• Section 1 - Purpose
• Section 2 - Scope
• Section 3 - Policy 
• Policy Statement
• Policy Principles
• Policy Topics
• MP Business Use
• Prohibited Conduct
• Cloud Computing
• Email and Internet Services
• ARTIFICIAL INTELLIGENCE (AI)
• MOBILE DEVICES
• Bring Your Own Device (BYOD)
• Removable Media
• Clean Desk Policy
• Records Destruction and sanitisation
• Reporting of Inappropriate Use
• Violation of the Policy
• Section 4 - Responsibility and Accountability
• Section 5 - Related Policies and/or Procedures
• Section 6 - Definitions

Section 1 - Purpose

(1) This Policy sets out the acceptable use of Melbourne Polytechnic (MP) Information and Communication Technology (ICT) resources, including networks.

Section 2 - Scope

(2) This Policy applies to all users of MP ICT resources including Board and Committee members, employees, contractors, employees of any contractors, volunteers and guests (Users). This Policy excludes student users for which a separate Acceptable Usage (Students) Policy is available.

(3) This Policy applies to use of all MP ICT Resources, as defined below, located at campuses, office spaces, and in private homes or at any other location. It includes the following resources provided or funded by MP:

1. MP’s communication networks.
2. Computer systems and software including PC’s, tablets and servers.
3. Printers, copiers and multi-function devices (MFDs).
4. Cloud services.
5. Mobile phones and related mobile devices (g. smart phones, wireless data cards etc.)
6. Internet and social media.
7. Email, telephones and related communication services.

(4) This Policy also applies to the use of Artificial intelligence (AI) by staff at MP, including any use of public or private AI platforms, and any software that includes AI functionality, not restricted to MP provided or endorsed platforms.

Section 3 - Policy 

Policy Statement

(5) MP is committed to providing access to ICT resources to improve and enhance learning and teaching, and for the conduct of the business and functions of MP in a manner that is legal, ethical, and consistent with the aims, values and objectives of MP and its responsibilities to staff and other IT users.

(6) Users are expected to use and manage these resources in an appropriate manner and in accordance with this policy.

Policy Principles

(7) This Policy will be guided by the following principles:

1. MP seeks to provide access to ICT resources to all users in an equitable, inclusive and accessible manner, to improve and enhance learning and teaching, and for conducting business and operational activities at MP.
2. Access to ICT resources will be based on role, need, and working context, recognising differing digital capabilities and circumstances, and supporting productivity and effective use of institutional and human resources.
3. Access to MP ICT resources is controlled using User IDs, passwords and/or tokens. All User IDs and passwords are to be uniquely assigned to named individuals and consequently, individuals are accountable for all their actions on the institute’s ICT resources.
4. All users must take responsibility for using ICT resources in an ethical, secure and legal manner having regard for MP objectives and the privacy, rights and sensitivities of other people.
5. All users must use MP ICT resources in accordance with their appropriate authorised purposes only, while also taking reasonable steps to minimise unnecessary system load or misuse that may impact availability, performance, and equitable access for other users.
6. This Policy clearly defines the activities that are prohibited in the use of ICT resources at MP. Such activities include:
   1. engaging in any action that violates MP’s internal policies or any local, state, or federal laws or regulations that could result in harm to individuals, damage to the MP's reputation, and the creation of a hostile working environment.
   2. engaging in any activities that interfere with the normal operation of ICT resources that could compromise the integrity of MP's ICT resources and threaten the privacy and security of the academic community.
   3. accessing, distributing, or receiving material that is illegal, inappropriate, or offensive that can create an unwelcoming environment for the academic community and may expose the institution to legal and reputational risks.
7. By using MP ICT resources, users acknowledge that they have read and agree to comply with this policy. This Policy may be updated from time to time, and users will be notified of any changes.

Policy Topics

MP Business Use

(8) MP ICT resources are provided to users for MP business purposes. Other than limited personal use, MP ICT resources must be used for MP business purposes, or where authorised by MP management or required by law. MP business purposes are activities that support the institute’s teaching and learning, research, administration, operations, compliance obligations, stakeholder engagement, and other functions undertaken in the course of employment, study, or engagement with MP.

(9) Users are allowed reasonable access rights to electronic communications using MP ICT resources to facilitate communication between MP employees and their representatives, provided that the use is not unlawful, offensive, improper or resulting in the breach of any MP policies and procedures including MP’s Code of Conduct Policy.

(10) Large data downloads or transmissions should be minimised to ensure the performance of MP ICT systems for other MP users is not adversely affected.

Personal Use

(11) MP ICT resources can be used for limited, incidental personal purposes as long as usage does not:

1. violate any MP policy or procedure,
2. negatively impact upon work performance,
3. interfere with business operations,
4. damage the reputation, image, or operations of the Institute, or
5. result in additional cost to the Institut

(12) MP accepts no responsibility for personal usage that results in the:

1. loss or damage arising from personal use of ICT Resources, or 
2. loss of data or interference with personal files arising from its efforts to maintain the ICT Resources.

