Shared Systems Security Policies & Practices

Policies

General

• Shared Systems used by staff such as Alma and ILLiad as well as Shared Systems tools such as Redmine, should only be accessed by devices configured securely to protect the privacy, security, confidentiality, integrity, and availability according to local campus IT and security policies.
• All non-student library staff should be required to complete local campus IT security training at regular intervals according to local campus practice. If student staff are not required to complete the same training, they should be strongly encouraged to complete the same training.
• Discovery-Fulfillment will take additional steps to ensure walk-in patron records are purged at the same time campuses are purging regular patron records.

Alma Staff Role Policies

• An annual review of access to Shared Systems and Shared Systems tools (Redmine, etc.) as documented in [Link for document 121407 is unavailable at this time] is required by each campus, under the direction of the Shared Systems Manager.
• Expiration dates on Alma roles for student workers:
  • Roles should be added to (or activated on) Alma accounts when the student worker starts work.
  • Student workers with Alma staff roles shall be required to have expiration dates on every staff role. 
  • Expiration dates should be added when the role is added/activated.
  • The expiration date should be one day after the last day student employment is allowed for a semester or other term at that campus.
  • If no date of last employment is specified by a campus, the latest expiration date used should be 4 weeks after the last instruction date of a semester or term.
  • Staff with access to the User Role Manager web application for updating roles and expiration dates. 
  • See (System) User Role Manager: How to Use for instructions.  

    • List of campus staff with access to the role manager tool.

      Campus	Staff	Email
      Eau Claire	Dan Hillis	HILLISDR@uwec.edu
      Eau Claire	Brad Gehrke	GEHRKEB@uwec.edu
      Green Bay	Melissa Platkowski	platkowm@uwgb.edu
      La Crosse	Kelly Peter	kpeter@uwlax.edu
      La Crosse	Scott Pfitzinger	spfitzinger@uwlax.edu
      Milwaukee	Andy Ritter	aritter@uwm.edu
      Milwaukee	Aaron Dobbs	dobba@uwm.edu
      Milwaukee	Joe Tomich	jtomich@uwm.edu
      Milwaukee	Lynne Jones	jones873@uwm.edu
      Oshkosh	Crystal Buss	buss@uwosh.edu
      Parkside	Heather Spencer	spencerh@uwp.edu
      Parkside	Jay Dougherty	doughert@uwp.edu
      Plattevile	Jessica Donahoe	donahoej@uwplatt.edu
      Plattevile	Katie Murphy	murphykath@uwplatt.edu
      Plattevile	Elizabeth Haase	haaseel@uwplatt.edu
      River Falls	Christy Boyer	christy.boyer@uwrf.edu
      Stevens Point	Matt Sonnenberg	msonnenb@uwsp.edu
      Stevens Point	Carrie Kline	cakline@uwsp.edu
      Stout	Matthew Winkler	winklerma@uwstout.edu
      Superior	Natasha Schumacher	nschuma6@uwsuper.edu
      Superior	Hanna Paquette	hpaquett@uwsuper.edu
      Whitewater	Patricia Fragola	fragolap@uww.edu
      Whitewater	Branden McCready	mccreadb@uww.edu

• Managers of any library staff (permanent or student) are obligated to report the end of employment to Alma system administrators as soon as possible to facilitate the prompt removal of Alma staff roles. Job Category and all staff roles (not Patron) should be removed for staff when they leave employment.
• Shared Systems will develop a report to identify all Alma accounts with active staff roles for campuses to review each year. This will be added to the list of annual tasks in [Link for document 121407 is unavailable at this time] 
• Any staff with access privileges that can see certain levels of circulation, fines or financial data or access to Alma Analytics should be educated on UW data classifications. In particular, Sensitive and/or Restricted data elements and how they can/cannot be used must be understood by all staff who make use of them. Background Information: Information Security: Data Classification 

Alma Analytics Access

Alma Analytics provides access to very sensitive data such as personally identifiable information (PII), which is subject to data governance restrictions. Alma Analytics has no granular data access restrictions. Alma Analytics is an expert's tool that will require a time commitment from staff to understand its user interface, data model and the Alma-to-Analytics data ingestion process (i.e., it is easy to get some numbers out of Analytics, but that does not guarantee they are the right numbers for your inquiry).

• Alma roles with access to Alma analytics should be granted only after additional training is provided to staff that will:
  • Educate staff on what patron data is available within Analytics.
  • Include notes about how and where to save your work in Alma Analytics
  • Include an overview of basic functionality of the system, and, importantly, how to ensure that shared reports within Analytics are not modified in ways that break campus wide reporting.

Alma NZ Access

• Access must be approved by Shared Systems Manager, the Shared Content Expertise Group, or the Discovery-Fulfillment Expertise Group.
• Staff with NZ access are documented in [Link for document 115351 is unavailable at this time], which includes who requested access and who approved it and the date access was granted.

Practices

• KB: [Link for document 90121 is unavailable at this time] - How to purge walk-in patron records
• KB: [Link for document 60735 is unavailable at this time] - Rules for setting purge dates on patron records, and the conditions under which a patron record is eligible to be purged.
• KB: [Link for document 30880 is unavailable at this time] - ILLiad transactions older than 2 complete fiscal years are deleted each summer by the vendor. Patron records that are no longer active are also deleted at that time.