Jump to Footer

NetID Policy

Establishes the governance, administration, security, and acceptable use of SUNY Plattsburgh NetID accounts. Defines the responsibilities of Information Technology Services and NetID account holders for the creation, management, protection, and lifecycle of NetID accounts used to access University information technology resources.

Policy Information

Policy Number Policy Owner
10016.2 Information Technology Services

 

  • 4.0 Policy

    4.1 General

    Each individual requiring access to University information technology resources shall be assigned a unique NetID.

    The NetID serves as the individual’s official electronic identity for authentication to University-owned or University-managed systems and services.

    A NetID may not be shared, transferred, assigned to another individual, or used by anyone other than the authorized account owner.

    4.2 Authorized Use

    A valid NetID is required to access University technology resources, including but not limited to:

    • MyPlattsburgh
    • University Email
    • Microsoft 365 service
    • Google Workspace services
    • Banner
    • Brightspace or other learning management systems
    • Campus Wi-Fi
    • Enterprise applications
    • Other authenticated university services

    Access to individual systems shall be based upon institutional role and business or academic need.

    4.3 Authentication

    All NetID accounts shall be protected through:

    • A University-approved password;
    • Multi-factor authentication (MFA) where required;
    • Security controls established by Information Technology Services.

    Users shall comply with all campus authentication requirements established by ITS. MFA is required for systems designated by the University and currently utilizes Duo as the campus authentication service.

    4.4 Account Security

    NetID account holders are responsible for safeguarding their credentials.

    Users shall not:

    • Share passwords;
    • Share MFA devices or authentication approvals;
    • Allow another individual to use their NetID;
    • Store passwords in unsecured locations;
    • Attempt to bypass authentication controls.

    Suspected compromise of a NetID account shall be reported immediately to the ITS Helpdesk.

    4.5 Account Lifecycle

    ITS shall establish procedures governing:

    • Account creation
    • Account activation
    • Password management
    • MFA enrollment
    • Account modification
    • Account suspension
    • Account deactivation
    • Account removal

    NetID accounts shall remain active only while an individual maintains an authorized relationship with the University and requires access to institutional technology resources.

    4.6 Compliance

    Improper use of a NetID or failure to comply with this policy may result in:

    • Temporary suspension of account access;
    • Permanent revocation of technology privileges;
    • Disciplinary action under applicable University policies and/or Collective Bargaining Agreements;
    • Civil or criminal penalties where applicable.

    4.7 Contractors, Consultants, and Vendors

    Contractors, consultants, vendors, and other non-University personnel who require access to University information technology resources to perform services are not ordinarily issued a standard SUNY Plattsburgh NetID.

    When access to University systems is required, the sponsoring department, in coordination with Information Technology Services (ITS) and/or Collective Bargaining Agreements, may authorize the use of an established service, vendor, administrative, or other approved institutional account appropriate for the business purpose. Access shall be granted only when it is necessary to fulfill contractual obligations and shall follow the principle of least privilege.

    The following requirements apply:

    • A sponsoring University department must be identified and is responsible for requesting, approving, and overseeing the access.
    • Access must be limited to the specific systems, applications, and data necessary to perform the contracted work.
    • Access must be approved by Information Technology Services and, where applicable, the Information Security Office.
    • Accounts must not be used by individuals other than those specifically authorized by the University. Shared credentials are prohibited unless the account has been expressly designated by ITS as a managed shared or service account.
    • Multi-factor authentication (MFA) and other security controls required by the University shall be used whenever technically feasible.
    • Access shall be granted for a defined period and reviewed periodically. Accounts or permissions shall be disabled or removed immediately upon completion of the contracted work, contract expiration, or when access is no longer required.
    • Contractors, consultants, and vendors are subject to all applicable University information security, acceptable use, privacy, and data protection policies, as well as any contractual confidentiality or non-disclosure requirements.
    • Requests for exceptions to this section must be documented and approved by the Chief Information Officer (CIO) or designee in consultation with the Information Security Officer (ISO), when appropriate.

For additional information about this policy, please contact the Policy Owner listed above.

Back to top