Prohibited Conduct

(13) In alignment with MP’s policies, the following uses of ICT resources is strictly prohibited:

1. Any activity that violates local, state, or federal laws or regulations, including but not limited to:
   1. accessing, using, copying or transmitting copyright material.
   2. accessing, using, copying or transmitting confidential or sensitive information or personal information related to other individuals (Staff, students, teachers, etc) without the explicit consent of the information owner.
   3. Forgery of MP documents or documents submitted to MP.
   4. Using MP ICT resources for fraudulent activities.
2. Any activity that is intended to harass, threaten, defame or intimidate others, including but not limited to:
   1. Using MP’s ICT resources to harass, defame, offend or discriminate against others.
   2. Using MP’s ICT resources in a vilifying, sexist, racist, abusive, annoying, insulting, threatening, obscene or other offensive manner.
3. Any activity that is intended to distribute, receive, or access material that is illegal, inappropriate, or offensive, including but not limited to
   1. Attempting to transfer, store or print files, material or messages that violate anti-discrimination legislation, copyright law or MP policies and procedures.
   2. Downloading, displaying or transferring offensive material, including material that is sexist, sexually explicit, pornographic or racist using MP’s ICT resources.
4. Any activity that interferes with normal operation of ICT resources, including but not limited to:
   1. Introducing malicious computer code (e.g., viruses, worms, Trojan horses, ransomware, etc.) designed to self-replicate, damage or otherwise hinder the performance of any ICT Resource.
   2. Installing unapproved software programs on the MP computers that may impact integrity of MP systems and network.
   3. Effecting security breaches or disruptions of network communication.
   4. Circumventing user authentication or security of any host, network or account.
   5. Using unauthorised network penetration, hacking or scanning tools or any software that could compromise the security and privacy of the network or its users.
5. Any activity that is intended to or could result in gaining unauthorised access to ICT resources, including but not limited to:
   1. Accessing data, a server or an account for any purpose other than for than conducting MP business, even if you have authorised access.
   2. Accessing data, a server, or a system to which the user is not authorised to.
   3. Revealing or sharing your account password with others or allowing use of your account by others. This includes work colleagues, family, and other household members when work is being done from home.
6. Any activity that is intended to damage, modify, or destroy ICT equipment, including but not limited to:
   1. Tampering or moving ICT equipment without prior express authorisation.
   2. Attempting to interfere or alter system configurations or corrupt, damage or destroy data and other physical or digital assets.
   3. Misusing ICT equipment. Care must be always exercised when using IT equipment, students will be held responsible for the cost of repair if damage is caused through misuse or negligence.
7. Inciting another person to commit any of the above.

Cloud Computing

(14) Cloud services are permitted to store, process or transmit MP data provided they are assessed to meet MP information security requirements and formally approved.

(15) It is the responsibility of the System Owner (requesting cloud service), in consultation with the Information Owner, Digital and Technology Experience (DTE), Legal Services and Information Management and Security (IM&S) to determine whether a particular cloud service and its provider can suitably maintain the required level of security and regulatory compliance on an ongoing basis. Guidance should be sought from MP Third-Party Information Security Risk Procedure.

(16) The contractual agreement between MP and CSP must clearly specify contractual data protection terms that ensure that MP data is appropriately kept confidential, is not modified without prior consent from MP’s representatives, and is available to the institute as needed.

Email and Internet Services

Internet/Web Usage

(17) Access to the Internet is provided to MP staff for conducting MP business activities and incidental personal use. Any access by staff that is inconsistent with business needs or could result in the misuse of resources is strictly prohibited. These activities may adversely affect productivity and may result in MP facing loss of reputation and possible legal action due to other types of misuse.

(18) MP filters and records any attempted access to Internet websites and protocols that are deemed inappropriate. The following list examples of categories of websites that may be blocked by MP:

1. Child Abuse.
2. Discrimination, Alternative Beliefs, and other Advocacy Organizations.
3. Alcohol and Drug Abuse.
4. Gambling, Sports Hunting and War Games.
5. Explicit Violence, Extremist Groups, Weapons (Sales).
6. Hacking, Proxy Avoidance, Phishing, Spam URLs.
7. Unethical Plagiarism.
8. Malicious Websites, Newly Observed Domain and Newly Registered Domain.
9. Adult/Mature Content, Nudity and Risqué, Pornography, Dating and Sex Education.

(19) If a website is mis-categorised, or where access is required for legitimate business or educational purposes, staff may request access to the site by raising a ticket to the DTE Service Desk. Information Management and Security & DTE will review such requests in consultation with People and Culture, and Legal Services and permit access if the site is deemed mis-categorised or qualifies for exemption and safe.

Email Usage

(20) All work email communications must be undertaken using MP email accounts (@melbournepolytechnic.edu.au). This includes communication with students who must be contacted via their official student email account (@student.mp.edu.au) and no other personal email address.

(21) Third-party email systems (such as Gmail, Hotmail, etc.) and storage servers (such as Dropbox, Google Drive) must not be used by staff to conduct MP business including the storage of any MP related information. Additionally, Staff are prohibited from automatically forwarding MP emails to third-party email providers. Any individual email messages that are forwarded by the individual to a third-party email provider must not contain MP confidential information.

(22) MP email may be used for limited personal communication; however, staff must understand that email communications and social media are not private and should not expect privacy undertaking these activities. Notwithstanding, all personal information shared or stored remain personal information and should be treated as such.

(23) When using MP email system, users must:

1. ensure emails containing MP’s confidential or sensitive information are classified as “confidential”, encrypted during transmission, and digitally signed by the sender to ensure confidentiality and integrity.
2. not send messages that a reasonable person would consider rude, discriminatory, antagonistic, bullying, threatening, offensive or humiliating.
3. ensure professional standards are adhered to. Messages that do not meet professional standards may give rise to formal complaints under grievance procedures or discrimination/sexual harassment procedures, including:
   1. Grievance Procedure
   2. Equal Opportunity, Discrimination and Harassment Policy
   3. Student Complaints and Appeals Policy
   4. Student Equal Opportunity, Discrimination and Harassment Policy

(24) All emails sent from MP staff accounts will automatically have a legal disclaimer attached to them. It should be noted that the disclaimer does not preclude MP or the sender of the email from being liable for its contents.

(25) Electronic communications including email and chat messages created on, sent or received using MP systems are the property of MP and may be accessed as part of an investigation. This includes investigations following a complaint or investigations into misconduct in compliance with MP’s policies, including but not limited to, Student Complaints and Appeals Policy, Prevention of Workplace Bullying Policy,  Fraud and Corruption Prevention Policy and Code of Conduct Policy.  

