Policies + Procedures — Information Technology — Email Whitelisting and Quarantine Access Policy

5.8 Email Whitelisting and Quarantine Access Policy

I. Overview

The College uses email filtering tools to block unwanted inbound emails such as spam, scams, and phishing emails. However, these filtering tools can block some legitimate emails from reaching an intended recipient’s mailbox.

II. Purpose

The primary purpose of this policy is to provide guidance on adding Trusted Partners to an approved safe sender whitelist. A whitelist is an exception list that allows emails from selected senders to bypass the College’s email filtering tools. It should be noted that whitelisting introduces additional cybersecurity risks. Threat actors take advantage of whitelisting and make the College more susceptible to spam, phishing, scams, malware, and viruses. Whitelisting should only be considered for Trusted Partners.
The secondary purpose of this policy is to document the required processes to provide access to a user’s quarantine mailbox.

III. Scope

This policy applies to all employees and representatives of the College who have an active email account.

IV. Policy Owner

The Vice President, Technology; CTO is responsible for this policy and its administration. At a minimum, the policy will be reviewed and updated once per year, where applicable. If significant changes in the environment warrant updating of this policy, then those updates will be applied as soon as possible. The policy will be disseminated whenever it is updated.

V. Definitions and Terms

Whitelisting - the process of adding an email address to an approved sender list. Emails from that sender will not be blocked by the College’s email filtering technologies.
Approved Safe Sender Whitelist - a list of email addresses, domains, and IP addresses which will bypass the College’s email filters.
Trusted Partners - third-party organizations that have an existing relationship with the College and that need to send email to faculty, staff, and students.
Blacklisted - a real-time list that identifies email addresses or domains that are known to send spam or malicious messages.
Quarantine Mailbox - the mailbox that contains a user’s messages that have been blocked by the College’s email filtering technologies.

VI. Policy

To request that an email address be added to the Approved Safe Sender Whitelist the following information must be submitted with the request:
- The email address to be whitelisted
- The reason that the email address needs to be whitelisted
- The expected benefit to be derived by the College (i.e. potential new service provider, new revenue stream, etc.)
The College will place Trusted Partners on the Approved Safe Sender Whitelist if they meet any of the following guidelines:
- Organizations that have an existing contractual relationship with the College
- Organizations that have existing grants or potential future grants with the College
- Organizations that provide benefits to faculty and staff
- Organizations that communicate to faculty, staff, and/or students in multiple departments
The College may elect not to whitelist an email address that meet any of the following conditions:
- If the address is using an email service that has been blacklisted
- If the address is from a generic email account. Generic email accounts are those that are provided by companies such as Yahoo, Gmail, Comcast, and Verizon (i.e. john.smith@gmail.com, jsmith@comcast.net, etc.) Since generic accounts can be more easily compromised, they would present a cybersecurity risk to the College if they were whitelisted.
- If the address is providing services that are not beneficial to the College (i.e. personal airline or hotel reservations, department stores, etc.)
- If the sending organizations does not have properly configured email security controls (i.e. controls designed that ensure messages are not altered in transit, controls that detect forged email addresses, etc.)
To request access to their quarantined mailbox the user must complete the following:
- Have successfully completed the College’s Data Security Awareness Training video.
- The reason that they need access to the quarantined mailbox.
- Approval by the Department Head or Dean.
- Approval by the Vice President, Technology; CTO.

VII. Exceptions

Any exception to the policy must be approved by the policy owner in advance.

VIII. Revision History

Date of Change	Responsible Party	Summary of Change

IX. Policy Information

Original Policy Date	Board Approved on 2/9/2023
Last Revised Date
Last Reviewed Date
Last Approval Date