Access Control & Video Surveillance Policy

The purpose of this policy is to establish standards for the administration, operation, and governance of electronic access control systems and video surveillance systems at the State University of New York at Plattsburgh (SUNY Plattsburgh).

This policy is intended to:

• Protect the safety and security of students, faculty, staff, visitors, and campus property.
• Support the University's educational, research, and administrative missions.
• Ensure that access control and video surveillance technologies are used in a
  lawful, consistent, and responsible manner.
• Define the roles and responsibilities of campus departments responsible for the management, operation, and use of these systems.
• Protect individual privacy while balancing the University's legitimate security and operational interests.
• Ensure compliance with applicable federal and state laws, SUNY policies, and campus standards.

 Review Process / Approval

This policy applies to:

• All SUNY Plattsburgh faculty, staff, students, volunteers, contractors, vendors, affiliates, and visitors.
• University Police.
• Information Technology Services (ITS).
• Facilities Maintenance & Operations.
• Office of Emergency Management.
• Campus departments requesting or managing access-controlled spaces.
• Any department utilizing University-owned electronic access control or video
  surveillance systems.

Access Control — The electronic management of authorized entry into University
facilities using card access, mobile credentials, biometrics, or other approved
technologies.

Access Credential — A University-issued card, mobile credential, key fob, biometric identifier, or other mechanism used to authenticate an individual.

Authorized User — An individual approved to access specific facilities or systems.

Electronic Access Control System — Hardware and software used to control, monitor, and record building access.

Video Surveillance System — Network cameras, recording devices, monitoring
software, and related equipment used to observe and record activity.

Personally Identifiable Information (PII) — Information that identifies or can reasonably identify an individual.

Security Incident — An event that threatens the confidentiality, integrity, or availability of University facilities, systems, or information.

Information Technology Services shall:

• Maintain centrally managed access control and surveillance technologies.
• Maintain supporting servers, storage, networking, and cybersecurity controls.
• Implement technical standards.
• Provide system administration.
• Support software updates and maintenance.
• Assist authorized departments with system configuration.
• Maintain system availability and resiliency.

College Auxiliary Services shall:

• Be responsible for the issuance and replacement of official SUNY Plattsburgh Campus Identification (ID) cards.
• Issue official Campus ID cards to eligible students, faculty, staff, affiliates, and other authorized individuals in accordance with University procedures.
• Verify eligibility and identity prior to issuing a Campus ID card.
• Replace lost, stolen, damaged, or expired Campus ID cards in accordance with established campus procedures.
• Assess and collect applicable fees for replacement Campus ID cards, as
  established by the University or College Auxiliary Services.
• Coordinate with Information Technology Services, University Police, Human
  Resources & Payroll Services, Enrollment & Student Success, and other appropriate offices to support the issuance and life cycle management of Campus ID credentials.

University Policy shall:

• Govern operational use of campus surveillance systems.
• Authorize access to investigative recordings.
• Respond to law enforcement requests.
• Coordinate criminal investigations.
• Recommend placement of surveillance systems for public safety.
• Approve operational monitoring practices.

Maintenance & Operations

• Maintain physical doors, door hardware, and supporting infrastructure.
• Coordinate installations with ITS and University Police.
• Support physical security upgrades.

Department heads shall:

• Approve requests for building and room access.
• Review employee access periodically.
• Notify ITS promptly when access should be modified or removed.
• Ensure departmental compliance with this policy.

Human Resource & Payroll Services

• Support timely modification or removal of access privileges.

All Users

Individuals issued access credentials shall:

• Individuals issued a Campus ID card are responsible for safeguarding the card and reporting lost or stolen cards promptly. Replacement fees may apply for lost, stolen, or damaged Campus ID cards, except where otherwise authorized by campus policy.
• Protect University-issued credentials.
• Not loan or share credentials.
• Report lost or stolen credentials immediately.
• Use access privileges only for authorized purposes.

7.1 Access Requests

Departments shall submit access requests using approved campus procedures.

Requests must identify:

• Individual requesting access
• Buildings and rooms
• Business justification
• Required access level
• Appropriate approvals

7.2 Access Changes

Departments shall promptly notify ITS when:

• Employment ends
• Job responsibilities change
• Access is no longer required
• Credentials are lost or stolen

7.3 Video Surveillance Requests

Requests for new surveillance installations shall be evaluated jointly by:

• University Police
• Information Technology Services
• Maintenance & Operations
• The requesting department

Evaluation shall consider:

• Public safety needs
• Privacy considerations
• Technical feasibility
• Budget
• Infrastructure requirements
• Legal and regulatory requirements

7.4 Access to Recordings

University requests to review or obtain recordings shall be directed to University Police.

University Police shall determine whether release is appropriate based upon:

• Active investigations
• Applicable law
• Records retention requirements
• Privacy considerations
• Legal obligations

7.5 Incident Response

When access control or surveillance systems indicate suspicious activity or system compromise:

1. University Police shall respond to security incidents.
2. ITS shall investigate technical issues affecting the systems.
3. Evidence shall be preserved when appropriate.
4. Appropriate campus officials shall be notified.
5. Incidents shall be documented according to campus incident response
   procedures.

7.6 Compliance

Violations of this policy may result in:

• Suspension or removal of access privileges.
• Disciplinary action.
• Referral to Human Resource & Payroll Services or Student Conduct.
• Criminal prosecution where applicable.

The University reserves the right to audit access records, system logs, and
administrative activities to ensure compliance with this policy.

None

None

There are no specific trainings identified with this policy.