(26) Staff should note that electronic communications of current and former staff may be subject to discovery in litigation and criminal investigations. All information produced on users’ computers, including emails, may be accessible under the Freedom of Information Act 1982 (Vic) in compliance with MP’s FOI Factsheet.

Fax Usage

(27) When sending faxes containing MP information from MP MFDs, the sender must ensure:

1. Arrangements are made for the receiver to collect the fax message as soon as possible after it is sent; and
2. The receiver must notify the sender if the fax message does not arrive in an agreed amount of time

Social Media

(28) When using social media for private purposes (i.e. not via a MP branded account), Users must ensure:

1. any comments relating to MP activities must state they are not official, and that Users are providing a personal opinion ONLY,
2. any personal comments made do not compromise the capacity to perform their duties and
3. MP’s trademarks, logos and any other intellectual property are not used.

(29) Comments posted on behalf of the Institute (i.e. via a MP branded account) must be compliant with all MP policies.

(30) MP’s policies around confidential information apply to social media, as such, all users are prohibited from revealing any confidential or proprietary information, trade secrets, public sector information, or any other material covered by MP’s Privacy Policy through any social media platform or public forums.

(31) Users should familiarise themselves with MP’s Social Media Policy and ensure their activities online are in alignment with the policy.

Misrepresentation, impersonation and false labelling

(32) Staff must be aware that misrepresentation, impersonation and false labelling will lead to a breach of this policy and MP’s Privacy Policy, this includes altering communications to convey false messages, impersonate sender identities, or recipients, using false labelling or trademarks. In such cases, individuals might unknowingly engage with impostors, expose sensitive information or act on fraudulent information.

(33) If a user doubts the validity of a received message or the identity of the sender, they should take steps to verify the identity of the sender or validity of the message using alternative methods such as calling them. Users should notify their immediate manager or DTE or Information Management and Security (IM&S) if they suspect interception or modification of electronic messages.

(34) Users are responsible for all activities conducted on MP ICT resources or through their MP accounts. Users should therefore continuously monitor activities and the physical access to their ICT resources, including laptops, mobile phones, tablets, and notebook computers and report any suspected unauthorised activities or access.

(35) Users must ensure security controls implemented by MP to protect ICT resources are followed consistently, in line with the Information Security Policy, including the following:

1. keeping their identification and login credentials confidential,
2. ensuring Multifactor authentication (MFA) is applied for online services
3. terminating active sessions once they are no longer needed,
4. locking their computers and devices when not in use, and
5. keeping their computers and devices in a secure physical location when not in us

Data and Information Storage

(36) Information and records storage practices must comply with MP’s Records Management Policy and Records Management Procedure.

(37) All information or records created, received, or managed by users must be retained until the minimum retention timeframe has been met. This may involve:

1. Retaining records identified as Normal Administrative Practice (NAP) until reference ceases.
2. More information in how to identify a NAP record is available in Guideline – Records Destruction.
3. Retaining short- or long-term temporary records until minimum retention timeframes designated by the Public Record Office Victoria (PROV) have been met.
4. Retaining designated records permanently.

(38) Once information and records have met their minimum retention timeframe(s) and appropriate disposal approvals have been provided, they can be disposed of in accordance with MP’s Records Management Policy and Procedure

(39) Any information or records created, received or managed by users relating to their work at MP must be saved in Institute approved storage locations (either on premise or in the cloud).

(40) In order to prevent risk of malware infections and loss of sensitive information, MP will not permit the use of removable media without the explicit permission of IM&S (Information Management and Security). In the event that a removable media is required for performance of staff duties or when providing information required by state or federal authorities, DTE (Digital and Technology Experience) team may provide the removable media to be used.

(41) Any sensitive information stored on removable media must be secured in accordance with the MP’s Records Management Policy and Records Management Procedure.

Copyright Infringement

(42) Copyrighted material from third parties must not be used without the owner’s prior written permission or copyright licence when applicable (accessible on the owner’s website copyright page). This may include software, database files, documentation, cartoons, articles, graphic files, music files, video files, books, text downloaded information and any copyrighted materials. MP staff must send all written permissions to the copyright mailbox for record keeping before using the material.

(43) Forwarding, distributing, and sharing electronic messages, attachments and files greatly increases the risk of copyright infringement. Users must assess the authenticity of the file ownership before distributing and only share content where there is a clear business need.

(44) Copying material to electronic storage, or printing, distributing, or sharing copyright material by electronic means may give rise to personal or MP liability, despite the belief that the use of such material was permitted.

Dealings in Copyright Protected Material for Teaching of Research

(45) All users of MP ICT resources (including those dealing with Copyrighted teaching and research materials) should be familiar with all relevant intellectual property and copyright guidelines provided by MP including the Copyright Requirements for the Development of Teaching Resources Policy and MP Intellectual Property Policy.

Confidentiality and Privacy

(46) The use, collection and disclosure of personal information when using ICT resources e.g. e-mail increases the risk of privacy and security breaches.

(47) All MP users must handle personal information MP is the custodian, in compliance with the Privacy Policy and information handling procedures to ensure its appropriate protection. This includes and is not limited to the use, the disclosure and the restricted access to appropriate personnel of all personal information when using ICT resources. 

(48) Only the minimum amount of personal information necessary to accomplish the purpose for which it is required should be transferred by e-mail.

(49) MP will not disclose the content of any internal electronic communications created, sent or received on MP ICT resources to third parties unless that disclosure complies with the Privacy and Data Protection Act 2014 (Vic) and is related to:

1. An MP investigation,
2. An investigation by law enforcement agencies,
3. For legal, audit or compliance reasons or
4. Or as required by law.

Access, monitoring, filtering and blocking

(50) MP does not generally monitor staff emails, files, internet downloads or data stored on ICT Resources. However, the Institute reserves the right to access and monitor ICT Resources and network traffic for operations, maintenance, security, compliance, auditing, legal, and other purposes, including investigating suspected breaches of this policy or unlawful activities.

