Downloads Microdata/Raw Data
- Delta Cost ProjectIPEDS Data CenterHow to apply for Restricted Use LicenseOnline Codebook
- ACS-ED TablesData LabElementary Secondary Information SystemInternational Data ExplorerIPEDS Data CenterNAEP Data Explorer
- ACS DashboardCollege NavigatorPrivate SchoolsPublic School DistrictsPublic SchoolsSearch for Schools and Colleges
- NAEP State Profiles (nationsreportcard.gov)Public School District Finance Peer SearchEducation Finance Statistics CenterIPEDS Data Center
- NAEP Question ToolNAAL Questions Tool
- ACS-ED DashboardACS-ED MapsLocale LookupMapEdSAFEMapSchool and District Navigator
- BibliographyED Data Inventory
- AssessmentsEarly ChildhoodElementary and SecondaryPostsecondary and BeyondResourcesSpecial Topics
- NCES BlogWhat's New at NCESConferences/TrainingNewsFlashFunding OpportunitiesPress ReleasesStatChat
- Search Publications and ProductsAnnual ReportsRestricted-use Data Licenses
Recent PublicationsBy Subject Index A-ZBy Survey & Program AreasData Products Last 6 Months
- About NCESCommissionerContact NCESStaffHelp
| Home: Acknowledgments and Introduction |
| Part 1: Planning Your Technology Initiatives |
| Part 2: Determining Your Technology Needs |
| Part 3: Selecting Your Technology Solutions |
| Part 4: Implementing Your Technology |
| Part 5: Safeguarding Your Technology |
| Part 6: Maintaining and Supporting Your Technology |
| Part 7: Training for Your Technology |
| Part 8: Integrating Your Technology |
Appendix A: Sample
Acceptable Use
Agreements and Policies |
| Appendix B: FERPA Fact Sheet |
| Appendix C: Web Guidelines |
| Appendix D: Sample Security Agreements |
| Glossary |
| List of Tables and Figures |
| Powerpoint Overview (700KB) |
Contact:
NCES Webmaster |
Sample Acceptable Use Agreement for Internet and Other Electronic Resources
(courtesy of the Rochester School Department, Rochester, New Hampshire)
The [Name of Organization] recognizes the value of computer and other electronic resources to improve student learning and enhance the administration and operation of its schools. To this end, the [Governing Body Name] encourages the responsible use of computers; computer networks, including the Internet; and other electronic resources in support of the mission and goals of the [Name of Organization] and its schools.
Because the Internet is an unregulated, worldwide vehicle for communication, information available to staff and students is impossible to control. Therefore, the [Governing Body Name] adopts this policy governing the voluntary use of electronic resources and the Internet in order to provide guidance to individuals and groups obtaining access to these resources on [Name of Organization]-owned equipment or through [Name of Organization]-affiliated organizations.
[Name of Organization] Rights and Responsibilities
It is the policy of the [Name of Organization] to maintain an environment that promotes ethical and responsible conduct in all online network activities by staff and students. It shall be a violation of this policy for any employee, student, or other individual to engage in any activity that does not conform to the established purpose and general rules and policies of the network. Within this general policy, the [Name of Organization] recognizes its legal and ethical obligation to protect the well-being of students in its charge. To this end, the [Name of Organization] retains the following rights and recognizes the following obligations:
- To log network use and to monitor fileserver space utilization by users, and assume no responsibility or liability for files deleted due to violation of fileserver space allotments.
- To remove a user account on the network.
- To monitor the use of online activities. This may include real-time monitoring of network activity and/or maintaining a log of Internet activity for later review.
- To provide internal and external controls as appropriate and feasible. Such controls shall include the right to determine who will have access to [Name of Organization]-owned equipment and, specifically, to exclude those who do not abide by the [Name of Organization]'s acceptable use policy or other policies governing the use of school facilities, equipment, and materials. [Name of Organization] reserves the right to restrict online destinations through software or other means.
- To provide guidelines and make reasonable efforts to train staff and students in acceptable use and policies governing online communications.
- Staff members who supervise students, control electronic equipment, or otherwise have occasion to observe student use of said equipment online shall make reasonable efforts to monitor the use of this equipment to assure that it conforms to the mission and goals of the [Name of Organization].
- Staff should make reasonable efforts to become familiar with the Internet and its use so that effective monitoring, instruction, and assistance may be achieved.
