Campus Email Policy

4.1 General

SUNY Plattsburgh provides email services to authorized members of the University community for communications supporting the University’s academic, administrative, research, and operational activities.

University email accounts and supporting systems are University information technology resources and shall be used in accordance with applicable SUNY and SUNY Plattsburgh policies.

4.2 Official University Communication

University-provided email may be used as an official means of communication with students, faculty, staff, and other members of the University community.

Users are responsible for regularly reviewing communications delivered to their University email account and maintaining access to their account.

4.3 Account Administration

Information Technology Services is responsible for the technical administration of the University’s email environment.

Email accounts shall be established, modified, suspended, and terminated according to an individual’s relationship with the University and applicable account lifecycle procedures.

Users shall not share individual email accounts or authentication credentials.

4.4 Appropriate Use

University email shall primarily be used for legitimate academic, administrative, research, professional, and University business purpose.

Incidental personal use may be permitted provided that such use:

• Does not interfere with University operations;
• Does not result in significant additional cost to the University;
• Does not interfere with the user’s employment or academic responsibilities;
• Does not violate applicable law or University policy; and
• Is otherwise consistent with the University’s Acceptable Use Policy.

4.5 Prohibited Use

University email shall not be used to:

• Conduct unlawful activities;
• Transmit threatening, harassing, discriminatory, or otherwise prohibited content;
• Distribute malicious software;
• Conduct unauthorized commercial activities;
• Send fraudulent or intentionally deceptive communications;
• Impersonate another individual or misrepresent the sender’s identity;
• Circumvent University security controls;
• Distribute unsolicited bulk email except as authorized by the University; or
• Engage in activities prohibited by SUNY or SUNY Plattsburgh policies.

4.6 Email Security

Users shall exercise reasonable care when using University email.

Users shall:

• Protect their NetID and authentication credentials;
• Use multi-factor authentication when required;
• Exercise caution when opening attachments or following links;
• Verify suspicious or unexpected requests;
• Report suspected phishing or malicious email using University-approved procedures; and
• Immediately report suspected account compromise to Information Technology Services.

ITS may implement filtering, malware protection, anti-phishing technologies, authentication requirements, and other security controls necessary to protect University email services.

4.7 Sensitive and Restricted Information

Email shall not be used to transmit restricted or sensitive University information unless the transmission complies with applicable University information security and data protection requirements.

Users should avoid transmitting information such as Social Security Numbers, financial account information, authentication credentials, health information, or other restricted data through email unless there is a legitimate business requirement and an approved secure method is used.

4.8 Automatic forwarding

Automatic forwarding of University email to external or personal email accounts may be restricted or prohibited when necessary to protect University information, meet regulatory requirements, or maintain information security.

ITS may disable automatic forwarding capabilities based upon security risk, data classification, legal requirements, or SUNY directives.

4.9 Mass and Broadcast Email

University-wide or large-scale email communications shall be distributed only through University-approved mechanisms and by authorized individuals or departments. See the 10015.5 Mass Email Policy for guidance.

ITS may establish technical controls governing mass distribution lists and bulk email delivery.

4.10 Shared and Departmental Accounts

Shared, departmental, functional, and service email accounts may be established when there is a legitimate University business need.

Such accounts shall:

• Have a designated University owner;
• Be limited to authorized users;
• Be periodically reviewed;
• Have access removed promptly when no longer required; and
• Comply with University information security requirements.

4.11 Email Records and Retention

University email messages created or received in the conduct of University business may constitute official University records.

Users are responsible for managing University records contained in email in accordance with applicable SUNY records retention and disposition requirements.

Deletion of an email message from an email system does not necessarily eliminate the University’s obligation to preserve the information when it constitutes an official record, is subject to a legal hold, or is otherwise required to be retained.

4.12 Privacy and University Access

University email systems are University resources and are subject to applicable University policies, legal requirements, audits, investigations, records requests, litigation holds, and information security activities.

Authorized University personnel may access email accounts or messages when necessary for legitimate University purposes and when authorized in accordance with applicable University procedures and law.

4.13 Account Separation and Offboarding

When an individual’s employment, enrollment, contractual relationship, or other authorized affiliation with the University ends, email access may be modified or terminated according to established account lifecycle procedures.

University business records and information contained within University email accounts remain subject to University ownership, records retention requirements, legal obligations, and continuity-of-operations needs.

Departments shall coordinate with ITS before an employee’s departure when University business information must be preserved or transferred.

Departing employees shall not delete, transfer to personal accounts, or otherwise remove University records without appropriate authorization.

4.14 Emergency Communications

University email may supplement official emergency communications; however, email shall not be considered the sole mechanism for emergency notification.

The Office of Emergency Management and University Police maintain operational authority for emergency notification and public warning, including applicable Clery Act notifications.

Information Technology Services provides technical support for the email infrastructure used to distribute authorized emergency communications.

4.15 Monitoring and Protection of Email Services

ITS may monitor system performance, security events, message delivery, authentication activity, and other technical information necessary to operate and protect University email services.

ITS may quarantine, block, redirect, or remove email determined to present a cybersecurity threat or significant risk to University information technology resources.