Roane State Community College

1. Purpose
   This policy outlines best practices and approval processes for using cloud-computing services to support the processing, sharing, storage, and management of institutional data.
2. Overview
   1. Cloud computing offers a number of advantages including low costs, high performance and quick delivery of services. However, without adequate controls, it also exposes individuals and organizations to online threats such as data loss or theft, unauthorized access to corporate networks, and so on.
   2. Cloud computing services are application and infrastructure resources that users access via the Internet. These services, contractually provided by companies such as Apple, Google, Microsoft, and Amazon, enable customers to leverage powerful computing resources that would otherwise be beyond their means to purchase and support. Cloud services provide services, platforms, and infrastructure to support a wide range of business activities. These services support, among other things, communication; collaboration; project management; scheduling; and data analysis, processing, sharing, and storage. Cloud computing services are generally easy for people and organizations to use, they are accessible over the Internet through a variety of platforms (workstations, laptops, tablets, and smart phones), and they may be able to accommodate spikes in demand much more readily and efficiently than in-house computing services.
   3. This cloud computing policy is to ensure that cloud services are NOT used without the Chief Information Officer’s (CIO) knowledge. It is imperative that employees NOT open cloud services accounts or enter into cloud service contracts for the storage, manipulation or exchange of company-related communications or company-owned data without the CIO’s input. This is necessary to protect the integrity and confidentiality of Roane State Community College data and the security of the corporate network.
   4. Roane State Community College’s IT department remains committed to enabling employees to do their jobs as efficiently as possible with technology. The following guidelines are intended to establish a process whereby Roane State employees can use cloud services without jeopardizing company data and computing resources.

3. Scope

   1. This policy applies to all employees in all departments of Roane State Community College, no exceptions.
   2. This policy concerns cloud computing resources that provide services, platforms, and infrastructure that provide support for a wide range of activities involving the processing, exchange, storage, or management of institutional data. This policy does not cover the use of social media services. This policy pertains to all external cloud services, e.g. cloud-based email, document storage, Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), etc. Personal accounts are excluded. If you are not sure whether a service is cloud-based or not, please contact the IT department.

4. Definitions

   1. Cloud Computing – The delivery of computing services over a proprietary network or the internet. Services include infrastructure services, development platforms and software applications.
   2. Infrastructure-as-a-Service (IaaS) – Vendor provides computing resources such as servers (both physical and virtual), storage, networking components and other hardware such as firewalls or load balancers. The provider is responsible for the operating system and hardware while the customer is responsible for the application or software running on the service. Examples: RackSpace, Amazon, IBM, HP.
   3. Platform-as-a-Service (PaaS) – Vendor provides an environment where the customer or developer can build and deliver web-based services over the Internet. Examples: Microsoft Azure, Bungee Labs, Google App Engine.
   4. Software-as-a-Service (SaaS) – Vendor hosts software applications and the data for the customer. No part of the software resides on the user’s computer. Examples: SalesForce, NetSuite, Google Apps, Office 365, Gmail, Hotmail, Yahoo.

5. Policy

   1. The CIO must formally authorize use of cloud computing services for work purposes. The CIO will certify the cloud-computing vendor will adequately address that security, privacy and all other IT management requirements.
   2. For any cloud services that require users to agree to terms of service, such agreements must be reviewed and approved by the CIO.

   3. The use of such services must comply with Roane State Community College’s existing Acceptable Use Policy/Computer Usage Policy/Internet Usage Policy/BYOD Policy (Access the complete detailed RSCC Policy GA-18-08, Data and Personally Identifiable Information Security, at www.roanestate.edu/policies/.)

   4. Employees must not share log-in credentials with co-workers. The IT department will keep a confidential document containing account information for business continuity purposes.
   5. The use of such services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data or any other data owned or collected by Roane State Community College.
   6. The CIO in conjunction with the Data Stewards will decide what data may or may not be stored in the Cloud.
   7. Personal cloud service accounts may not be used for the storage, manipulation or exchange of company-related communications or company-owned data.
6. Cloud Services
   1. Approved Cloud Services
      1. Azure (as part of MEP/Shared Services)
      2. ExaVault (Secure File Sharing)
      3. Microsoft OneDrive
      4. RSCC Office 365
      5. STS (OIR)
      6. SurveyMonkey

   2. Unapproved Cloud Services

      1. Amazon Cloud Drive
      2. Dropbox
      3. Google Drive
      4. iCloud

When using one of the approved cloud services for institutional information, use it only for institutional information classified as shown below. Pay special attention to access levels when sharing files and folders with other collaborators to ensure that data is not inappropriately shared. You may not use your personal cloud services account to collect, process, or store data covered by laws such as HIPAA, FERPA, FISMA, and GLBA.

7. Data Classification

8. Responsible Party
   The CIO is responsible for the development and maintenance of this policy for issuance by the Vice President of Business and Finance.