- Use of the electronic media provided by the [Name of Organization] is a privilege that offers a wealth of information and resources for research. Where it is available, this resource is offered to staff, students, and other patrons at no cost. In order to maintain the privilege, users agree to learn and comply with all of the provisions of this policy.
- All use of the Internet must be in support of educational and research objectives consistent with the mission and objectives of the [Name of Organization].
- Proper codes of conduct in electronic communication must be used. In news groups, giving out personal information is inappropriate. When using e-mail, extreme caution must always be taken in revealing any information of a personal nature.
- Network accounts are to be used only by the authorized owner of the account for the authorized purpose.
- All communications and information accessible via the network should be assumed to be private property.
- Subscriptions to mailing lists and bulletin boards must be reported to the system administrator. Prior approval for such subscriptions is required for students and staff.
- Mailing list subscriptions will be monitored and maintained, and files will be deleted from the personal mail directories to avoid excessive use of fileserver hard-disk space.
- Exhibit exemplary behavior on the network as a representative of your school and community. Be polite!
- From time to time, the [Name of Organization] will make determinations on whether specific uses of the network are consistent with the acceptable use practice.
- Giving out personal information about another person, including home address and phone number, is strictly prohibited.
- Any use of the network for commercial or for-profit purposes is prohibited.
- Excessive use of the network for personal business shall be cause for disciplinary action.
- Any use of the network for product advertisement or political lobbying is prohibited.
- Users shall not intentionally seek information on, obtain copies of, or modify files, other data, or passwords belonging to other users, or misrepresent other users on the network.
- No use of the network shall serve to disrupt the use of the network by others. Hardware and/or software shall not be destroyed, modified, or abused in any way.
- Malicious use of the network to develop programs that harass other users or infiltrate a computer or computing system and/or damage the software components of a computer or computing system is prohibited.
- Hate mail, chain letters, harassment, discriminatory remarks, and other antisocial behaviors are prohibited on the network.
- The unauthorized installation of any software, including shareware and freeware, for use on [Name of Organization] computers is prohibited.
- Use of the network to access or process pornographic material, inappropriate text files (as determined by the system administrator or building administrator), or files dangerous to the integrity of the local area network is prohibited.
- The [Name of Organization] network may not be used for downloading entertainment software or other files not related to the mission and objectives of the [Name of Organization] for transfer to a user's home computer, personal computer, or other media. This prohibition pertains to freeware, shareware, copyrighted commercial and non-commercial software, and all other forms of software and files not directly related to the instructional and administrative purposes of the [Name of Organization].
- Downloading, copying, otherwise duplicating, and/or distributing copyrighted materials without the specific written permission of the copyright owner is prohibited, except that duplication and/or distribution of materials for educational purposes is permitted when such duplication and/or distribution would fall within the Fair Use Doctrine of the United States Copyright Law (Title 17, USC).
- Use of the network for any unlawful purpose is prohibited.
- Use of profanity, obscenity, racist terms, or other language that may be offensive to another user is prohibited.
- Playing games is prohibited unless specifically authorized by a teacher for instructional purposes.
- Establishing network or Internet connections to live communications, including voice and/or video (relay chat), is prohibited unless specifically authorized by the system administrator.
- The [Name of Organization] cannot be held accountable for the information that is retrieved via the network.
- Pursuant to the Electronic Communications Privacy Act of 1986 (18 USC 2510 et seq.), notice is hereby given that there are no facilities provided by this system for sending or receiving private or confidential electronic communications. System administrators have access to all mail and will monitor messages. Messages relating to or in support of illegal activities will be reported to the appropriate authorities.
- The [Name of Organization] will not be responsible for any damages you may suffer, including loss of data resulting from delays, non-deliveries, or service interruptions caused by our own negligence or your errors or omissions. Use of any information obtained is at your own risk.
- The [Education Agency Name] makes no warranties (expressed or implied) with respect to:
- the content of any advice or information received by a user, or any costs or charges incurred as a result of seeing or accepting any information; and
- any costs, liability, or damages caused by the way the user chooses to use his or her access to the network.
- The [Name of Organization] reserves the right to change its policies and rules at any time.
User Agreement (to be signed by all adult users and student users above grade 5)
I have read, understand, and will abide by the above Acceptable Use Policy when using computer and other electronic resources owned, leased, or operated by the [Name of Organization]. I further understand that any violation of the regulations above is unethical and may constitute a criminal offense. Should I commit any violation, my access privileges may be revoked, school disciplinary action may be taken, and/or appropriate legal action may be initiated.
