Security of Connected Devices Standard

Date: 04/09/2026                             
Last Revised: 07/15/2026                             
Governing Policy: IRM-004: Information Security of University Technology Resources                             
Applies To: Academic Division, the Medical Center, the College at Wise, and University-Associated Organizations.                             
 

Table of Contents

1.  Purpose and Background                                 
2.  Standards                                 
     a) Security Requirements for All Connected Devices                                 
     b) Additional Security Requirements For Devices Owned by The Academic Division or Wise 

     c) Additional Security Requirements for Email Services                                 
     d) Additional Security Requirements for M365 Tenants                                 
     e) Additional Security Requirements for Devices Accessing, Collecting, Displaying, Generating, Processing, Storing, Or Transmitting Regulated Data                                 
     f) Devices Not Meeting Security Requirements                                 
     g) Required Reporting                                  
3.  Definitions                                 
4.  Related Links                                 
5.  Exceptions

[Return to Library]

 

1. Purpose and Background

Those responsible for devices connected to the University of Virginia network and/or accessing University data must secure those devices to help prevent threats to the University’s information technology resources. The IRM-004: Information Security of University Technology Resources policy states that owners and overseers of the University’s information technology (IT) resources must take reasonable care to eliminate security vulnerabilities from those resources. This policy (IRM-004) and its associated standards and procedures apply to the Academic Division of the University, the Medical Center, the College at Wise (Wise), and University-Associated Organizations unless otherwise stated.

This standard highlights the responsibilities for maintaining the security of any device connecting to the University network.

[Table of Contents]

 

2. Standards

 

a)  Security Requirements For All Connected Devices

It is the responsibility of device owners to ensure that all electronic devices that connect to the University's network or that access, collect, display, generate, process, store, or transmit University data meet the following security requirements:

  • Running supported operating systems and firmware
  • Operating systems and firmware are kept up to date with the latest security patches.
  • Remove or disable unnecessary applications and services.
  • Devices with operating systems or firmware that have exceeded the end-of-life support from the vendor must have an approved exception from Information Security.
  • Devices are not modified to remove vendor provided security protections (e.g., jailbreak).
  • Default passwords are changed and meet the University’s authentication requirements.
  • Devices capable of installing antimalware software (such as Microsoft Defender for Endpoint) must have it installed, up-to-date, and running (excluding mobile operating systems).
  • Installed applications are properly licensed, kept up to date, with vendor supplied security patches applied.
  • Host-based firewalls, where available, must be turned on and block unnecessary inbound network traffic.
  • Any suspected or actual security incident is reported to Information Security within one hour.

 

b)  Additional Security Requirements for Devices Owned by The Academic Division or Wise

It is the responsibility of device owners and school/department/unit’s IT personnel/administrators to ensure that all electronic devices owned by the Academic Division or Wise comply with the requirements described in this section.

i) Vulnerability Management

  • All electronic devices capable of installing, configuring and running Qualys Cloud Agent, the University licensed Vulnerability Management solution, must do so.
  • Security patches must be applied based on the severity of the patch:
    • Qualys Urgent (5) within 21 calendar days of patch release
    • Qualys Critical (4) within 45 calendar days of patch release
    • Qualys Serious/Medium/Low - No specific remediation timetable
      • Note: University Information Security may raise or lower the severity of a patch based on other factors.
    • An automated patching solution should be implemented
    • Vendor patches should be tested before applying to a production environment.
  • ITS must configure the Qualys Cloud Agent to:
    • Initiate scans at least daily
    • Communicate scan results at least weekly

ii) Antimalware and Microsoft Defender

  • All electronic devices capable of installing and running Endpoint Detection and Response (EDR) real-time antimalware protection must do so.
  • All servers utilizing a Microsoft Windows Operating System must install and run Microsoft Defender for Servers (MDS) Plan 1 or Plan 2. See Microsoft Defender for Servers.
  • All servers utilizing a Linux Operating System must install and run Microsoft Defender for Servers Plan 1 or Plan 2. See Microsoft Defender for Servers.
  • All non-server electronic devices utilizing an operating system supported by ITS's Microsoft Defender for Endpoint service must install and run Microsoft Defender for Endpoint Plan 2 by July 1, 2026. See Microsoft Defender for Endpoints (MDE).

iii) Administrator Access

  • Administrator level access to servers is logged and tied to a specific user.

iv) Logging

  • Devices should be configured in such a way to prevent alteration or deletion of logs.

v) Device Inventory

vi) Alerts

  • Alerts are set up to identify suspicious activities or access and alerts are reviewed promptly and appropriate action taken.

