user Account Creation & Retention

Policy 14.6
Approved by:	President
Responsible Officer:	CHIEF INFORMATION OFFICER
Responsible Office:	INFORMATION TECHNOLOGY SERVICES
Originally Issued:	06/30/2025
Last Revision:	NEW
Category:	TECHNOLOGY
Related Policy
DSU Access Control Policy

1. Reason for Policy

   To govern the creation and management of user network accounts. Maintaining these accounts ensures accountability, a key to any robust computer security framework, in managing information resource utilization. It is imperative for the University's security program to diligently oversee the creation, control, and monitoring of all computer accounts and their associated access privileges. This policy is designed to safeguard the University's information technology systems, network, devices, and all associated digital data.

2. Definitions

   1. Account. Refers to the actual user’s credentials, username, and password, that is used to access University technical resources.
   2. Affiliate/Vendor Accounts. Third-party affiliates that use DSU accounts for business activity but are not employees of DSU.
   3. CIO (Chief Information Officer). Campus Chief Information Officer is the department head for the DSU (Dakota State University) technology department.
   4. Deactivated Account. An account that is not accessible to the user, as a result, access to all resources associated with the account are restricted.
   5. Deleted Account. The permanent deletion of a user's network account involves removing stored email, any associated digital data, and access to all University resources and systems.  Once an account is deleted, user data cannot be recovered.
   6. Inactive Account: A user account that has not logged into or accessed the associated email service through any method (e.g., webmail, mobile app, or email client) for a continuous period of one (1) year.
   7. Information Technology Systems. Technology that includes all electronic tools utilized to generate, store, access, transmit, and utilize digital data, information, or communications in administrative, instructional, research, or service-related activities.
   8. Information Technology Services. The official technology department for Dakota State University and subsumed departments.
   9. Users. Employees, students, Emeriti, and third-Party vendor or affiliates, volunteers, agents, and authorized users accessing University information technology systems and applications.

3. Statement of Policy

   1. DSU requires all employees, students, and third-party affiliates to obtain electronic identifiers (username and password) to gain access University resources necessary for them to successfully complete their job duties and to protect these resources from unauthorized use.
   2. Account Creation Requirements
      
      1. Students. ITS will create accounts for new students upon receiving confirmation of acceptance to the University. Account access information and set-up instructions will be sent to the new student's alternate email address as provided.
      2. Faculty.  ITS will create accounts for new faculty upon notification from Human Resources regarding their employment status. Account access information and setup instructions will be sent to the new faculty member's alternate email no earlier than 90 days (3 months) prior to the new faculty’s contract start date.
      3. Staff.  ITS will create accounts for new staff upon notification from Human Resources regarding their employment status.  Account access information will be provided to new staff on the first day of employment during ITS Onboarding, scheduled by Human Resources.
      4. Affiliate/Vendor Accounts.  Affiliates may obtain an account from ITS upon providing identification, justification, and authorization from the CIO.
         1. University contracts with vendors and contractors to support business processes and functions, manage systems and applications and perform tasks on behalf of the University.
      5. Alumni.  Graduating students may request an alumni account upon graduation. Once verified, the account will be limited to Exchange Online access.
   3. Account Management Requirements
      
      1. All staff and faculty user account requests shall be initiated, documented, and approved by the Human Resources department.
      2. Faculty and staff must complete security awareness training within 7 days of receiving account access.
      3. Prior to executing a forgotten or expired password reset, the user's identity must be verified by ITS staff.
      4. User accounts and access levels are to be requested by the direct supervisor of the account holder. Additionally, ITS will conduct a periodic review of accounts to verify appropriate system access privileges, in adherence to the University’s Access Control Policy.
      5. Regular monitoring of user accounts for suspicious activity will be performed by ITS staff.
   4. Account Retention Requirements
      
      1. Student Accounts.  Students who have attended but have not graduated shall be deactivated and deleted by ITS staff from the system two (2) semesters after the last semester in which they are enrolled.  Accounts created for students upon acceptance, who did not complete registration at the University, will be deleted after the census day of the student's most recent accepted term.
      2. Staff and Faculty Resignations, Retirement, or Termination. Upon resignation from employment, the staff account shall be deactivated on the employee's last working day, with the official end date and time provided by Human Resources. ITS shall delete the account from the University's user management system 30 days after the official end date.
         1. Adjuncts. Accounts remain active during contracted teaching terms and will be deactivated following the end of the contract period, as indicated by Human Resources. If an adjunct faculty member has a future teaching assignment within the upcoming academic year, their account may remain active based on information provided by Human Resources. In cases where no upcoming contract is recorded, the account will be deactivated after the current term concludes and deactivated for one (1) year. If no new contract is awarded during this deactivation period, the account will be permanently deleted from the University's user management system.
      3. Emeriti Status.  Upon official notification to ITS from the Office of the Provost, emeritus faculty will have the privilege of a limited DSU email address. If the email account remains inactive (not logged into) for over one (1) year, it will be considered unused and deactivated.  ITS shall delete the account from the University's user management system 30 days after the deactivation date.
      4. Affiliate/Vendor Accounts.  These accounts are used for university business, access to those accounts shall be disabled immediately upon completion of service.
      5. Alumni Accounts.  Alumni accounts will retain the privilege of an email address. If an account remains inactive for over one (1) year, it will be deactivated. ITS will purge the account from the University's user management system 30 days after the deactivation date.
      6. No user ID is reissued to a new user.  User IDs previously used will not be reissued to new users with similar names.

   Exclusions

   N/A

   Exceptions

   Exceptions to this policy shall be reviewed and approved by the CIO.

4. Procedures (Major)

   1. Account Creation.
      
      1. Student accounts shall be automatically created by ITS staff daily by identifying accepted students within the student record system.
      2. Employee accounts shall be initiated by Human Resources.
      3. Vendor access requests shall be reviewed by ITS and handled based on need and access risk.
      4. All faculty, staff, and students are provided with a network account that includes a DSU email address.
   2. Account Email Designations
      
      1. Faculty and Staff Accounts.  All employee accounts will use the designated staff email address, @dsu.edu.
      2. Student Accounts.  All student accounts will use the designated student email address, @trojans.dsu.edu.
      3. Alumni Accounts.  Graduated students who request and are verified as alumni will be assigned a designated alumni email address, @trojans.dsu.edu.
      4. Affiliate/Vendor Accounts.  All affiliate/vendor accounts will use the designated staff email address, @dsu.edu, if email is applicable.

5. Related Documents, Forms, and Tools

   How to Change your Preferred or Legal Name Change

   Change Name / Preferred Name or Address Form

6. Policy History

   Adopted: 06/30/2025