IMP 13: Network Management Policy
1. Policy Introduction and Purpose
1.1 This Policy sets out the responsibilities and required behaviour of those who manage data and communications networks on behalf of the University.
2. Scope and Definitions
2.1 The Policy covers everyone who has a contractual (formal or informal/implied) relationship with the University, including employees, students, visiting academics, and consultants. Please note that this list is not exhaustive.
2.2 For the purposes of this Policy, we will refer to everyone covered as 鈥渕embers鈥�.
2.3 The Policy covers all information and network assets processed by the University, regardless of ownership or format.
2.4 All the University鈥檚 data and communications networks, whether wired or wireless are in scope, irrespective of the nature of the traffic carried over the networks (data or voice).
3.0 Responsibilities
3.0.1 The Chief Risk & Information Security Officer (CRISO) retains overall accountability for this Policy and for ensuring the Policy meets legal and regulatory requirements; for keeping this Policy up to date; and for ensuring that controls, checks, and audits are carried out as part of compliance with this Policy.
3.1 Operational Responsibilities
Adherence to this鈥疨olicy鈥痑nd its supporting IMST 17 Network Management Standard (currently in development) and Standard Operating Procedures (SOPs) is achieved by following the鈥疨olicy鈥痯rinciples and the network management provisions it鈥痗ontains. It is everyone鈥檚 responsibility to ensure that they follow鈥痶his Policy.
| Role | Function |
| Designate of Head of Department (e.g. academic lead on research, individuals with delegated authority for information, system administrators) |
Responsible 鈥� for overseeing compliance with the Policy within areas of responsibility |
| Head of Department (or equivalent) |
Accountable 鈥� for compliance with this Policy within Departments |
| Information Risk and Compliance Team (with escalation to CRISO) |
Consult 鈥� to discuss organisational level compliance with the Policy |
| IDG Digital Business Partners |
Inform 鈥� must be informed of the content of the Policy to communicate it to their departments |
4. Principles of the Policy
4.1 Management of the Network
4.1.1 The University鈥檚 communications networks (including cloud networking) will be managed by appropriately skilled and authorised staff to oversee their day-to-day running and to ensure their on-going security (confidentiality, integrity and availability).
4.1.2 Whilst on University premises, all members are required to use network services provided by IDG (or those otherwise-approved by IDG) for University work. Any requirement that cannot be met by the standard service where an alternative arrangement is to be used must be documented and approved by IDG.
4.1.3 Network staff are authorised to act promptly to protect the security of networks but must be proportionate in the actions which they take, particularly when undertaking actions which have a direct impact on the users of the network. Any actions which may be potentially invasive of users鈥� reasonable expectations of privacy must be undertaken in accordance with the University鈥檚 IMP 12 Digital Investigation and Monitoring Policy (currently in development).
4.1.4 Network staff must immediately report any information security incidents to the CRISO.
4.2 Network Design & Configuration
4.2.1 The network must be designed and configured to deliver high levels of performance, availability and reliability, appropriate to the University鈥檚 business needs, whilst providing a high degree of control over access to the network.
4.2.2 The network must be segregated into separate logical domains with routing and access controls operating between the domains in order to prevent unauthorised access to network resources and unnecessary traffic flows between the domains.
4.2.3 All network assets must be documented in corresponding asset registers. SOPs must be maintained by teams responsible for network maintenance and management documenting core maintenance and management activities.
4.3 Physical Security & Integrity
4.3.1 Networking and communications facilities, including comms rooms, data centres and computer rooms must be adequately protected (appropriate to the potential health and safety, financial or security risk being managed) against accidental damage (fire or flood, for example), theft, or other malicious acts and such arrangements documented.
4.3.2 The network must be resilient to help mitigate the impact of the failure of network components.
4.3.3 Any alterations to networking assets and infrastructure are strictly prohibited unless carried out by individuals authorised by IDG to do so.
4.4 Change Management
4.4.1 All changes to network components (routers, firewalls etc.) are subject to IDG established change management processes and procedures.
4.4.2 Any locally administered network must be managed through a formal, robust change process and such arrangements documented and approved by IDG.
4.5 Connecting Devices to the Network
4.5.1 The University network must not be extended via the addition of new network assets (E.g. servers, access points etc.) without prior approval from IDG or federated IT teams to whom such authority has been delegated.
4.6 Network Address Management
4.6.1 The allocation of network addresses (IPv4 and IPv6) and domain names (DNS) used on the University鈥檚 networks will be managed by IDG, they may delegate the management of subsets of these address spaces to other teams. Such arrangements must be documented and approved by the IDG.
4.6.2. Network addresses (IPv4 or IPv6) assigned to end-user systems will be (where possible) assigned dynamically (and will therefore be potentially subject to change).
4.6.3 Network addresses will use private ranges, and public addresses will only be assigned following approval of a Service Request which documents the justification.
4.7 Access Controls
4.7.1 Access to network resources must be strictly controlled to prevent unauthorised access.
47.2 Access control procedures must provide adequate safeguards through robust identification and authentication techniques.
4.7.3 Access to some segments of the network will be controlled by specific rules. Some segments will require that devices are registered in asset registers and meet minimum security or specification requirements (or similar arrangement). IDG will ensure all users requesting this access are made aware of these additional requirements.
4.7.4 IDG is responsible for the management of the routers and switches which link the University鈥檚 network to the Internet. Controls will be enforced at these routers (and elsewhere across the network) to limit the exposure of University systems to threats or attacks. Controls will be applied to both incoming and outgoing traffic. These routers must be patched regularly in accordance with the Vulnerability Management Standard (currently under development).
4.7.5 Devices which are deemed to present security risk may be removed from the network at the discretion of IDG, the CRISO, or federated IT teams. When urgent, devices may be removed without notifying users or engagement with standard change approval processes.
4.8 Network and IT Systems Monitoring
4.8.1 The University (in compliance with the IMP 12 Digital Investigation and Monitoring Policy (currently in development), will carry out relevant monitoring and/or logging in order to ensure the integrity and security of the University network and associated systems. Details of the University Policy on monitoring is contained within the IMP 12 Digital Investigation and Monitoring Policy (currently in development).
4.8.2 Where systems or services do not comply with this Policy then they may have access to University networks and/or resources blocked.
5. Exceptions
5.1 under this Policy must be submitted to the CRISO or their designate. Authority to approve exception requests is delegated to the Information Risk and Compliance Team. Activities that have received prior approval by the Research Governance and Ethics Committee will be exempt, but the CRISO must be notified.
5.2 This Policy may have an impact on users of assistive technology or assistive software dependent on circumstances. These individual cases will be considered on a case-by-case basis.
6. Compliance Monitoring
6.1 It is everyone鈥檚 responsibility to report instances of non-compliance with this Policy to the Information Risk and Compliance Team. The Information Risk and Compliance Team will use report data, and any other tools made available to it to monitor compliance with this Policy, standards, SOPs. Issues that are deemed to merit escalation or further discussion will be brought to the attention of the Information Security and Data Protection Committee via the CRISO. Where non-compliance presents a significant risk, it will be subject to the staff or student disciplinary process.
Amendment History:鈥����
| Version | Date Created | Date Published | Next review | Note/outcomes |
| 1.0 | September 2026 |
November 2026 |
November 2027 |
This Policy replaces IS08 Network Management Policy |