(51) Access to the information gathered from the monitoring of emails, files and internet downloads or data stored on ICT Resources will be restricted to staff that require access to perform the roles associated with their jobs.

(52) Reports and data from internet usage monitoring may be accessed by the DTE and Information Management and Security staff to aid in responding to an investigation of a security incident. Staff undertaking investigative procedures must adhere to MP’s Code of Conduct Policy. Such activities include, but are not limited to:

1. Monitoring email, chat, web browsing and other communications
2. Reviewing logs and usage reports
3. Conducting audits and investigations

(53) In the event a formal investigation is required, Melbourne Polytechnic will initiate an internal approval process requiring 2 levels of approval:

1. Senior Leadership: CE or Senior Executives, and
2. Director of IM&S or Director of DTE.

(54) All users of MP ICT resources must:

1. Use MP systems on the understanding and condition that their use may be monitored.
2. Acknowledge and consent to MP’s right to access, monitor, filter and block electronic communications created, sent or received by any user using the systems.
3. Acknowledge that their access to ICT resources is provisioned when commencing work at MP and will be removed and/or restricted immediately when they leave MP.

(55) If there is a reasonable belief that MP ICT resources are being used in breach of this policy, DTE with guidance from the immediate manager of the person who is suspected of inappropriate use may secure the equipment while the suspected breach is being investigated.

Deep Packet Inspection

(56) In addition to the above monitoring practices, MP utilises Deep Packet Inspection (DPI) technologies to enhance network security and performance. DPI enables the analysis of data packets traversing MP’s network to identify patterns, threats, and usage trends.

(57) Information collected through DPI may include metadata such as source and destination IP addresses, protocol types, domain names, and application usage. Content-level inspection may also occur when necessary to investigate suspected policy breaches or security incidents.

(58) All DPI activities are conducted in accordance with MP’s privacy and data protection obligations and are restricted to authorised personnel.

ARTIFICIAL INTELLIGENCE (AI)

Acceptable AI Use at MP:

(59) MP supports the responsible and ethical use of AI technologies by staff and students to enhance learning, productivity, and operational efficiency, provided such use complies with all applicable policies, privacy requirements, and legal obligations.

(60) All AI use must demonstrate responsible, ethical, and safe practices, ensuring outputs are accurate, fair, and consistent with the MP’s Guiding Principles for AI summarised below:

1. Professional responsibility - ensuring AI use is designed and implemented in accordance with professional understanding, capability and responsibility by staff.
2. Fairness and inclusion – advocating for fair, equitable and inclusive use of AI, avoiding biases and discrimination in both access to AI and content produced from AI.
3. Transparency and explainability – ensuring AI is utilised with transparency and explainability, aligning with values that emphasise integrity, honesty, and respect for human dignity. This includes AI use disclosure and understandable AI inputs and outputs.
4. Privacy, safety and security – ensuring AI is used with appropriate consideration of the safety and wellbeing of staff and community in line with Australian federal and state law(s), MP policies and any other applicable standards, laws and regulations. 
5. Accountability - ensuring AI use upholds academic integrity, respects cultural and intellectual property, while maintaining human accountability for decisions and making sure outputs are justifiable and verifiable.
6. Human control and the promotion of Human values – making sure AI use safeguards human control, upholds human dignity and our values, supports education and professional growth, and enhances human thought and experience.

(61) AI use must align with all relevant MP Policies, Procedures and Guidelines as well as applicable Victorian and Australian laws and regulations, along with those of the user’s applicable jurisdiction (e.g. offshore staff).

(62) MP has identified the following broad categories of AI Platforms. These are outlined in the following paragraphs, namely:

1. MP Approved AI Platforms (MP Managed or Externally Managed)
2. Public AI Platforms (Not formally assessed or approved)
3. Banned AI Platforms
4. AI Integrated with Business System

MP Approved AI Platforms

(63) MP Approved AI platforms are AI systems that have undergone formal assessment and approved for use at MP, except where formal exemption applies.

1. Approved AI platforms provide AIâ€'enabled capabilities while ensuring sufficient controls over data access, handling, privacy protections, and regulatory compliance, are in place to manage associated risks.
2. Approved platforms can be MP managed or managed externally by a Third-Party.
3. MP Managed AI Platforms:
   1. These are approved AI platforms that operate within MP’s secured and managed technology environment and receive ongoing technical support from MP DTE.
   2. With managed AI platforms, MP retains full control and visibility over the identity, security, and governance controls to ensure sensitive information is handled safely and in accordance with internal policies and regulatory requirements.
4. Externally Managed AI Platforms:
   1. These are approved AI platforms that operate outside of MP technology environment and are managed externally with a third-party. The platforms have undergone formal MP risk assessment and are approved for MP staff use.
   2. Assessment shall be completed in line with MP Risk Management Framework and shall consider AI use-cases, type of data processed/accessed by AI and alignment with MP AI principles and information security requirements.  
   3. Staff shall raise new request for AI risk assessment request via AI Support email <aisupport@melbournepolytechnic.edu.au>.
5. Staff are encouraged to use already approved AI platforms, where possible, before requesting new external platforms.  
6. Staff must always ensure sensitive personal information, such as Personally Identifiable Information (PII), Protected Health Information (PHI) or MP Protected information, is not captured or processed with any AI platform, including MP approved platforms. Refer to Section titled ‘Data Management and Handling When Using AI’, for more details on types of data permitted with different types of AI platforms.

Public AI Platforms

(64) Public AI platforms refer to AI systems that are publicly accessible on the internet and are operated by thirdâ€'party providers outside MP’s managed technology environment and have not been formally assessed and approved for use at MP. Examples include online personally paid or free platforms without MP subscription.  