vii) Hardening Procedures

viii) Data Sensitivity Controls

 

c)  Additional Security Requirements for Email Services

It is highly recommended that central IT email services or Medical Center email services be used for any University related email.  Other email services providers must follow the requirements above when providing email services for University faculty, staff, and/or students.  In addition, email services providers (e.g., servers):

  • Must use a centralized authentication resource (e.g., Shibboleth, Active Directory) or authentication resource approved by University Information Security for account login.
  • Must meet or exceed the University’s authentication requirements.
  • Must be running up-to-date antimalware and anti-spam service.
  • Must automatically send email and authentication logs to the University Information Security’s Security Information and Event Management SIEM tool daily.
  • Must run Data Loss Prevention (DLP) tools that have been approved by University Information Security prior to deployment.
    • The DLP tools must check for and alert the sender of the transmission of Social Security Numbers (SSN) and/or credit card numbers and must inform the sender that such transmissions are not allowed per University policy.
    • Email providers must report DLP violations (e.g., sending HSD to anyone or receiving HSD in email from anyone) and how they were remediated to University Information Security
  • All email service providers sending or receiving email with a virginia.edu domain or sub-domain must:

d)  Additional Security Requirements for M365 Tenants

It is highly recommended that organizations use the ITS Academic or Medical Center M365 tenants for a secure, integrated M365 platform. Organizations not employing these tenants' Microsoft Defender for Servers (MDS) or Microsoft Defender for Endpoints (MDE) must:

  • Forward MDS and MDE logs to University Information Security’s SIEM tool daily .
  • Implement security configuration settings at the same or higher level than the ITS tenant
  • Provide ITS Information Security personnel full access to the tenant security portal

 

e)  Additional Security Requirements for Devices Accessing, Collecting, Generating, Processing, Storing, Or Transmitting Regulated Data

In addition to the security requirements described above, additional requirements may need to be applied to a device based on law, regulation, or contractual agreement.  Additional requirements may be required while traveling in other countries. 

Examples of regulations that may impose additional requirements on a device are:

Consult the applicable grant, award, regulation, and/or the University Vice-President Research Security webpage for guidance on additional security requirements.

 

f)  Devices Not Meeting Security Requirements

In cases where University IT resources and privileges are threatened by other IT resources, Information Technology Services (ITS) and Health Information and Technology (Health IT) may act on behalf of the University to eliminate the threat by working with the relevant owners or overseers. In circumstances where these collaborative efforts fail or there is an urgent situation requiring immediate action, the IT resource may be disabled or disconnected from the network by ITS or Health IT (depending upon the location of the IT resource). This policy applies to all users of the University’s information technology resources, regardless of location or affiliation. See Revoking Information Technology Resource Privileges Standard.

 

g)  Required Reporting

If you think a security incident has occurred, you must report it to University Information Security within one (1) hour from the time the incident is identified. Report the incident at the "Reporting a Security Incident ” webpage (preferred) or the UVA Help Desk at 434-924-4357.  

[Table of Contents]

 

3. Definitions

See the list of definitions for the Acceptable Use, Data Protection, Information Security, and Privacy & Confidentiality policies, standards, and procedures.

Device Inventory: is an up-to-date list of devices owned and/or managed by a department. The list must include: Device Name, Business Unit, Computing IDs for Primary Device Owner, Secondary Device Owner, Tertiary Device Owner, Device/Endpoint Manager, Highest Data Sensitivity Accessed by Device, Shared or Single User Device, User Admin Level, Device Serial Number, Primary MAC/EHA address, Other MAC/EHA address, OS Version (Mac, PC, Linux), Network Zone, Device Purpose, Other/Comments. If this list cannot be automatically created by JAMF, KACE or similar software, then a spreadsheet similar in format to this example is acceptable. Click here for example spreadsheet.

Electronic device: is electronic equipment, whether owned by the University or an individual, that has a storage device or persistent memory, including, but not limited to: desktop computers, laptops, tablets, servers, smart phones, and other mobile devices. For purposes of this definition, the term does not include IOT, networking, or medical devices.

[Table of Contents]

 

4. Related Links

[Table of Contents]

 

5. Exceptions

If you cannot meet this standard’s requirements, you must use the policy exception request process.

[Table of Contents]

Approved by, Date: Chief Information Officer, 04/03/2026       
Next Scheduled Review: 04/06/2029       
Revision History: July 15, 2026, April 6, 2026, November 15, 2024, March 14, 2023; April 20, 2022; November 29, 2021; June 16, 2021; December 14, 2020; November 5, 2020; October 23, 2020  
Source URL: https://security.virginia.edu/security-network-connected-devices-standa…