.
User Name (please print)
.
Parent Agreement (to be signed by parents of all student users under the age of eighteen)
As parent or guardian of [please print name of student] __________________________, I have read the Acceptable Use Policy. I understand that this access is designed for educational purposes. [Name of Organization] has taken reasonable steps to control access to the Internet, but cannot guarantee that all controversial information will be inaccessible to student users. I agree that I will not hold the [Name of Organization] responsible for materials acquired on the network. Further, I accept full responsibility for supervision if and when my child's use is not in a school setting. I hereby give permission for my child to use network resources, including the Internet, that are available through [Name of Organization].
.
Parent Name (please print)
.
Sample Electronic Mail Policy
(courtesy of the Rhode Island Department of Education)
These guidelines are intended to help you make the best use of the electronic mail facilities at your disposal. You should understand the following:
- The agency provides electronic mail to staff members to enable them to communicate effectively and efficiently with other members of staff, other companies, and partner organizations.
- When using the agency's electronic mail facilities you should comply with the following guidelines.
- If you are in any doubt about an issue affecting the use of electronic mail, you should consult the IT Services Manager.
- Any breach of the agency's Electronic Mail Policy may lead to disciplinary action.
- Do check your electronic mail daily to see if you have any messages.
- Do include a meaningful subject line in your message.
- Do check the address line before sending a message and confirm you are sending it to the right person.
- Do delete electronic mail messages when they are no longer required.
- Do respect the legal protections to data and software provided by copyrights and licenses.
- Do take care not to express views that could be regarded as defamatory or libelous.
- Do use an "out of the office assistant" to automatically reply to messages when you are not available.
- Do not print electronic mail messages unless absolutely necessary.
- Do not expect an immediate reply; recipients might not be at their computer or could be too busy to reply straight away.
- Do not forward electronic mail messages sent to you personally to others, particularly newsgroups or mailing lists, without the permission of the originator.
- Do not use electronic mail for personal reasons.
- Do not send excessively large electronic mail messages or attachments.
- Do not send unnecessary messages such as festive greetings or other non-work items by electronic mail, particularly to multiple people.
- Do not participate in chain or pyramid messages or similar schemes.
- Do not represent yourself as another person.
- Do not use electronic mail to send or forward material that could be construed as confidential, political, obscene, threatening, offensive, or libelous.
Please note the following:
- All electronic mail activity is monitored and logged.
- All electronic mail coming into or leaving the organization is scanned for viruses.
- All the content of electronic mail is scanned for offensive material.
Sample Dial-In Access Policy
(courtesy of Rhode Island Department of Education)
The purpose of this policy is to protect [Name of Organization]'s electronic information from being inadvertently compromised by authorized personnel using a dial-in connection.
The scope of this policy is to define appropriate dial-in access and its use by authorized personnel.
[Name of Organization] employees and authorized third parties (customers, vendors, etc.) are permitted to use dial-in connections to gain access to the corporate, or agency, network. Dial-in access should be strictly controlled, using one-time password authentication. Dial-in access should be requested using the corporate account request process. It is the responsibility of employees with dial-in access privileges to ensure that a dial-in connection to [Name of Organization] is not used by non-employees to gain access to company information system resources. Employees who are granted dial-in access privileges must remain constantly aware that dial-in connections between their location and [Name of Organization] are literal extensions of [Name of Organization]'s corporate network, and that they provide a potential path to the organization's most sensitive information. The employee and/or authorized third party individual must take every reasonable measure to protect [Name of Organization]'s assets. Analog and non-GSM digital cellular phones cannot be used to connect to [Name of Organization]'s corporate network, as their signals can be readily scanned and/or hijacked by unauthorized individuals. Only GSM standard digital cellular phones are considered secure enough for connection to [Name of Organization]'s network. For additional information on wireless access to the [Name of Organization] network, consult the Wireless Communications Policy.
Note: Dial-in accounts are considered to be "as needed" accounts. Account activity is monitored, and if a dial-in account is not used for a period of six months, the account will expire and no longer function. If dial-in access is subsequently required, the individual must request a new account as described above.
Any employee found to have violated this policy may be subject to disciplinary action, including termination of employment.