1. Public AI platforms are available to anyone with an internet connection and are not bound by the MP’s internal security, privacy, or compliance controls.
2. Staff are encouraged to use MP approved AI platforms, where possible. However, they may use public AI platforms for Low-risk activities and must not use with MP data without approval (only use with UNOFFICIAL or publicly available information).
3. Refer to Section titled ‘Data Management and Handling When Using AI’ below, for more details on types of data permitted with different types of AI platforms.

Banned AI Platforms

(65) These are public AI platforms assessed as High risk by MP or other regulatory bodies and are prohibited for use on MP devices. An example is Deepseek, for onshore staff (based in Australia).

AI Integrated with Business Systems

(66) Before enabling or using AI features embedded in thirdâ€'party or internal systems or software applications a formal risk assessment must be completed to ensure AI use complies with MP security, privacy, and regulatory requirements.

1. Requests for risk assessments on new software or software updated to include AI functions must be raised via aisupport@melbournepolytechnic.edu.au email.
2. Risk approval must be obtained from relevant Information Owners based on identified risks and treatments plans prior to use. An Information Owner is the most senior officer in a division who has been designated as accountable for a specific information asset, system or type of information.
3. Where AI use involves processing restricted MP data, contracts with software Suppliers must be updated to include MP’s AI information management and security requirements as outlined in Section 9 of the MP Data Management and Security Requirements

Data Management and Handling When Using AI

(67) The following table illustrate the type of information that can be used with different AI platforms:

1. Personally Identifiable Information (PII) and Private Health Information (PHI) must not be used with any AI platforms unless a Privacy Assessment has been completed and approval obtained from the relevant Information Owner. Request for privacy assessment must be sent via email to privacy@melbournepolytechnic.edu.au
2. Staff must respect all Intellectual Property (IP) rights. AIâ€'generated materials must not infringe thirdâ€'party copyright or breach MP’s IP ownership and reuse requirements.
3. Any suspected data breach, AI misuse, or unauthorised data disclosure must be reported immediately to Information Management and handled under MP’s Security Incident Response processes, Academic Integrity Policy and Procedure, and Staff Code of Conduct.

AI Use Guidance and Decision Tree

(68) MP shall maintain AI use guidance:

1. MP shall develop and maintain an AI Use Decision tree, to assist Staff assessing the risk associated with using AI platforms.
2. The AI use assessment shall consider the following, among other things, to determine the level of risk and whether Staff can use the platform with the selected type of data:
   1. The proposed AI use case
   2. Type of Data that will be processed, referenced, or captured into the AI platform.
   3. Type of AI platform (MP Approved or Public AI platform)
3. Staff may seek guidance from the AI Support Team via aisupport@melbournepolytechniedu.au, to ensure the proposed use-cases and AI platforms align with this policy.
4. Additional AI guidance and resources for Educators shall be made available via the MP intranet site, AI for Educators. AI for students shall be made available via a separate site, AI for students.

Review and Validation of AI Output (Human in the Loop)

(69) All AIâ€'generated content must be reviewed, verified, and approved by a human before being used, distributed, relied upon, or incorporated into educational or administrative materials.

(70) Staff remain fully responsible for the accuracy, appropriateness, and ethical integrity of all materials produced using AI.

Attribution And Disclaimer on AI Generated Records

(71) When AI platforms are used to assist in creating MP materials (for example, educational, administrative, or research materials etc), staff must acknowledge AI use in accordance with MP’s academic integrity and copyright guidance, identifying the platform and nature of AI involvement where appropriate.

(72) Where required, AIâ€'generated outputs must include Melbourne Polytechnic’s AIâ€'generated material disclaimer - Disclaimer-ai-generated-material.

(73) Teaching Staff must:

1. set clear and accurate expectations and instructions around AI use for students in their learning and completing assessments
2. acknowledge when AI has been used in their work (to students, partners, community as well as industry)

AI Training, Advice and Support

(74) Staff are expected to maintain appropriate AI literacy and comply with any mandatory AI capability or training requirements determined by the Institute or other regulatory bodies in alignment with relevant digital literacy skills requirement.

(75) Staff can reach out to AI Support Team via aisupport@melbournepolytechnic.edu.au to receive guidance, advice, and support regarding safe and effective AI use (including AI queries raised students. Note: email is only for staff support).

AI Legal and Regulatory Compliance

(76) Staff must use AI platforms in compliance with all applicable state and federal regulations, including but not limited to privacy, copyright, antiâ€'discrimination, consumer protection, employment law and child protection laws. Examples are outlined below:

1. Australia’s AI Ethics Principles 
2. Voluntary AI Safety Standard (Australia)
3. Victorian Government AI use guidance as updated from time to time, including
   1. Safe and Responsible Use of Generative AI in Victorian Public Sector and
   2. OVIC guidance for AI use in the public sector
4. TEQSA AI Strategies for Australia Higher Education
5. Australian Framework for GenAI in Schools
6. ASQA Responsible Use of AI in VET Guidance

(77) Staff must comply with any additional contractual, or fundingâ€'related requirements relating to AI use, applicable to their role and department. Such requirements may change over time and are managed outside of this policy. MP’s AI Guiding Principles and this Policy were designed to ensure AI usage is in alignment with relevant state and federal AI regulations and standards.

