Definitions

Information Technology (IT) resources, as defined in UVA policy, IRM-002: Acceptable Use of the University’s Information Technology Resources, are: All resources owned, leased, managed, controlled, or contracted by the University involving networking, computing, electronic communication, and the management and storage of electronic data including, but not limited to:

• Networks (virtual and physical), networking equipment, and associated wiring including, but not limited to: gateways, routers, switches, wireless access points, concentrators, firewalls, and Internet-protocol telephony devices;
• Electronic devices containing computer processors including, but not limited to: computers, laptops, desktops, servers (virtual or physical), smart phones, tablets, digital assistants, printers, copiers, network-aware devices with embedded electronic systems (i.e., “Internet of things”), and supervisory control and data acquisition (SCADA) and industrial control systems;
• Electronic data storage devices including, but not limited to: internal and external storage devices (e.g., solid state and hard drives, USB thumb drives, Bluetooth connected storage devices), magnetic tapes, diskettes, CDs, DVDs;
• Software including, but not limited to: applications, databases, content management systems, web services, and print services;
• Electronic data in transmission and at rest;
• Network and communications access and associated privileges; and
• Account access and associated privileges to any other IT resource.

Gathering information and initial fact-finding to determine whether an allegation or apparent instance of research misconduct warrants an investigation.

Intentional testing is purposeful actions undertaken to discover or reveal a vulnerability.  It does not include exploiting or exploring a vulnerability.

Internal Use Data, as defined in the UVA Policy IRM-003: Data Protection of University Information, are: data that is a public record available to anyone in accordance with the Virginia Freedom of Information Act (FOIA) but is also not intentionally made public (see the definition of public data).  Examples may include salary information, contracts, and specific email correspondence not otherwise protected by a FOIA exemption.  For a complete list, see Code of Virginia § 2.2-3700 Virginia Freedom of Information Act.

The formal examination and evaluation of all relevant facts to determine if misconduct has occurred, and, if so, to determine the responsible person and the seriousness of the misconduct.

Legitimate educational interest, as referenced in UVA policy: STU-002: Rights of Students at the University of Virginia Pursuant to the Family Educational Rights and Privacy Act (FERPA), refers to the need of school officials, including those performing the functions described below, to access specific Education Records in the course of performing their duties for UVA.School officials are those individuals who engage in the instructional, supervisory, advisory, administrative, governance, public safety, research, and support functions of UVA. They need not necessarily be paid employees of UVA. School officials include but are not limited to:

• Those UVA students who, pursuant to their duties as officers in officially recognized honor societies, periodicals, and other activities that recognize or encourage superior academic achievement, require personally identifiable information (e.g., grades) from students' education records to determine the satisfaction of specified eligibility requirements;
• Those UVA students who, pursuant to their duties as members of official UVA committees (e.g., scholarship committees), require personally identifiable information from Education Records;
• Those UVA students who, pursuant to the authority granted by the Board of Visitors under the terms of the Honor System and the University Judiciary System, require personally identifiable information from Education Records to investigate, adjudicate, or advise students involved in an alleged violation of the Honor Code or the Standards of Conduct;
• Those persons, companies, or agencies under UVA’s direct control, with whom UVA has contracted to provide services that UVA itself would provide otherwise.

Logging requirement: All access to Highly Sensitive Data (HSD) must be logged.  Logging of access to other UVA data types is recommended.

Managed devices include all network connected devices that are managed or administered by someone other than the end-user. Formerly known as centrally or departmentally managed devices.

Medical Center employees, as defined in multiple UVA policies, are: Individuals employed by the University of Virginia Medical Center in any capacity.

A University mission critical system is any factor (e.g., component, equipment, personnel, process, procedure, software, server) that is essential to a business operation or a unit.  When a mission critical system fails or is interrupted, business operations are significantly impacted. It is indispensable to continuing operations.