# Acceptable Use of Harvard IT Resources # Acceptable Use of Harvard IT Resources Policies & guidelines ![Woman works on her laptop in a library.](/sites/g/files/omnuum10811/files/styles/hwp_21_9__1920x825/public/2025-09/Hero%20image%20-%20policies.jpg?h=897e25e6&itok=q0BRfO_L) ## Contents - [Purpose](#purpose) - [Scope](#scope) - [Definitions](#definitions) - [Policy Statement](#statement) - [System User Requirements](#requirements) - [Consequences and Enforcement](#consequences) - [Governance and Exceptions](#governance) - [Effective Date and Review](#effective) - [Related Policies and Links](#policies) ## Purpose This policy sets expectations and establishes obligations for the appropriate, secure, and lawful use of Harvard IT Resources. It promotes the confidentiality, integrity, and availability of Harvard IT Resources, supports academic and administrative missions, and assists the University in meeting regulatory and contractual obligations. ## Scope This policy applies to all System Users accessing Harvard IT Resources. ## Definitions Harvard IT Resources means any application, platform, service, network, computer, tablet, smartphone, or other device that generates, stores, or transmits electronic information that is owned, licensed, operated, administered, or managed by or on behalf of Harvard. System Users means anyone who accesses Harvard IT Resources, including faculty, staff, students, researchers, contractors, visiting scholars, volunteers, and guests, in each case, directly or indirectly. ## Policy Statement System Users are granted access to Harvard IT Resources to support the research, education, administrative, and other mission-driven functions of Harvard University. System Users must use Harvard IT Resources in accordance with the System User Requirements set forth below. ## System User Requirements System Users are required to comply with the following requirements when using Harvard IT Resources: ### Non-Disruptive Use - System Users must use Harvard IT Resources in a manner that does not interfere with the provision of information technology services to others. Examples of prohibited activities include attempting to degrade or damage the performance of Harvard IT Resources, triggering excessive network traffic, and causing excessive computing load. ### Protection of Systems and Security - System Users must protect the integrity and security of Harvard IT Resources. Examples of prohibited activities include knowingly enabling security breaches; accessing or attempting to access, test, probe, exploit, circumvent, or interfere with systems, accounts, applications, networks, or data without authorization; attempts to defeat security controls, spread malicious code, introduce or test malicious code or system vulnerabilities, or obtain or facilitate unauthorized access to systems, accounts, or data; in each case unless expressly authorized as part of approved academic, research, or work responsibilities. ### Incidental Personal Use - System Users may engage in incidental personal use of Harvard IT Resources only when such use is lawful, (other than in the case of student use) limited, non-disruptive, does not interfere with academic or employment responsibilities, does not impose more than minimal cost on the University, and complies with all Harvard policies. - System Users should not expect or rely on the continued availability, security, or confidentiality of information stored on Harvard IT Resources for personal use. ### Communication Tools - System Users must use communication tools, including email, listservs, broadcast messaging tools, collaboration platforms, and other mass communication platforms, responsibly and for legitimate University purposes and other uses permitted by applicable school or University policies governing requirements relating to approvals, audience targeting, opt-in or opt-out practices where applicable, and records management, and in all cases in compliance with applicable law. ### External Business and Commercial Activity - Except where such use is authorized by Harvard in advance and in writing, System Users must not use Harvard IT Resources, including University-issued email and communication platforms to operate, promote, or materially support an external business or commercial enterprise unrelated to the University. ### Political Activities - Except when authorized in advance and in writing by Harvard Public Affairs and Communications, Harvard employees may not use Harvard IT Resources in the course of lobbying or engaging in partisan political activities, including to endorse or support any political candidate or party. - Harvard students may not use Harvard IT Resources to fundraise for candidates. ### Automated Processes and Agentic Tools - Harvard may consider any action taken by an automated process or AI-based agentic tool to access, interact with, or act within Harvard IT Resources to be an action taken by the System User who authorized or deployed the process or agent. Harvard may hold the System User responsible for