When to Use?
This Knowledge Base article establishes the requirements for the use of non-GVSU managed cloud services when conducting university business. Its purpose is to help protect university information by ensuring that data is only stored or processed in cloud services that have been appropriately reviewed for security, privacy, and compliance.
Procedure
This guidance applies to all faculty, staff, student employees, contractors, and third parties acting on behalf of GVSU who are considering the use of cloud services that are not provided, managed, or approved by GVSU Information Technology. Official GVSU-managed cloud services, such as Microsoft 365 and Google Workspace for Education, remain approved for university use in accordance with applicable university policies and data classification requirements.
Approved Cloud Services
GVSU provides and supports a variety of enterprise cloud services through contractual agreements that address security, privacy, and compliance requirements. These services may be used in accordance with applicable university policies and data classification requirements.
Examples include:
- Microsoft 365 (Outlook, Teams, OneDrive, SharePoint, Office Apps)
- Google Workspace for Education (Drive, Docs, Sheets, Meet)
- Canvas
- Zoom
- GitHub Enterprise
- Other services approved by Information Technology
Use of Non-Approved Cloud Services
Cloud services that have not been reviewed and approved by Information Technology should not be used to store, process, or transmit university data unless an appropriate security and legal review has been completed.
Users must not store the following information in non-approved cloud services:
- FERPA-protected data
- HIPAA-protected data
- PCI data
- Personally Identifiable Information (PII)
- Confidential university information
- Institutional business records
Refer to the GVSU Information Classification Standard for additional guidance.
Artificial Intelligence Services
For guidance on AI tools please see www.gvsu.edu/ai and the Acceptable Use Policy for Public AI Solutions.
User Responsibilities
Before using a cloud service for university business, users should:
- Use GVSU-approved services whenever possible.
- Ensure the service is appropriate for the type of data being stored.
- Review the provider’s terms of service and privacy practices.
- Contact Information Technology before adopting a new cloud service for university business if approval is uncertain.
Questions
Questions regarding the appropriate use of cloud services should be directed to the Information Technology Office.