Prohibited Uses of AI

(78) The following uses of AI are strictly prohibited:

1. Any use of AI that breaches legal, ethical, professional, or institutional obligations, policies and procedures.
2. Any activities that compromise ethical standards, academic integrity, MP’s Code of Conduct, privacy requirements, information security controls, confidentiality obligations, or copyright and intellectual property laws and policies, examples are below:
   1. Upload media including depictions of students, staff or parents (for example, photos, audio, video), or generate images or other media in the likeness of these people.
   2. Generate artefacts that mimic a cultural tradition in a way that is disrespectful or offensive.
   3. Creation or dissemination of deepfakes, deceptive manipulated media, or intentionally misleading content.
   4. Using AI for profiling, surveillance, automated decisionâ€'making in recruitment, or other highâ€'risk activities without explicit endorsement from the Executive Leadership Committee (ELC) or AI Steering Group and approval from the Chief Executive.
   5. Enabling AI functions in MP systems without prior risk assessment and approval.
   6. Installing, executing, or use unauthorised AI agents or automation tools (including those deployed via scripts, package managers, containers, or user-profile directories) on MP devices or connecting such tools to MP systems or data without formal approval.
   7. Use of banned Public AI platforms.
   8. Use of unapproved AI platforms with MP sensitive information (sensitive personal data – PII and PII, and Protected Information).
3. Unauthorised use of AI with Melbourne Polytechnic brand assets and logos without authorisation. This includes the following prohibited activities:
   1. Using AI to create, recreate, modify, or imitate Melbourne Polytechnic logos, trademarks, or brand assets without prior approval from Marketing department.
   2. Using AIâ€'generated content that includes Melbourne Polytechnic branding for externalâ€'facing material (e.g marketing, websites, social media, images, videos or documents, meeting background pictures) without following established brand and approval processes.

MOBILE DEVICES

MP Allocated Mobile Phones (Managed by MP)

(79) Mobile phones and/or mobile devices may be provided to staff members who are required to work off campus, remotely or undertake a role where immediate contact is required.

(80) The Director of DTE will need to approve the purchase based on justification provided by the staff member’s supervisor, and sign-off by their Senior Manager.

(81) General Conditions for MP provided mobile phones:

1. Corporate devices will only be allocated to staff in ongoing, full-time roles with the Institute.
2. General staff will be provided with a standardised mid-range smart phone. Advanced features will need to be justified by supervisor.
3. Any additional requirements above and beyond the standard will need to be covered at the requesting departments own cost.

(82) Your mobile device can contain confidential Melbourne Polytechnic information and access to Melbourne Polytechnic’s information systems. All staff are responsible for securing mobile devices when outside of Melbourne polytechnic facilities, including, but not limited to keeping the devices in a concealed and secure location when not in the staff member’s physical possession.

(83) Any potential unauthorised access to mobile devices will need to be reported to Melbourne Polytechnic DTE who will investigate the incident.

(84) Melbourne Polytechnic reserves the right to monitor device access to its information systems and device validation including, but not limited to operating system levels, patch levels, anti-malware status and database levels, and have to right to block access if any of these components are not within MP DTE approved specifications.

(85) All mobile devices containing or providing access to confidential data owned by Melbourne Polytechnic or for use by Melbourne Polytechnic must use an approved method of encryption to protect data at rest. Mobile devices are defined to include laptops, tablets, and mobile telephones.

(86) Melbourne Polytechnic mobile phones shall be managed under a Mobile Device Management (MDM) system which provides the ability to remotely locate, disable, lock and delete any data stored on the mobile phone.

(87) For additional information on the usage and management of MP allocated Mobile Devices, refer to Mobile Device Usage and Management Standard.

Bring Your Own Device (BYOD)

(88) Staff may use a personally owned device such as a laptop, tablet or smart phone to access MP Systems and Services provided the following conditions are met:

1. MP systems or services should not be accessed when using free or public Wi-Fi as information transmitted and received can be intercepted.
2. Users must not connect a personally owned device to a wired network port or via VPN to MP infrastructure without express authorisation from both the Director of IMS and Director of DTE. Staff may connect their personal devices to the MP Wi-Fi network (SSID: wifi@MP) or remotely MP access MP services via the Internet.
3. Users must comply with this Acceptable Usage Policy when using their personal devices to access MP systems and services.
4. Staff must not let others use their personal device which are used to access MP systems and services without their permission and supervision.
5. Staff should only use their personal charging cable and power adaptor when charging their mobile phone in public spaces as they can be infected with malwar
6. Staff should use security software and configure security features such as anti-virus / anti-malware, device encryption, enabling of phone remote tracking features (such as “Find my Phone”), auto-lock after inactivity; and
7. Staff must implement password protection (password, PIN or biometrics) for restricting access to the personal device.
8. Staff must immediately report to DTE in the event of a loss or theft of any device containing MP data. Where applicable, DTE may remotely delete all data on the lost or stolen device to ensure any sensitive or confidential MP information stored on the device cannot be accessed by unauthorised users or the public.
9. Staff must remove all data belonging to the MP on any personal owned devices before leaving the MP.

(89) To ensure the security of MP information, any personal devices accessing MP systems or information must have up to date software and applications installed to address known vulnerabilities, including the following conditions:

1. Staff turn on automatic updates and ensure software receives and applies the latest fixes.
2. Staff should only install secure and reputable apps which are downloaded from an official app store (e.g., Apple App Store, Google Play) and remove apps when they are no longer required. To determine whether an app is secure and reputable, staff should:
   1. Use apps from trusted developers or organisations using their official app stores or websites (avoid third-party sources).
   2. Check ratings and other customer reviews.
   3. Review permissions and avoid apps requesting unnecessary access.
3. Staff must not circumvent operating system security measures designed to protect the integrity of their personal device, software and / or applications including rooting or jailbreaking devices.
4. Staff must keep internet browsers and plugins updated when accessing MP Web Application systems (systems accessed through an internet browser).
5. Staff may contact DTE via lodging a ticket or by calling 1300 635 276 for assistance on implementing security controls and requirements outlined above to secure BYOD devices connecting to MP systems or storing or processing MP data.

(90) Devices with known security compromises, vulnerabilities, or that can no longer receive software updates must not be used to access MP systems and information until these issues have been resolved.

(91) Staff must not store sensitive, confidential, or personal MP information on personal devices.

Removable Media

(92) To prevent risk of malware infections and loss of sensitive information, Melbourne Polytechnic will not permit the use of removable media without a valid business case and explicit approval from DTE and IM&S.

