formally approved, highly controlled and time-limited exception.

(49) An end-user exception must demonstrate that the required activity cannot reasonably be completed through standard access, an approved software-deployment process, temporary elevation technology or assistance from Information Services. The exception must be risk assessed, limited to the specific user, device, activity and duration, approved through the privileged-access exception process, and subject to logging, monitoring, periodic review, a defined expiry date and automatic revocation where technically supported.

(50) A person exercising privileged access must:

1. use a separate privileged account or approved controlled-elevation mechanism;
2. use only the minimum privileges necessary for the approved task;
3. exercise privileged access only for the purpose and period approved;
4. not use privileged access for ordinary email, web browsing, collaboration, personal activity or routine day-to-day work;
5. not share, delegate or disclose privileged credentials;
6. record material administrative changes where required;
7. not access information merely because the privileges technically permit it;
8. comply with applicable logging, monitoring and session-recording requirements; and
9. promptly report accidental, inappropriate or suspected misuse of privileged access.

(51) Information Services or Cyber Security may immediately suspend or revoke privileged access where the approved need has ended, the conditions of approval have not been met, or the access creates an unacceptable risk.

Part I - Remote Work, Travel and Public Environments

(52) Users working remotely or travelling must take reasonable steps to protect devices, information and conversations from loss, theft, unauthorised access or observation.

(53) University equipment may only be used away from its assigned University location where it is portable equipment issued or approved for that purpose. Fixed equipment must not be taken to an alternative work location, including a person’s home, without prior approval from Information Services.

(54) Users must:

1. use approved remote access and collaboration methods;
2. avoid confidential calls or sensitive work in unsuitable public environments;
3. prevent unauthorised screen viewing or listening;
4. keep devices secure during transport and not leave them unattended in public places or vehicles;
5. comply with country, travel or role-specific technology restrictions;
6. promptly report border inspection, seizure, loss, theft or unusual device behaviour; and
7. avoid using public or shared computers for sensitive University services.

Part J - Unacceptable Use

(55) Users must not use University Information Services assets or services to:

1. engage in unlawful, fraudulent, dishonest or deceptive conduct;
2. harass, threaten, bully, discriminate against, intimidate or harm another person;
3. access, create, possess, transmit or distribute unlawful content;
4. infringe copyright, intellectual property, privacy, confidentiality or contractual rights;
5. conduct unauthorised commercial activity, private business or personal profit-making activity;
6. create, introduce, distribute or conceal malicious code;
7. mine cryptocurrency or undertake other unauthorised high-consumption computing;
8. bypass, disable, evade or interfere with security, monitoring, management or protective controls;
9. conceal identity or activity for an improper purpose;
10. impersonate another person, role or organisation;
11. consume excessive bandwidth, storage, processing, support or other resources without authority;
12. undertake unauthorised surveillance, interception, investigation or security testing;
13. transfer University information to personal accounts or unapproved services;
14. damage, disrupt or impair University or third-party systems, information or services; or
15. undertake any activity reasonably likely to expose the University or another person to material legal, security, financial, operational or reputational harm.

Part K - Access, Monitoring and Privacy

(56) The University may monitor, log, access, analyse, preserve, restrict or disclose information about the use of its Information Services assets and services where reasonably required to:

1. operate, maintain and secure services;
2. detect, prevent or investigate suspected misuse, security incidents or policy breaches;
3. recover University information or equipment;
4. meet legal, regulatory, contractual, audit, records or risk obligations;
5. protect people, the University and third parties; or
6. support authorised disciplinary, employment, student, legal or investigative processes.

(57) Monitoring and access must be lawful, proportionate, authorised and limited to legitimate purposes. Information obtained through monitoring must be protected and handled in accordance with the Privacy Policy, Records Management Policy and Information Security Policy.

(58) The University will not ordinarily access the content of a User’s account or communications without a valid operational, security, legal, investigative, records or compliance reason.

(59) Limited personal use does not prevent the University from undertaking authorised monitoring or accessing information where permitted under this Policy.

Part L - Reporting, Protective Action and Cooperation

(60) Users must immediately report, or report as soon as reasonably practicable:

1. phishing, suspicious messages or unexpected authentication requests;
2. lost, stolen or compromised devices or credentials;
3. malware or unusual device or account behaviour;
4. accidental or unauthorised disclosure of information;
5. suspected unauthorised access;
6. security weaknesses or vulnerabilities; and
7. suspected misuse of University Information Services assets or services.

