Notifications and Review
- Employee Notification: Notification of intent to terminate employment should be provided as far in advance as possible. Certain rules for notification for faculty are included in the Faculty Handbook, and rules for notification for staff are included in the Staff Handbook. An employee may want to contact CIS well in advance of the separation date for guidance in making the separation process clear and smooth.
- Supervisor Notification: A supervisor may also want to contact CIS well in advance of the employee separation date for guidance with the process.
- Employee Disclosure: The employee is obligated to disclose to the supervisor all privileged information such as key contacts, email addresses, phone numbers, files and archives etc. relevant to the functions/business responsibilities held on behalf of the University.
- Access Review: The employee and supervisor should review all internal and external User accounts, data stores, resources, and systems well in advance of separation and either copy files to the appropriate backup staff members, or make sure critical institutional data is preserved for future business use.
Most University access (Banner, Canvas, Talisma, Tableau, etc.) is automatically revoked by CIS using the MARS system. CIS also automatically removes membership in permission groups and university distribution lists.
- All departmental email distribution lists and departmental User Groups will be terminated automatically by MARS on the separated date noted by HR..
If the departing employee does not have any other university role that will allow the continuation of SPU accounts or resources, several automated actions will take place after the last day of employment and at prescribed time frames that follow:
- Access to CIS MARS managed administrative systems systems, databases, privileged accounts based on employment status will be immediately revoked after the last day of employment.
- Access to computers and equipment that have been assigned to the employee will be revoked after the last day of employment.
- Access to the departing employee’s email account will persist for 30 days past the last day of employment.
- The account will be purged 120 days after the last day of employment. During this time, the Out-of-Office greeting will persist.
By the last day of employment, the following items will be understood and completed by the employee:
- All employment/business related accounts, systems, and data will be transferred to the supervisor, or other designee.
- All person/non-business related accounts, systems, and data will be removed from SPU provided equipment and systems.
- All employment/business related accounts, systems, and data that is stored on personally owned and maintained systems will be removed and deleted.
- Out-of-Office messages and greetings will be put in place.
Prior to the last day of employment, all employment/business related accounts, systems, and data that might be in place or configured on personally owned computers, tablets or phones should be deleted and removed. Identify and document types of accounts, data stores, procedures, and any other information that is relevant and needed for the smooth continuation of business functions or activities after the end of employment. Including but not limited to:
- Transfer Documents and Data: copy, transfer, or provide all employment/business related data to your supervisor, to a shared resource (SharePoint, a departmental share (Matthew), etc...), or another employee so designated by the supervisor.
- This should include email, My Documents, OneDrive for Business, and any other information stored on university-provided or non-SPU systems, computers, drives, or systems. This might include a snapshot of the departing employee's email account (a .PST file) and a snapshot of the departing employee's My Documents, OneDrive for Business, or any other similar resources.
- This includes any data that has been stored in systems or locations outside of those managed by the University
- Transition Accounts/Access: transfer or remove access to any 3rd party accounts not managed by CIS. These include applications such as Mail Chimp, Survey Monkey, TargetX, Formstack, SmugMug. It also includes access to vendor support access like Slate, Banner, Atlassian, Tableau, etc.
- Remove University Data from Personal Devices: remove and delete all employment/business related data, accounts, and systems from all personally owned devices. This includes all personally owned computers, tablets, phones, at home, other cloud services, etc...
- Remove Personal Data from University Systems: remove and delete all personal/non-employment related accounts, systems, and data from university provided computers, systems and equipment.
On about the final day of employment, the employee shall establish and enable an Out-of-Office greeting on their SPU email account. This greeting is to remain in effect for thirty (30) days following employment separation or three (3) months for an employee that will continue to use their SPU-provided email account after the end of employment.
Out of Office Greeting
The email account Out-of-Office greeting shall include the following information:
- A clear statement that the employee is no longer an agent of the department or University.
- Follow-up contact information for the employee’s supervisor, replacement, or other departmental designee.
- Optional (at the discretion of the University): a personal forwarding address for email that is sent to the departing employee unrelated to University business.
- Email forwarding to a non-SPU email account is prohibited during this notification period.
- At the discretion of the University, the departing employee may continue to use their SPU email account during the notification period if their "standing" allows such continued use. The Out-of-Office greeting and forwarding rules will remain in place for at least 3 months to provide notification regarding transition of employment.
- For current or former students that will have continued access to SPU provided resources after the end of employment - after the 3 months notification period, complete account control returns to their student status and any Out-of-Office messages can be deleted.
Retaining Email Account
SPU offers email services to former students indefinitely, however this offer is at the University's discretion. Employees who are former students will retain their SPU email account unless the supervisor or HR requests that it be removed.
- Out-of-Office Message: current or former students that will have continued access to SPU must maintain the out-of-office notification on their account for 3 months after separation. After the 3 months notification period, complete account control returns to their student status and any Out-of-Office messages can be deleted.
- Purge Business Data: current or former students that will have continued access to SPU must delete all employment/business related email and documents from the account. This should only be done after providing a copy of this data to the supervisor.
Voicemail / Telephone
The departing employee shall establish an Out-of-Office greeting on their telephone voice mail account. This greeting shall include those details described for email account Out-of-Office messages. This greeting will remain in place until the department replaces the employee, re-assigns the telephone extension, or for any other reason at the discretion of the University.
Upon separation the employee must return any university owned equipment. This includes University provided phones, PCs, monitors, printers, or other university owned equipment.
The supervisor will oversee the employee’s actions as described above – including care to make sure email account data (such as a .PST file) and all documents, worksheets, reports, and presentations that the employee may have are transferred to the supervisor or another designated employee. Additionally, the supervisor will:
- Provide the departing employee with specific details as to how/ to whom future University correspondence shall be redirected.
- Verify that the employee activates their Out-of-Office greeting prior to departure, and that this is tested and confirmed functional.
Revoke System Access
Prior to the last day of employment, the supervisor will transition and remove access to all employment/business related accounts, systems, and data .
Transition 3rd Party Accounts
Disable or transition any 3rd party accounts or access not managed by CIS. These include access to applications such as Mail Chimp, Survey Monkey, TargetX, Formstack, SmugMug. It also includes access to vendor support access like Slate, Banner, Atlassian, Tableau, etc.
Preserve University Data
If it there is important University-related information stored on a desktop computer or network resource, the supervisor must communicate to CIS the need to obtain this information prior to the 30-day resource deletion deadline. CIS is not responsible for information that is revealed “needed” after that time, nor is there any guarantee that purged/deleted information will be recoverable from tape backups or other information stores.
Termination for Cause
If the separation is a termination for cause , all prior steps are still in play, but there are additional options for preserving institutional data and communications. See: CIS Privileged Account Usage for policies and permissions that are required.
Documents and Email Snapshots
The department head or HR may request that CIS take a snapshot of the employee's email account, OneDrive for Business, and My Documents resources. This must be done prior to separation.
The document and email snapshots can then be provided by CIS to an employee designated by the department head.
Retaining University Email Account
SPU offers email services to former students indefinitely, however this offer is at the University's discretion. If an individual is a former student and an employee terminated for cause, a department head or VP may request that the email account be terminated along with employment.
If the email account is not retained, the supervisor needs to require that the employee to delete the University email account off any personal devices (mobile phone, tablet, laptop, etc.).