ICT Policy for EUI Digital Workspace Management

Policy Title: Flexible Workspace Transition Policy for EUI Administrative Staff
Effective Date: October 2024
Responsible Department: ICT Service

1. Purpose
   
2. Scope
3. Objectives
4. Key Policy Provisions
   1. Device Replacement
   2. Security Enhancements
   3. Data Accessibility and Cloud solutions
   4. Administrative Privileges
   5. Compliance and Monitoring
   6. Malfunctions and Damage Cause by Negligence
   7. Laptop Redemption Option
   8. Review and Amendments

1. Purpose
   

This policy outlines the framework for the efficient management of EUI digital workspaces in order to enhance mobility, flexibility, and IT security for administrative staff. It aligns with the expiration of the current desktop loan agreements and the shift towards a more dynamic and cloud-based infrastructure.

2. Scope
   

This policy applies to all administrative staff using EUI desktop computers across all Units within the Institute, as part of the Flexible Workspace Project. The policy covers hardware, software, data security, and IT support services related to EUI users’ endpoints provided by the ICT Service.

3. Objectives

The transition to the new endpoints model aims to:
• Provide greater mobility and flexibility for staff
• Optimise IT resources and streamline device management
• Enhance data and device security through modern security protocols
• Ensure reliable access to cloud-based data and services

4. Key Policy Provisions

1. 1. Device Replacement
      
   • • 
       Desktop to Laptop Transition: all existing desktop computers under the current operative loan will be replaced with laptops by March 2025.
     • Laptop Configuration: laptops will be equipped for full office functionality, including docking stations, external monitors, and peripherals such as mouse and keyboard for standard office environments set up.
       
       
   2. Security Enhancements
      
   • • 
       Encryption: all laptops will have full disk encryption to secure data, even in cases of theft or loss.
     • Authentication: password-less login and multi-factor authentication (MFA) will be offered upon request to enhance security.
     • Automated Updates: real-time security patches, OS updates, and application management will ensure systems remain up to date.
       
       
   3. Data Accessibility and Cloud Solutions
      
   • • 
       Cloud Storage and Services: cloud-based data and services will be accessible from any location, granting seamless access to EUI resources.
     • User Data Migration and Storage on OneDrive: user data will be automatically stored on Microsoft OneDrive and Teams, providing greater file accessibility and backup/restore capabilities.
       
       
   4. Administrative Privileges
      
   • • 
       User Access Permissions: unless more stringent security is required, users will have administrative privileges, allowing them to install software and configure their devices as needed.
     • IT Security and Management: the ICT service will retain centralised control over security policies and critical system configurations to ensure device stability. Based on user responsibilities, the security configurations of endpoints can be further enhanced to reflect the nature and sensitivity of the activities performed on the computers.
       
       
   5. Compliance and Monitoring
      
   • • 
       Staff must comply with the security protocols and usage guidelines outlined in this policy.
     • Regular audits and monitoring will ensure that laptops are used securely and efficiently.
     • Laptops must be kept in a secure configuration state, i.e. no dangerous, potentially harmful, or illegal software should be installed.
     • In the event of a security issue or policy breach, ICT Service reserves the right to remotely reinstall the laptop’s operating system or disconnect the device from the EUI network with short notice to mitigate risks.
       
       
   6. Malfunctions and Damages Caused by Negligence
      
   • • 
       As per Article 6.2 of President Decision No. 20/20, any damages to laptops caused by user negligence may result in the cost of repair being charged to the user.
       
       
   7. Laptop Redemption Option
      
   • • 
       Laptops remain the responsibility and property of the ICT Service and cannot be retained (redeemed) by EUI members after they leave the Institute. Laptops must be returned to the ICT service for data destruction, reconfiguration, and reassignment.
       
       
   8. Review and Amendments
      
   • • 
       This policy will be reviewed annually by the ICT Service to ensure its continued relevance and effectiveness. Amendments will be made as necessary to adapt to evolving technology and user needs.