activities or outputs initiated or carried out by the automated process or agentic tool where such activities or outputs were within the scope of the System User’s authorization or resulted from the System User’s failure to comply with applicable Harvard policies and guidance, including [Harvard University guidance on the use of AI features including agents and connectors](/ai-features "AI Features"). ### Legal Compliance - System Users must comply with all applicable laws and regulations when using Harvard IT Resources, including copyright, patent, trademark, and other intellectual property laws. - System Users must comply with applicable contractual obligations and restrictions governing the use of Harvard IT Resources, including, for example, software license terms and website terms of use. ### Compliance with Harvard Policies and Standards of Conduct - Use of Harvard IT Resources remains subject to other University and School policies applicable to the user or activity, including Harvard’s Information Security Policy, [Harvard’s Non-Discrimination and Anti-Bullying (NDAB) Policies](https://csndr.harvard.edu/university-NDAB-policies), [Harvard’s Policy on Access to Electronic Information](https://provost.harvard.edu/sites/g/files/omnuum12476/files/provost/files/policy_on_access_to_electronic_information.pdf), [Harvard’s Policy Regarding University Information on Personal Platforms and Devices](/personal-resources-policy "Policy Regarding University Information on Personal Information Technology Resources"), and any school- or other locally-imposed acceptable use policies. This policy does not replace or modify those policies. ## Consequences and Enforcement Violations of this policy may result in technical or administrative measures, including suspending or revoking access, revoking credentials or permissions, or isolating systems. In addition, conduct found to violate this Acceptable Use Policy may be referred to relevant Schools or units to review under applicable HR, research or academic policies. This policy will be enforced without regard to the content, viewpoint, or subject matter of communications or expression posted, sent, or conveyed using Harvard IT Resources. ## Governance and Exceptions This policy is maintained by HUIT. HUIT, in consultation with the schools and units, may make changes to this policy from time to time. Material changes to this policy will be subject to review and approval by the Chief Information Officer. Requests for exceptions must be submitted to the Chief Information Officer for review and approval. Any suspected violation of this policy should be reported promptly to the Chief Information Officer. ## Effective Date and Review This policy is effective as of Tuesday, November 3, 2026, and will be reviewed periodically. ## Related Policies and Links ### Information Security: - [University Information Security Policy](https://privsec.harvard.edu/information-security-policy) ### Use of Personal Devices: - [Policy Regarding University Information on Personal Platforms and Devices](/personal-resources-policy "Policy Regarding University Information on Personal Information Technology Resources") - University Information Security Policy linked above ### Data Privacy: - [Policy on Access to Electronic Information](https://provost.harvard.edu/sites/g/files/omnuum12476/files/provost/files/policy_on_access_to_electronic_information.pdf) - [University-wide Privacy Principles](https://privsec.harvard.edu/privacy-principles) ### Harassment and Bullying - [Guidance on responding to online abuse, harassment, and intimidation](https://privsec.harvard.edu/respond-online-abuse-harassment-and-intimidation) - [University Non-Discrimination and Anti-Bullying Policies](https://provost.harvard.edu/sites/g/files/omnuum12476/files/2025-07/non-discrimination_and_anti-bullying_policies.pdf) ### Communications Practices - [Harvard University Institutional Voice Principles](https://provost.harvard.edu/institutional_voice_principles_FAQs) - [Harvard social media account guidelines](https://www.harvard.edu/guidelines/) - [Broadcast Email Policy](https://evp.harvard.edu/broadcast-email-policyhttps://evp.harvard.edu/broadcast-email-policy) ### Artificial Intelligence - [Guidelines for the use of Generative AI tools at Harvard](/ai/guidelines "Generative AI Guidelines") - [AI Meeting Assistant Guidelines](/news/guidance-ai-meeting-assistants-data-privacy-principles "Guidance on AI meeting assistants; data privacy principles") - [EU AI Act Prohibited Use Cases](/eu-ai-act "EU AI Act Prohibited Use Cases") - [Guidance on the use of AI features including agents and connectors](/ai-features "AI Features") ### Use of Harvard Names - [Policy on the Use of Harvard Names and Insignias](https://trademark.harvard.edu/policy-on-use-of-harvard-names-and-insignias) ### Use of Harvard Names and Insignias in Electronic Contexts: - [Policy on the Use of Harvard Names and Insignias in Electronic Contexts](https://trademark.harvard.edu/use-of-harvard-names-and-insignias-in-electronic-contexts)