• Section 1 - Summary
• Section 2 - Scope
• Section 3 - Policy Statement
• Part A - General Obligations
• Part B - Provision and Use of IT
• Part C - Unacceptable Use
• Part D - Personal Use and Personal Devices
• Part E - Monitoring and Compliance
• Section 4 - Procedures
• Section 5 - HESF/ASQA/ESOS Alignment
• Section 6 - Definitions
• Section 7 - Supporting Documents and Information

Section 1 - Summary

(1) This Policy establishes a framework for the appropriate use of Information Technology (IT) facilities and services provided by Victoria University (VU) to authorised users. It outlines user obligations, responsibilities and restrictions when accessing and using VU IT resources, and aims to safeguard VU information and minimise the risk of disruption to teaching, research and University operations.

Section 2 - Scope

(2) This Policy applies to:

1. All VU staff, students, Council members and members of its Committees, visitors, contractors and third-party service providers both onshore and offshore connecting to IT computing facilities, services, systems, networks and accounts, either on VU premises or remotely.
2. All information that is owned and/or operated by VU and/or registered in any Domain Name System (DNS) domain owned by VU.
3. IT equipment and devices that are present on VU premises but may not be owned or operated by VU, including personal or third-party/contractor devices.
4. Information outsourced or hosted by external/third-party service providers, if that information resides in a VU domain or appears to be owned by VU.

Section 3 - Policy Statement

Part A - General Obligations

(3) All users are expected to use IT facilities and services appropriately, responsibly and for University purposes in accordance with this Policy. The use of IT must comply with other relevant VU regulations, policies and procedures, including the:

1. IT Asset Policy;
2. AI Governance and Responsible Use Policy;
3. Appropriate Workplace Behaviour Policy;
4. Student Conduct Policy and Student Charter;
5. First Nations Anti-racism Policy;
6. Bullying Prevention and Management Policy;
7. Gender-based Violence Policy;
8. Discrimination and Harassment Prevention and Management Policy;
9. Safety and Welfare of Children and Young People Policy and Safety and Welfare of Children and Young People - Staff Code of Conduct;
10. Copyright Policy;
11. Intellectual Property Regulations 2013.

(4) Users must take all reasonable precautions to protect VU information from unauthorised access, use or disclosure, and comply with the Information Security Policy and the Privacy Policy.

(5) Exemptions to this Policy may be granted where required for legitimate University purposes, with approval from the relevant organisational unit head and the Chief Digital Officer and Executive Director Campus Services. 

Part B - Provision and Use of IT

(6) VU information (which includes any corporate, teaching and research data) must be stored on VU approved systems and services in accordance with the IT Appropriate Use Procedure and managed in accordance the Information Security Policy.

(7) VU may restrict or block access to systems, websites, email addresses, applications, and other digital resources that pose a risk or breach this Policy.

(8) Users allocated a VU device are responsible for its proper use, care, maintenance and safekeeping.

(9) In using VU IT systems, users must comply with:

1. the Information Security Policy and associated procedures;
2. access controls and any restrictions applicable to physical and virtual environments;
3. local rules governing the use of shared IT resource spaces, including computer laboratories and docking areas;
4. applicable procedures when using VU email and digital communication services; and
5. the AI Governance and Responsible Use Policy when using AI tools for academic, research, business or administrative purposes.

(10) Access to the internet via VU networks, including AARNET, must comply with applicable external access policies (for example, AARNET’s Access Policy).

(11) Personal profile images uploaded to VU systems must be appropriate and consistent with representing VU, in accordance with Staff Profile Image Guidelines.

Part C - Unacceptable Use

(12) Users must not use IT facilities and services to:

1. engage in unlawful activity or breach VU policies.
2. create, access, store or transmit content that is inappropriate, obscene or offensive, or exposes VU to legal or reputational risk.
3. breach the Copyright Policy and Intellectual Property Regulations 2013 including, but not limited to, the use or distribution of unauthorised software.
4. engage in activities for unauthorised commercial or private gain.
5. send unauthorised or unsolicited global or commercial messages (spam or junk mail).
6. make unauthorised alterations to VU’s IT environment, including modification to IT infrastructure or the production network, or installing unapproved software.
7. damage, degrade or alter, either willfully or through negligence, IT facilities and services (including denial of service activities).
8. introduce malicious programs or code (e.g. viruses, worms, trojan horses).
9. deliberately cause security breaches or disruptions of VU network or business systems including, but not limited to, accessing information of which the user is not an intended recipient or logging into a server or account that the user is not expressly authorised to access, unless these activities are within the scope of regular duties.
10. conduct unauthorised monitoring, scanning or testing of systems or networks.
11. circumvent or compromise security controls, authentication mechanisms, or access controls.
12. misrepresent VU or make unauthorised statements, commitments or offers on its behalf.
13. misuse or disclose VU information, including providing information about staff or students without appropriate authorisation.

Part D - Personal Use and Personal Devices

(13) IT facilities and services are provided for University purposes.  Limited personal use is permitted where it:

1. Does not interfere with work or study obligations;
2. Does not impact system performance or availability;
3. Complies with this Policy and associated procedure; and,
4. Is not used for private business activities.  

(14) Users must exercise good judgement regarding reasonable personal use.

(15) VU may recover costs associated with excessive personal use.

(16) VU employees travelling on official University business are permitted to use their VU allocated mobile phone for making personal calls to home if approved by their department, provided such use is reasonable in duration and does not result in significant additional cost to VU.

(17) To the extent that individual contracts of employment allow personal use of VU devices that is inconsistent with this Policy, the contract of employment takes precedence.

(18) Personal devices may be connected to the VU network. VU information accessed or stored on personal devices must be protected and managed in accordance with the Information Security Policy and only accessed or stored using VU-approved systems and services. 

(19) The University may remove VU information from a personal device, including remotely, where necessary to protect VU information.

Part E - Monitoring and Compliance

(20) VU may monitor, access and review IT usage in accordance with the Information Security Policy.

(21) In the case of a breach of this Policy, disciplinary action will be undertaken in accordance with VU regulations, policies and any applicable employment agreements. This may include, but is not limited to, the relevant enterprise agreement, Complaints Policy, Complaints Procedure (Staff), Complaints Procedure (Student and Public), Student Misconduct Regulations 2019 and Student Misconduct Procedure.

(22) In the case of a breach of this Policy by a contractor, consultant or other third party, VU may pursue remedial or disciplinary action, including pursuant to any contract, agreement or VU policy that may apply.

Section 4 - Procedures

(23) IT Appropriate Use Procedure

Section 5 - HESF/ASQA/ESOS Alignment

(24) HESF: Standard 2.1 Facilities and Infrastructure, 7.3 Information Management.

(25) Outcome Standards for NVR Registered Training Organisations 2025: Standard 1.8 Facilities, Equipment and Resources.

Section 6 - Definitions

(26) IT Facilities and Services – Including but not limited to computer labs, equipment, software, operating systems, business systems and applications, data storage, communication facilities and accessories (voice, video and data), network accounts, network services, email accounts and central archive, web browsing, mobile phones and handheld devices.

(27) User – VU staff, students, contractors, visitors, third-party providers and Council members and members of its committees using IT computing facilities, systems, networks and accounts.

(28) Information – Any data and information that is intended to be used within VU, including but not limited to files, documents, records, reports and staff email.

Section 7 - Supporting Documents and Information

(29) Staff Profile Image Guidelines