(93) In cases where removable media is required for performance of staff duties or when providing information required by state or federal authorities, DTE will provide the removable media to be used.

(94) All removable media must be sanitised before it can be used on MP systems.

(95) Any removal media provided for use on MP ICT resources shall not be used with any external or personal devices to reduce the risk of malware contamination.

(96) Any information with a classification of OFFICIAL: Sensitive or higher (as determined by the Information Security Classification Policy and Procedure) should not be stored on external or portable drives unless explicitly approved by MP DTE and IM&S with prescribed mitigating security controls including encryption implemented.

(97) All removable media is to be recorded in a Removable Media Register developed, implemented, and maintained by the DTE.

(98) Media is to be labelled with protective marking in line with the Information Security Classification Policy and Procedure.

(99) Media is classified to the highest sensitivity or classification of information stored.

(100) Media is only used with systems that are authorized to process, store or communicate its sensitivity or classification.

(101) Any media connected to a system with higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification.

(102) Before reclassifying media to a lower sensitivity or classification, or prior to disposal. The media must be sanitised, and a formal approval from the Records Services Manager be granted to reclassify and / or dispose of it.

(103) Special care must be taken to physically protect the removable media device and stored data from loss, theft or damage.

(104) Any lost or stolen removable media must be reported to Information Management and Security as soon as possible.

(105) Removable media devices that are no longer required, or have become damaged, must be disposed of securely in accordance with Guideline – Records Destruction to avoid data leakage.

(106) Removable media devices must be returned to MP during the cessation process of staff members.

Clean Desk Policy

(107) To ensure the security and confidentiality of MP information and records all staff must maintain a clean desk when workspaces are unattended or outside of business hours.  This requires all sensitive and confidential information, in electronic or hardcopy format, to be appropriately managed and stored to protect it from unauthorised access.

(108) The following steps must be followed to maintain a clean desk:

1. All sensitive and confidential documents must be placed in a drawer or filing cabinet when not in use. If this information is of a sensitive nature the drawer or filing cabinet must be locked when the information is not in use.
2. Draft documents, report statistics and figures, duplicate documents, or documents due for disposal that contain sensitive or confidential information must be placed in the designated secure disposal bins for disposal, in accordance with the Records Management Policy, and Procedure and Guidelines.
3. Computers must be locked (Windows Key + L) when unattended and shut down at the end of each workday.
4. Laptops, tablets, and other hardware devices must be removed from plain view and placed in a drawer or filing cabinet, when not in use
5. Keys for accessing drawers or filing cabinets should be stored out plain view or taken home with the staff member.
6. Passwords must not be written down in an accessible location (e.g. post-it note on desktop).
7. Any sensitive or confidential information written on whiteboards must be wiped off at the end of each day.
8. Print jobs containing sensitive and confidential paperwork should be retrieved immediately.

(109) Removable media including but not limited to CR-ROM, DVD, BlueRay and USB drives must be treated as sensitive and secured in a locked drawer when not in use by the owner.

(110) MP DTE and Records Services reserve the right undertake spot checks as well as random and scheduled audits to ensure these processes are being followed, where any breaches are identified they may be reported to your line manager.

Records Destruction and sanitisation

(111) MP – Guideline Records Destruction must be followed when decommissioning an ICT Resources containing MP information. The data purging and sanitisation process outlined in the guideline must be followed when re-using ICT Resources and where sanitisation cannot be applied records must be destroyed.

Reporting of Inappropriate Use

(112) Users who receive unsolicited offensive material from an unknown external source or a known source within MP must report it immediately to their Line Manager or Director who will determine if the Director DTE and/or IM&S is/are to be advised.

(113) All employees, contractors, employees of any contractor, volunteers or guests of MP must immediately report any data breaches (e.g. unauthorised access, disclosure or loss of Personal Information or Sensitive Information) or suspected breaches that come to their attention in alignment with the MP Data Breach Response Plan.

Violation of the Policy

(114) Violations of this policy will be regarded as a serious matter and appropriate action will be taken based on the nature of inappropriate use of MP ICT resources. Violation of policy may result in:

1. Suspension or revocation of IT resource access, including but not limited to: Prohibiting the staff access to or use of MP premises, MP facilities and services or MP activities for up to two weeks.
2. Confiscation of any evidence that may indicate a staff has committed, is committing or intends to commit misconduct.
3. In addition to any disciplinary action by MP, serious misconduct may lead to civil or criminal proceedings and penalties (when legal offense), which MP may report to relevant law enforcement bodies and for which the user will be held personally accountable.

(115) A staff who fails to comply with a sanction under this Policy is guilty of serious or repetitive misconduct.

(116) Serious or repetitive misconduct may lead to disciplinary action, including the revocation of staff account or suspension during investigations or termination of employment.

(117) In some exceptional circumstances (for example where access to objectionable material relates directly to a user's employment or study with MP), subject to the approval of and at the discretion of authorised persons, an exemption may be granted for activities that would otherwise breach these guidelines. Exemptions may be required to be approved in advance by MP management.

(118) When misconduct is suspected, MP reserves the right to audit and remove any illegal material from its computer resources without discretion.

Section 4 - Responsibility and Accountability

(119) All MP Employees are responsible for:

1. Reading and acknowledging their understanding of the Acceptable Use Policy (this Policy). 
2. Ensuring that their use of MP ICT resources complies with this policy.
3. Taking reasonable steps to protect Personal Information from misuse, loss and unauthorised access, modification, or disclosure.
4. Reporting and assisting in the investigation and mitigation of suspected breaches or non-compliance with this policy.

