About CIT

University Policy Statement

Cornell University requires that departments and units maintain control of all devices that provide access to university facilities and vehicles. This includes possession, issuance of copies, and storage of access devices.

Link to University Policy

http://www.dfa.cornell.edu/dfa/treasurer/policyoffice/policies/volumes/facilities/access.cfm

Overview

CIT is committed to the security of all CIT managed facilities. The essential element of security is maintaining adequate access control so that facilities are accessed only by those who are authorized.

Process/Procedures for Routine Access to CIT Building Areas

Request for Access Control Devices:
All requests must be made through the respective Building Service Coordinator (BSC) and approved by the requestor's management staff. When a key is issued, it must be accompanied by a key retrieval tag. These tags are provided to CIT by the Campus Police and can help get lost keys to which they are attached returned to Cornell. (These tags are also available from any BSC or the Campus Police for attachment to your personal keys.)

Emergency Building and Room Access:
In emergency situations (generally, an "emergency" is a situation in which a person locks his or her home or vehicle keys in an office, and has no other way to retrieve them), Cornell Police will first attempt to contact the individual responsible for the building, the respective BSC. If that person is unable to do so, then the Cornell Police may assist entry. Other access requests may be approved by the Cornell Police officer in charge, depending upon:

• the circumstances of the request,
• the approval of the building coordinator/BSC, unit manager or the occupant of the particular room and
• the availability of an officer to respond.

Note: Even if the request is approved, the Cornell Police may not have a key or access device for the door, especially if it is not on a building master system.

Retrieving Access Control Devices When Employees Leave CIT and/or the University:
When CIT HR is conducting the exit interview all access control devices will be surrendered and returned to a BSC. Supervisors should ensure that any combination locks are changed as appropriate.

Changes to Access Requirements Due to Promotions, Transfers or Relocations:
The supervisor is responsible for retrieving access devices and returning them to their CIT HR representative whenever an employee action indicates a change in access requirements; in such cases, the supervisor must also notify the respective BSC of the change. CIT HR will work with the appropriate BSCs to process the return of any access control devices and to ensure the deactivation or access changes required to encoded ID cards. Supervisors should also ensure that any combination locks are changed as appropriate.

Process/Procedures for Secure Area Access

The following areas are considered CIT Secure Areas:

• Room 757 Rhodes Hall (machine room), room 658 Rhodes Hall (network node room), room B03 CCC (secured node room). Systems and Operations (S&O) primarily manages assets and operations in these locations.
• Room 102 CCC (switchroom), telecommunications rooms (e.g., Clark Hall and Lab of Ornithology), and all other secured node rooms across campus. Network Communication Services (NCS) primarily manages assets and operations in these locations.

New staff:

1. CIT Human Resources (HR) will include a Secure Area Access Authorization form when processing new hire documentation. If the hiring supervisor determines the need for the new hire to gain access to a secure area, a Secure Area Access Authorization form will be completed. CIT HR will have the newly hired employee sign the access form at the same time they sign all other personnel package forms.
2. Representatives from NCS and S&O divisions will be included in the CIT HR e-mail notification when a new person requiring access to secured areas is hired. At present, the NCS representative is the Voice Engineering Manager, and the S&O representative is the Computer Operations Manager II.
3. Once the new hire has signed the Secure Area Access Authorization form, the form will be forwarded to the representatives (as noted above) responsible for the areas to which access is being requested.
4. Subsequent to approval, the form will be returned by the NCS or S&O representative to a Building Services Coordinator (BSC) for assignment of an access control device.
5. Once the BSC has assigned access for the individual, the BSC will send a confirmation to individual, their supervisor and the secure area representatives noted above.

Vendors:

1. The CIT sponsor of a vendor requiring access to a CIT secure facility will contact a BSC to acquire a Secure Area Authorization Access Non-Cornell Representative form. The vendor representative will complete the authorization form and return it to a BSC who will forward it for review by the appropriate NCS or S&O representative. Subsequent to approval, the form will be returned to a BSC for assignment of an access control device.
2. Once a vendor representative no longer requires access to a CIT secure area, the CIT sponsor will notify a BSC to disable access for that vendor representative. The CIT sponsor will be responsible for the return of any access control device that the vendor representative has and will return same to a BSC.
3. Consistent with University Policy 2.6, the term of issuance of access devices to outside vendors must not exceed six months and this re-approval process will be accommodated in the semi-annual verification process noted below.

Semi-annual Verification:

1. Within the first 5 business days of the months of April and October, the CIT Facilities Manager will provide to the NCS and S&O representatives a report that lists CIT staff that have access to secure areas. The representatives will return the updated report to the Facilities Manager by the close of business of the month of the report (either April or October).
2. A separate listing of external vendors will be submitted to the NCS and S&O representatives who will return the updated report to the Facilities Manager by the close of business of the month of the report (either April or October).
3. The Facilities Manager will contact managers of non-CIT units to verify that Cornell University staff that have access to secure areas still require that access.

Exit processing:

1. Representatives from NCS & S&O will be included in the HR e-mail notification when a staff person is leaving CIT, transferring to another Cornell department or leaving Cornell.
2. When CIT HR is conducting the exit interview all access control devices will be surrendered and returned to a BSC.
3. BSC will disable access to all CIT secure areas based on this HR notice.

Emergency Procedures:

1. If an employee or external vendor who has access control device privileges is terminated under other than normal circumstances, it is the responsibility of the CIT supervisor or CIT sponsor (in the case of external vendors) to notify Building Services (and CIT HR in the case of CIT staff) so that access to secured areas can be disabled immediately.
2. If a vendor requires access to a secure area in an emergency or on a non-routine basis, they can contact the Network Operations Center (NOC) at 607-255-9900. The NOC will contact the manager responsible for that area to approve access. The NOC will keep a log of each approved access event and will provide a copy to the access control coordinator when requested.

Operational Process/Procedures

Requests for Keys, Lock Changes, Lock Maintenance or Access Control Devices Other than Keys:
Such requests for CIT must be made by the respective BSC or the CIT Facilities Manager, utilizing the appropriate forms and obtaining any authorizations required by the Cornell Police.

Storage of Access Control Devices:
CIT BSCs are responsible for meeting or exceeding the storage and recordkeeping requirements as described in the associated university policy.

Periodic Inspections/Internal Audits:
BSCs may conduct inspections and/or audits at any time deemed appropriate to ensure compliance.

University Forms

• [None]

CIT Forms

• Secure Access Authorization Form for Cornell Employees
  
• Secure Access Authorization Form for Non-Cornell Representatives
• Secure Access Authorization Form for Cornell Employees

Related Documents and Policies

University Documents and Policies

• 2.6, Keys and Other Access Control Devices
• 4.6, Standards of Ethical Conduct

CIT Documents and Policies

• [None]

Process

All violations must be reported to the CIT Facilities Manager immediately.

Consequences

Violations of CIT processes/procedure and/or university policy by CIT staff may result in disciplinary action up to and including termination of employment.

Vendors who violate CIT processes/procedure and/or university policy will have their access privileges revoked.

University definitions are marked with an asterisk, all others are CIT definitions.

No Frequently Asked Questions are currently listed for this policy.

Any other questions should be directed to Jim Honness, 5-4885, jdh2.