COLORADO COMMUNITY COLLEGE SYSTEM
APPROVED: January 28, 2021
EFFECTIVE: January 28, 2021
REFERENCES: Board Policy (BP) 6-10, Cyber Security Policy
/ Joe Garcia /
Joseph A. Garcia
This procedure documents requirements for employees, students, and external parties (vendors and contractors) connecting to Colorado Community College System and its Colleges’ (“CCCS”) Information Systems.
This procedure applies to employees, personnel affiliated via third party contracts, and volunteers that have access to Information Systems and Assets that are owned or leased by CCCS.
Remote access is defined as access to CCCS Information Systems by a user communicating through an external network to an internally secured network.
The System Chancellor delegates to the System Vice Chancellor for Information Technology (“IT”) responsibility for oversight of compliance with and implementation of this procedure. Further, the System Chancellor delegates to the College Presidents the responsibility to implement and compliance with this procedure at their respective institution.
CCCS employees are granted remote access rights through secure web portals or cloud-based solutions to email, file share, and other applications. To gain remote access rights directly to CCCS’s internal Information Systems from an external connection, users must utilize only System IT Department (“System IT”) or College IT Department (“College IT”) approved remote access solutions (e.g., VPN, VDI).
- Remote access requests and approvals must be documented.
- Employees and external parties with remote access rights shall adhere to Acceptable Use of Information Resources Procedure and other CCCS procedures governing remote access.
- Remote access login and password information must be kept confidential and shall not be shared.
- Authentication traffic must be secured or encrypted.
- Remote access accounts shall be configured to automatically terminate connection if left idle for more than 120 minutes.
- Access to VPN is limited to CCCS managed or owned devices.
- CCCS employees, personnel affiliated via third party contracts, and volunteers shall complete information security awareness training prior to being granted remote access capabilities.
Remote Access for Third Parties
- Third party remote access requests can only be initiated by System IT or College IT. Third parties may NOT submit a request for remote access themselves.
- Remote access requests must include the following information:
- Third party name and contact information;
- Contact information of the CCCS employee responsible for the third party relationship;
- Remote access start date and duration of remote access; and
- Description of access required.
- Third party access to CCCS resources will be controlled using standard remote access technology (e.g., VPN or VDI).
- Third party remote access, no matter how frequent, will be considered temporary access and therefore limited to only scheduled dates and times.
- Third party user accounts shall only be enabled at times of scheduled remote access. Third party accounts shall be disabled when no longer in use.
- Third party accounts must be secured with a password that meets or exceeds CCCS password requirements set forth in Access and Authentication Procedure.
- Upon completion of work, third party accounts shall be disabled on associated devices and documented through the System IT or College IT ticketing system.
Monitoring of Remote Access
- Remote access accounts shall be monitored on a semester basis to ensure that remote access accounts are valid and that accounts that have reached their expiration dates have been deactivated.
Revising this Procedure
CCCS reserves the right to change any provision or requirement of this procedure at any time and the change shall become effective immediately