Skip to main content

Logical Access Security Procedure

Effective Date: September 1, 2025
Revised Date: September 22, 2025

1. Purpose

This procedure establishes standards for account creation, management, and information system management across all systems and accounts within the university. It is designed to align with guidance from the National Institute of Standards and Technology (NIST), Arkansas Legislative Audit, and the Criminal Justice Information Services (CJIS) Security policy, while incorporating operational considerations specific to our user environment.

2. Scope

This procedure applies to all users, including employees, students, contractors, and vendors who access any information system, application, or service under the control of the Arkansas State University Jonesboro campus. Any mention of specific teams, user groups, management groups, or leadership teams will only be applicable to their Jonesboro campus counterpart unless explicitly stated otherwise.

3. Definitions

This section of the procedure serves to assign clear ownership of the necessary components for management and implementation of the logical access security procedure.

  • Chief Information Officer (CIO): Responsible for establishing and coordinating the campus’ information systems management strategy, ensuring alignment with organizational objectives and regulatory requirements.

  • ITS Security Team: Responsible for monitoring the campus’ digital infrastructure for both internal and external threats and verification of compliance with organizational objectives and regulatory requirements. This includes the investigation and response of reported or identified security incidents and maintenance of monitoring tools.

  • ITS Systems Team: Responsible for the campus’ domain-level system administration. Responsible for designing, documenting, maintaining, and overseeing enterprise infrastructure, system configurations, and access to control frameworks. This includes the active management and documentation of all information system accounts. This team establishes the standards and procedures to which endpoint-level support activities must adhere.

  • ITS Hardware Team: Responsible for the campus’ endpoint-level system administration. Endpoint-level administration will maintain infrastructure in alignment with the standards and procedures designed by the ITS Systems Team.

  • Department of Human Resources: Responsible for conveying employee employment status to those responsible for organization-level system administration.
  • Office of the Registrar: Responsible for conveying student registration status to those responsible for organization-level system administration.

4. Procedure Exceptions

The Chief Information Officer for the Jonesboro Campus is authorized to review and approve exceptions to this procedure when organizational needs justify a deviation, and the associated risks are deemed acceptable. All exceptions must be documented, including a defined scope, a scheduled review date, and incorporate compensating controls when appropriate. The CIO may delegate this authority as necessary but retains overall accountability for exception management and review.

5. Passphrase Requirements

This section of the procedure serves to establish four account security levels and outline their respective passphrase requirements. These account security levels serve to accommodate varying account passphrase requirements based on the sensitivity of systems accessed. Universal account passphrase requirements apply to all security levels unless specified otherwise. This section also outlines requirements for local account passphrases but does not place them at a specific security level as their use outside of emergencies is strongly discouraged.

Passphrase settings are not considered enforced unless systematically required.

  1. Universal Account Passphrase Requirements

    1. Prohibited Passphrases:

      Passphrases must not appear on known compromised passphrase lists or commonly used passphrase databases. Passphrases will be screened against such lists during passphrase creation and change. A mechanism will be used to detect user passphrases that become compromised after being selected by the user.

    2. Passphrase Reuse

      (i) A user’s passphrase cannot match their last 24 set passphrases within the campus’ information systems.

      (ii) Users must create unique passphrases for each individual system to which they are given access.

      (iii) Reuse of personal account passphrases for business purposes is strictly prohibited.
    3. New User Passphrases
      Users will be required to change their initially assigned passphrase.
    4. Multi-Factor Authentication (MFA)
      Users will be required to authenticate using a multi-factor solution during their first authentication of the day for each individual resource. This authentication will be valid for a period of 4 hours. Security Level 3 and 4 accounts are excluded from this universal requirement and will instead follow a stricter requirement as outlined in their section.
    5. Alternative Authentication Solutions

      Other technologies for user identification and authentication, such as biometrics (e.g., fingerprint verification, signature verification) and use of hardware tokens (e.g., smart cards) will be considered and made available for users, if appropriate. Security Level 3 and 4 accounts are excluded from this universal requirement and will instead follow a stricter requirement as outlined in their section.

    6. Duplicated Passphrases

      All user passphrases will be unique and cannot match the passphrase of another account in the campus’ information system. This includes any additional account a user may have (such as an administrator account) but excludes accounts synced to the same passphrase using passphrase synchronization at the domain level.

  2. Security Level 1 Accounts
    1. Passphrase Length

      Account passphrases must be a minimum of 15 characters in length.

    2. Passphrase Complexity

      Passphrases must include at least one uppercase letter, one lowercase letter, one number, and one special character. Users are strongly discouraged from using repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).

    3. Passphrase Rotation

      Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

    4. Account Lockout Threshold

      Accounts will be temporarily disabled for 15 minutes after five (5) consecutive failed attempts within a 15-minute period. At the end of this 15-minute lockout the user's account will automatically unlock, and the process will restart. Passive authentication attempts are excluded from this requirement.

  3. Security Level 2 Accounts
    1. Passphrase Length

      Account passphrases must be a minimum of 20 characters in length.

    2. Passphrase Complexity

      Users are strongly discouraged from using repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).

      No other complexity requirements are imposed.

    3. Passphrase Rotation

      Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

    4. Account Lockout Threshold

      Accounts will lock after 5 consecutive invalid logon attempts by a user during a 15-minute period. This account will stay locked until an A-State representative releases the account. Passive authentication attempts are excluded from this requirement.

  4. Security Level 3 Accounts
    1. Passphrase Length

      Account passphrases must be a minimum of 20 characters in length.

    2. Passphrase Complexity

      Users are strongly discouraged from using repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).

      No other complexity requirements are imposed.

