Draft Visitor Access to IT Systems, Data, and Restricted Facilities Policy and Procedures

The draft Visitor Access to IT Systems, Data, and Restricted Facilities Policy and Procedures is open for consultation until 5pm, 28 February 2025. This Policy governs how visitors are granted access to University IT systems, internal, sensitive or restricted data, and restricted facilities. Please submit any feedback using this survey link.

Application

All University members acting as sponsors of visitors with access to restricted IT systems, data, or facilities, and all sponsored visitors requiring access to Waipapa Taumata Rau | University of Auckland beyond publicly available systems, data and facilities.

Purpose

To ensure that visitors’ access to restricted University systems, internal, sensitive or restricted data, and restricted facilities is authorised through the correct procedures and that risks associated with visits are assessed and mitigated.

Policy

1. All visitors requiring access to restricted University systems, internal, sensitive or restricted data and restricted facilities must be approved and registered by the University for a specified purpose and term prior to their visit in accordance with this policy.

2. All such visitors require a sponsor who must be a University staff member.

Note: Prospective University of Auckland students, conference and event attendees do not require sponsorship unless they require access to restricted University systems, internal, sensitive or restricted data and/or restricted facilities.

3. International visitors must comply with New Zealand immigration law and hold an appropriate visa for the activities they will undertake while at the University.

Note: Information on visa requirements can be found on the New Zealand Immigration website.

4. The University may make appropriate enquiries, undertake reference checks, request letters of endorsement, or require a memorandum of understanding before approving sponsored visitor status.

5. Sponsored visitors must comply with all University policies, procedures, standards and rules.

6. The University may withdraw its approval of sponsored visitor status and immediately de-provision their access at any time (including where a sponsored visitor or sponsor has not carried out their obligations under this policy).

Procedures

7. Sponsors of visitors must seek approval by Level 3 line managers, academic heads, or above on the University’s Organisational Structure, or their delegate, and approval must be recorded in the Sponsored Visitor Registration Form. Members of the Senior Leadership Team may approve their own visitors, but the visit must still be registered. Approvers must consider if the visitor may present any health & safety, security, privacy, reputational or financial risk to the University, as guided by the University’s Risk appetite.

Note: the Sponsored Visitor Registration Form is a new form that will be developed in 2025.

8. Approved, sponsored visitors must self-register to create a University Identity.

9. Sponsors must arrange for completion of the IT Service Access for Contractors, Visitors & External Collaborators form on behalf of their sponsored visitors.

10. Visitors to restricted facilities require an additional approval by the University delegate who approves access to particular restricted facilities. The sponsored visitor must comply with any induction, training and/or access requirements for the facility and must be supervised by a University member at all times.

11. The sponsor must review all applicable University policies, procedures, standards and rules and building-specific processes relevant to the activities to be undertaken by the sponsored visitor and ensure that this information is made available to the visitor for their review before their visit.

Note: Health and safety topics contains the University’s standards, procedures and safe work instructions for a range of health and safety risks and topics.

12. The sponsor must record the types and levels of access that have been provisioned to a sponsored visitor, have oversight of the visitor for the duration of their access period, and de-provision that access once the visit or collaboration has ended.

13. Sponsored visitors continue to be bound by University policies and procedures until their access has been de-provisioned, regardless of whether they continue to meet the definition of a sponsored visitor.

Definitions

Internal, sensitive or restricted data are defined in the Data classification standard and Research data classification standard.

International visitors are visitors to University facilities and systems who are not Aotearoa New Zealand residents or citizens and do not have a contractual relationship with the University.

Restricted facilities are defined by the space manager and could refer to any physical space, building, or area owned, leased, or controlled by the University where access is limited to authorized personnel due to the nature of activities conducted, the presence of sensitive or hazardous materials, or the requirement to protect confidential information, intellectual property, critical resources, or any other purpose identified by the space manager.

Space manager is the faculty, LSRI, service division, individual or external entity with primary responsibility for a physical space as approved and recorded through the Space Management Policy.

Sponsor means a University staff member who acts as the sponsor of a visitor and is responsible for complying with the sponsor’s obligations under this policy.

Sponsored visitor means a person who is not a University member and has been sponsored by a University staff member to visit university facilities or systems for a specified purpose and has been approved by a level 3 or above line manager or their delegate.

Staff member refers to an individual employed by the University on a full or part time basis.

University means Waipapa Taumata Rau | University of Auckland and includes all subsidiaries.

University members of Waipapa Taumata Rau | University of Auckland are all students, staff members, honorary and adjunct staff, contractors and subcontractors, consultants, co-locators, tenants, landlords, landlord’s agents and members of University Council.

Visitor means a person who is not a University member who is on University property, including University digital systems.

Key relevant documents:

Document management and control

Owner: Deputy Vice-Chancellor Operations & Registrar
Content manager: Deputy Vice-Chancellor Operations & Registrar
Approved by: Vice-Chancellor
Date approved:
Review date: