School of Medicine & Public Health – Information Systems Warning Banner

Layout for printing
Policy Number:
SMPH-6005
Old Policy Number:
60.05
Responsible Office:
SMPH Cybersecurity

School of Medicine and Public Health (SMPH) Policy

Rationale/​Purpose:

The School of Medicine and Public Health (SMPH) is committed to maintaining the privacy, confidentiality, and security of university-owned data. This policy supports a comprehensive governance, risk, and compliance (GRC) program and serves to be consistent with information security best practices associated with organizational information security management. The purpose of this policy is to set forth technical and legal requirements and expectations related to user acknowledgment of access to SMPH information systems or university-owned data prior to accessing such systems or data. This policy should be used in conjunction with SMPH-6020 User Account Management Policy and related university policies.

Definitions:
Confidentiality, integrity, and availability (CIA)
  • Confidentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
  • Integrity: Guarding against improper information modification or destruction, which includes ensuring information non-repudiation and authenticity.
  • Availability: Ensuring timely and reliable access to and use of information.
Data
Information, whether electronic or hard copy, that is collected, stored, transferred, or reported for any purpose.
Information system
A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. An interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people.
IT asset
Equipment or software used to manage, process, or store UW System, UW–Madison, or SMPH data and used in the course of accomplishing UW System, UW–Madison, and SMPH missions.
SMPH information systems
All information systems that are managed and supported by the SMPH and all other entities residing within the SMPH (e.g., SMPH departments, centers, institutes, etc.).
Warning banner
A computer system pre-login text window that advises authorized and legitimate users of their obligations related to acceptable use of the computerized or networked environment(s) and their consent thereof. A pre-login warning banner also provides a definitive warning to any possible intruders that may want to access your system that certain types of activity are illegal.
Scope:

This policy applies to all SMPH departments, centers, and institutes.

Policy:

This policy establishes requirements of necessary controls and processes supporting the display of a defined system-use notification message or banner to users prior to granting access to information system resources. It supports the confidentiality, integrity, and availability (CIA) of departmental and SMPH information systems and university-owned data. This policy maintains that:

  1. Information technology (IT) assets accessing SMPH information systems that are storing or transmitting university-owned data will display a warning banner notification prior to granting access to such information systems as part of the log-in process.
  2. Elements of the warning banner must include:
    1. Access is only permitted for authorized members/users, and unauthorized access will incur legal penalties.
    2. Users have no expectation of privacy, and they are subject to monitoring with or without permission.
    3. Activity is subject to review and release to law enforcement under UW–Madison policy, state statute, and federal policy. By attempting to log in, logging in, and while accessing this system, users acknowledge and accept the terms and conditions.
  3. Warning banners should be reviewed annually to ensure they are meeting current expectations and policy.
  4. All devices with a warning banner must have security controls in place to monitor login attempts as detailed in SMPH-6020 User Account Management.

  5. The following message is an example that outlines the expectations regarding access to SMPH information systems and their data:

    "Authorized user access only. You are about to access a protected information system containing university-owned data. Actual or attempted unauthorized access and use of this computer system may result in disciplinary action, criminal, and/or civil prosecution. We reserve the right to view, monitor, record, and audit all activity on this system without notice or permission. Any information obtained by such actions taken is subject to review and release to law enforcement organizations for investigation or prosecution of unauthorized criminal activity on the system in accordance with federal law, state statute, and university policy. If you are not an authorized user of this system, exit the system at this time. By clicking ‘ok’, you agree to and accept these conditions."

Related UW-Madison Policies:
External References:

Policy Administration

Approval Authority:
Dean, School of Medicine and Public Health
Policy Manager:
SMPH Cybersecurity Governance, Risk, & Compliance (GRC) Manager
Contact:
SMPH Cybersecurity Governance, Risk, & Compliance (GRC) Manager -- Amy Diestler, adiestler@wisc.edu, (608) 263-4623
Effective Date:
10-01-2019
Date Issued:
10-01-2019
Revised Dates:

01-15-2020, 08-26-2019, 12-20-2021

Retrieved:
01-16-2025 17:09:55