    3. Passphrase Rotation

      Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

    4. Account Lockout Threshold

      Accounts will lock after 5 consecutive invalid logon attempts by a user during a 15-minute period. This account will stay locked until an AState representative releases the account. Passive authentication attempts are excluded from this requirement.

    5. Enhanced MFA Requirements

      Users will be required to authenticate using a multi-factor solution upon each account authentication.

    6. Endpoint Configuration

      Endpoints will be configured to block security level 3 accounts from directly accessing them. Instead, security level 3 accounts will be required to access an endpoint using their security level 2 account and then elevate their access using system specific solutions (such as Sudo on Linux or RunAs on Windows).Security Level 3 Accounts

      1. Passphrase Length

        Account passphrases must be a minimum of 20 characters in length.

      2. Passphrase Complexity

        Users are strongly discouraged from using repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).

        No other complexity requirements are imposed.

      3. Passphrase Rotation

        Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

      4. Account Lockout Threshold

        Accounts will lock after 5 consecutive invalid logon attempts by a user during a 15-minute period. This account will stay locked until an AState representative releases the account. Passive authentication attempts are excluded from this requirement.

      5. Enhanced MFA Requirements

        Users will be required to authenticate using a multi-factor solution upon each account authentication.

      6. Endpoint Configuration

        Endpoints will be configured to block security level 3 accounts from directly accessing them. Instead, security level 3 accounts will be required to access an endpoint using their security level 2 account and then elevate their access using system specific solutions (such as Sudo on Linux or RunAs on Windows).

  5.  
  6.  

6. Use of AI in Research

AI use in research should:

  • Support (not replace) ethical research practices

  • Comply with institutional research ethics and regulatory requirements

7. Use of AI in Administrative and Operational Functions

When AI is used in university operations (e.g., admissions, financial aid):

  • The university must clearly disclose where and how AI is used

  • Human oversight must be applied to AI decisions that affect individuals

AI use must comply with relevant regulations, including but not limited to:

  • FERPA (Family Educational Rights and Privacy Act)

  • GLBA (Gramm-Leach-Bliley Act)

  • HIPAA (Health Insurance Portability and Accountability Act)

  • Other applicable federal, state, or international laws such as:

    • UK Data Protection Act 2018

    • EU GDPR

    • EU AI Act

    • China’s Personal Information Protection Law

9. Prohibited Uses of AI

The following are not permitted:

  • Using AI for academic dishonesty (e.g., cheating or plagiarism)

  • Collecting or using personal data without authorization

  • Discriminatory or biased use of AI

  • AI surveillance without approval from A-State IT Security and Legal departments

10. Use of AI Assistant Guidelines

10.1 Overview

AI assistants, such as those integrated into Microsoft Teams or Zoom, can provide valuable support in meetings by generating summaries, action items, and transcripts. However, they are not appropriate for all settings and should only be used in meetings where their presence aligns with meeting objectives, privacy expectations, and institutional policy.

10.2 Risks to Consider

  • Privacy Concerns – AI assistants record and process meeting content, which may include sensitive or confidential information.
  • Data Security – Content may be stored in third-party systems depending on the AI service provider, potentially outside the institution’s control.
  • Compliance – Certain discussions (e.g., FERPA-, HIPAA-, or CJIS-protected data) must not be recorded or processed by AI assistants.
  • Informed Consent – All participants should understand and agree to AI assistant use prior to recording or summarizing a meeting.
  • Legal Considerations – Recorded discussions and summaries/transcripts may be subject to legal discovery in future litigation. 

10.3 Guidance for Approved Use of AI Assistants

  • AI assistants should never be enabled by default in recurring meetings or meeting templates.
  • AI assistants may be used in Microsoft Teams meetings only when all participants provide explicit consent at the start of the meeting.
  • The meeting organizer is responsible for announcing the AI assistant’s presence and its intended function (e.g., transcription, note-taking, summarization).
  • Avoid enabling AI assistants in meetings that include confidential, legally protected, or sensitive data.
  • Store and share AI-generated notes only in secure, approved A-State storage platforms (e.g., Microsoft OneDrive, SharePoint) and should only be shared with individuals who were part of the meeting.

10.4 General Guidance on Preventing AI Assistants from Joining Meetings

  • In Microsoft Teams, review and adjust meeting options before the session to ensure that AI assistants are not automatically admitted.
  • Disable transcription, recording, or meeting summarization features unless explicitly needed and approved.
  • If an AI assistant joins unexpectedly, the meeting organizer should remove it immediately and verify settings before proceeding.

11. Compliance and Enforcement

Misuse of AI may result in disciplinary action per A-State's employee and student handbooks. The university may review AI usage to ensure institutional compliance, especially for licensed tools.

12. Review and Updates

These guidelines will be reviewed as AI technologies and regulations evolve. The IT Security Panel will monitor compliance and propose updates when necessary.

13. Contact Information

14. Approved AI Platforms

See Appendix I for A-State-approved AI platforms. All other tools must go through the standard Software Purchase Request process, including submission of a VPAT and HECVAT or ITS Security Questionnaire.

Use of OpenAI platforms such as ChatGPT or DALL·E is discouraged unless a Business Associate Agreement (BAA) is obtained.

Appendix I – Approved AI Platforms

The following AI tools meet A-State's compliance and data protection standards:

  • Microsoft Copilot (Strongly Recommended)

    • Fully compliant with FERPA and HIPAA

  • Claude Pro (Anthropic)

  • OtterAI

While Microsoft Copilot is preferred due to its robust compliance standards, other listed tools are acceptable for use. OpenAI platforms (e.g., ChatGPT, DALL·E) are generally discouraged unless approved through a BAA.

 

 

Back to top