(61) The University may, without prior notice where reasonably necessary, suspend accounts, block access, quarantine devices, remove software, isolate systems, preserve evidence, reset credentials, restrict network access, lock or securely erase University-managed devices, recover University equipment, or suspend any or all Information Services access for a user or group of users where there is a high likelihood of compromise, severe breach or material risk.

(62) Protective action taken by Information Services or Cyber Security is intended to manage risk and does not determine whether misconduct has occurred.

(63) Users must cooperate with authorised investigations, evidence preservation, incident response, recovery, audit and compliance activities.

(64) Good-faith reporting is encouraged. Retaliation against a person who makes a legitimate report is not permitted.

Part M - Non-compliance and Exceptions

(65) Non-compliance may result in restriction, suspension or withdrawal of access, equipment or services and may be addressed under applicable staff, student, contractor, legal, academic integrity, conduct or disciplinary processes.

(66) Information Services may take immediate protective action but conduct findings and disciplinary outcomes remain the responsibility of the relevant authorised University process.

(67) Serious, unlawful or high-risk misuse may be referred to relevant external agencies, regulators or law enforcement authorities where appropriate.

(68) Any exception to this Policy must:

1. be documented;
2. identify the legitimate business, teaching, research or operational need;
3. be risk assessed;
4. include appropriate conditions or compensating controls;
5. have an accountable owner;
6. be approved through the Information Security Policy exception process; and
7. include an expiry date or review date. 

(69) An exception involving privileged or administrative access must also identify the specific user, account, device, privileges, permitted activities and duration; demonstrate why standard access or an Information Services-supported method is insufficient; require appropriate logging and monitoring; and provide for immediate revocation and a defined expiry date.

(70) Approval of another policy exception, software request or business activity does not itself authorise privileged access.

Section 7 - Definitions

(71) For the purpose of this policy and procedure:

1. Artificial Intelligence: A technology or system capable of generating content, making recommendations, identifying patterns, automating tasks or otherwise performing functions commonly associated with human intelligence.
2. End user: A person who uses Information Services assets or services to perform their ordinary University role, teaching, study, research or operational activities and who is not exercising an authorised Information Services support, security or administration function.
3. Information Services Asset or Service: Any account, device, network, system, application, platform, communication service, information repository or other technology resource owned, licensed, operated, managed or made available by or on behalf of the University.
4. Non-human Identity: An account or identity used by an application, service, device, automation, integration or other technology rather than an individual person.
5. Personal Use: Limited use of University Information Services assets or services for a private purpose unrelated to University duties, study or authorised activities.
6. Privileged Access: Access that provides elevated administrative, security, configuration or data permissions, including the ability to install software, alter security controls, manage accounts, change system configurations, bypass standard restrictions or access protected system functions.
7. Standing privileged access: Privileged access that remains continuously assigned or available to a person or account, rather than being issued temporarily for a specific approved task.
8. University: La Trobe University and, where applicable, its controlled entities.
9. University Information: Information created, received, stored, processed, transmitted or managed by or on behalf of the University.
10. User: Any person or non-human identity authorised to access University Information Services assets or services.

Section 8 - Authority and Associated Information

(72) This Policy is made under the La Trobe University Act 2009.

(73) Associated information includes:

1. Data Governance Policy
2. End-User Computing and Device Management Policy
3. Information Security Policy
4. Privacy Policy
5. Records Management Policy
6. Responsible AI Adoption Policy
7. Student Behaviours Policy
8. Student Academic Misconduct Policy
9. Use of Computer Facilities Statute 2009 
10. Workplace Behaviours Policy

(74) Associated procedures and standards, as they are published:

1. Information Classification and Handling Standard
2. Identity and Access Management Standard
3. Privileged Access Standard
4. Endpoint Security Standard
5. Email and Messaging Standard
6. Remote Access Standard
7. Bring Your Own Device Standard
8. Artificial Intelligence Standards and Procedures

(75) Related obligations:

1. Applicable Commonwealth and Victorian legislation, contractual obligations, University codes, academic integrity requirements and authorised terms of use.