(120) Information Management and Security (IM&S) and Digital and Technology Experience (DTE) teams are responsible:

1. Monitoring for any conduct that is non-compliant with this policy.
2. Investigating breaches of proper use of MP ICT resources and mitigating all data breaches.
3. Granting exemptions to this policy.
4. Ensuring all DTE contract workers read and acknowledge their understanding of this Policy prior to commencing work with MP.
5. Following the principles and ensure adequate consultation when developing and implementing security settings, this includes considerations of the impacts and operational feasibility of security settings.

(121) People and Culture are responsible for:

1. Ensuring all new MP staff read and acknowledge their understanding of this Policy during the induction process.

Section 5 - Related Policies and/or Procedures

(122) Acceptable Usage (Students) Policy, 

(123) Code of Conduct Policy, 

(124) Delegation of Authority Policy

(125) For all other related MP Policies, Procedures, Supporting documents, Legislation and Regulation, please refer to the Associated Information tab of this policy.

Section 6 - Definitions

(126) For the purpose of this Policy the following definitions apply:

1. Access: permissions and privileges granted to a user within a computer system or network.
2. Artificial Intelligence (AI): refers to technologies, systems, or tools that perform tasks normally requiring human intelligence. These include generating content, making predictions, identifying patterns, performing language or image processing, or assisting with decisionâ€'making.
3. AI Platform: any software, application, or online service that uses AI technologies to generate, analyse, or process data.
4. Authentication: a process of verifying the identity of a user who is attempting to access a system or network. User presents two or more pieces of evidence (e.g Use ID, Password, Token, PIN, Biometrics) that will be validated by the system before access is granted.
5. Cloud Services: Service or resource available to MP Users or students that is hosted offsite in the cloud.
6. Complaint: an expression of dissatisfaction with the quality of an action taken, decision made, or service provided by MP, contractors or third-party providers, or a delay or failure in providing a service, taking an action, or making of a decision by MP, its contractors or a third-party provider.
7. Copyright Material: Physical or electronic material to which only the original creators of products and anyone they give authorization to are the only ones with the exclusive right to reproduce the work.
8. Data: Information that has a value and meaning, translated into a form that can easily be transferred or processed.
9. Data Breach: Unauthorised access, disclosure or loss of any Personal Information or Sensitive Information held by MP.
10. Denial of Service (DoS): an interruption in an authorised user's access to a computer network, web page, system or application, typically one caused with malicious intent.
11. Disruption of Network Communication: includes, but is not limited to network sniffing, ping floods, packet spoofing, denial of service, key logging, and forged authentication and routing information for malicious purposes.
12. Hacking: any act of gaining unauthorized access to computer systems, networks, or data.
13. Information Owner: There are two types of information owners:
    1. Individual who creates the information and assigns the Information Security Classification.
    2. Most senior officer in a division who has been designated as accountable for a specific information asset dataset / system / type of information
14. IT Resources: MP’s computer infrastructure. It includes all computers and computing devices (including both the wired and wireless local area networks) as well as any software services provided by MP for work use.
15. Malicious Software: any malicious program that causes harm to a computer system or network. Malicious Malware Software attacks a computer or network in the form of viruses, worms, trojans, spyware, adware or rootkits.
16. Network Monitoring: any inspection of data across the network in real time. It is used for network management but can also be used by malicious users to covertly inspect or intercept data not intended for their workstation.
17. Network Penetration test: a process of assessing the security of a computer network by simulating attacks from malicious outsiders (or insiders) to identify vulnerabilities that could be exploited by unauthorized individuals or entities.
18. Password: A sequence of characters used for authentication.
19. Personal Information: refers to information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified individual, or an individual who is reasonably identifiable. Common examples are an individual’s name; age; date of birth; contact details; address, bank account details, medical records, image (as recorded in video footage or a photograph).
20. Personally Identifiable Information (PII): collectively or individually refers to Personal Information, Sensitive Information, Health information, and identifiers.
21. Protected Health information (PHI): Protected health information (PHI), also referred to as personal health information, is a subset of personally identifiable information that specifically refers to the demographic information, medical histories, test and laboratory results, mental health conditions, insurance information and other data that a healthcare professional collects to identify an individual and determine appropriate care.
22. Plagiarism: Plagiarism is the act of using someone else's work, ideas, or intellectual property without proper attribution or permission and presenting it as one's own.
23. Phishing: a type of cyber-attack in which attackers use deceptive techniques, typically via email, messaging platforms, or websites, to trick individuals into providing sensitive information such as login credentials, personal information, or financial details.
24. Port Scanning: a technique used to discover open ports and services running on a target system or network that could be used to identify security vulnerabilities and compromise a system.
25. Proxy Avoidance: techniques used to bypass or circumvent restrictions imposed by MP proxy servers or content filtering systems. Proxy servers are intermediary servers that act as an intermediary between a user's device and the internet.
26. Record: Any information created or received by a staff member as part of their daily work for Melbourne Polytechnic. Records can include documents, email, spreadsheets, photographs, audio visual materials, official social media posts, databases, etc.
27. Removable Media: A system component that can be inserted into and removed from a system, and that is used to store data or information (e.g., text, video, audio, and/or image data). Such components are typically implemented on magnetic, optical, or solid-state devices (e.g., floppy disks, compact/digital video disks, flash/thumb drives, external hard disk drives, and flash memory cards/drives that contain non-volatile memory).
28. Sensitive Information:  all data, in its original and duplicate form, for which there is either a legal, ethical, or contractual requirement to restrict access. Examples include financial information, system access passwords, building plans, tenders and contracts, information about a third party with whom MP has a commercial relationship, etc.
29. SPAM: Irrelevant or unsolicited messages sent over the internet, typically to many users, for the purposes of advertising, phishing, spreading malware, etc.
30. Users: MP MP’s employees, contractors, employees of any contractors, volunteers and guests that has access to MP network or systems.
31. Web Filter Categories: Categories of websites or web pages that have been assigned based on their dominant Web content. A website or webpage is categorized into a specific category that is likely to be blocked according to its content.