Sample Password Policy
(courtesy of the Rhode Island Department of Education)
Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of [Name of Organization]'s entire network. As such, all employees (including contractors and vendors with access to [Name of Organization] systems) are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.
The purpose of this policy is to establish a standard for the creation of strong passwords, the protection of those passwords, and the frequency of change.
The scope of this policy includes all personnel who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides at any [Name of Organization] facility, has access to the [Name of Organization] network, or stores any non-public [Name of Organization] information.
- All system-level passwords (e.g., root, enable, NT admin, application administration accounts, etc.) must be changed on at least a quarterly basis.
- All user-level passwords (e.g., e-mail, web, desktop computer, etc.) must be changed at least every six months. The recommended change interval is every four months.
- Each successive password must be unique. Re-use of the same password will not be allowed.
- Passwords must be a minimum of eight (8) characters long.
- User accounts that have system-level privileges granted through group memberships or programs such as "sudo" must have a unique password from all other accounts held by that user.
- Passwords must not be inserted into e-mail messages or other forms of electronic communication.
- Where Simple Network Management Protocol (SNMP) is used, the community strings must be defined as something other than the standard defaults of "public," "private," and "system," and must be different from the passwords used to log in interactively. A keyed hash must be used where available (e.g., SNMPv2).
- All user-level and system-level passwords must conform to the guidelines described below.
- Passwords should never be written down or stored online.
4.1 Password Construction Guidelines
Passwords are used for various purposes at the [Name of Organization]. Some of the more common uses include: user-level accounts, web accounts, e-mail accounts, screen saver protection, voice-mail password, and local router logins. Since very few systems have support for one-time tokens (i.e., dynamic passwords which are only used once), everyone should be aware of how to select strong passwords.
- Poor (unacceptable) passwords have the following characteristics:
- The password contains fewer than eight characters.
- The password is a word found in a dictionary (English or foreign).
- The password is a common usage word such as:
- names of family, pets, friends, co-workers, fantasy characters, etc.
- computer terms and names, commands, sites, companies, hardware, software
- acronyms for the agency or city
- birthdays and other personal information such as addresses and phone numbers
- word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
- any of the above spelled backwards
- any of the above preceded or followed by a digit (e.g., secret1, 1secret)
- Contain both upper and lowercase characters (e.g., a?z and A?Z).
- Have digits and punctuation characters as well as letters (e.g., 0?9 and !@#$%^&*()_+|~-=\`<>[]:";í<>. /).
- Are at least eight alphanumeric characters long.
- Are not a word in any language, slang, dialect, jargon, etc.
- Are not based on personal information, names of family, etc.
- Can be easily remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation. (NOTE: Do not use either of these examples as passwords!)
- Do not use the same password for [Name of Organization] accounts as for other non-[ Name of Organization] access (e.g., personal ISP account, option trading, benefits, etc.). Where possible, don't use the same password for the various [Name of Organization] access needs. For example, select one password for the e-mail systems and a separate password for network systems. Also, select a separate password to be used for an NT account and a UNIX account.
- Do not share agency passwords with anyone, including administrative assistants or secretaries. All passwords are to be treated as sensitive, confidential [Name of Organization] information.
- If someone demands a password, refer them to this document or have them call someone in the Office of Network and Information Systems.
- Do not use the "Remember Password" feature of applications (e.g., Eudora, Outlook, Netscape Messenger).
- Do not write passwords down and store them anywhere in your office. Do not store passwords in a file on ANY computer system (including Palm Pilots or similar devices) without encryption.
- Change passwords at least once every six months (except system-level passwords which must be changed quarterly). The recommended change interval is every four months.
- If an account or password is suspected to have been compromised, report the incident to the Office of Network and Information Systems and change all passwords.
- The Office of Network and Information Systems or its delegates may perform password cracking or guessing on a periodic or random basis. If a password is guessed or cracked during one of these scans, the user will be required to change it.
- Applications should support authentication of individual users, not groups.
- Applications should not store passwords in clear text or in any easily reversible form.
- Applications should provide for some sort of role management, such that one user can take over the functions of another without having to know the other's password.
- Applications should support TACACS+, RADIUS, and/or X.509 with LDAP security retrieval, wherever possible.
Any employee found to have violated this policy may be subject to disciplinary action and loss of network privileges.
Application Administration Account: Any account that is for the administration of an application (e.g., Oracle database administrator, ISSU administrator).
