The security concept that a user should only be granted the minimum levels of access—or permissions—that are essential to perform their job functions.

Access to mission-critical systems and systems that contain confidential or restricted information will only be provided to users based on documented business requirements, job functions, or a demonstrated need-to-know.

Access to these systems must be approved by the appropriate supervisor and/or data owner. All such systems must utilize an authentication protocol to verify user identities before granting access.

Any individual who violates this policy may be subject to disciplinary action, including but not limited to, termination, loss of data access privileges, administrative sanctions, and personal civil and criminal liability. Any employee or student who interferes with or refuses to cooperate in the investigation of a violation of this policy may be subject to the same disciplinary action.