Estimated Enforcement Timeline

*For additional unit-level changes, please contact your local information security representative.

Jump to: General Information | Cybersecurity Awareness Training | Email Duo Multi-factor Authentication | ZotDefend Security Package

General Information:

1. What is the purpose of this initiative? The initiative is being implemented to protect the University’s sensitive information and systems by strengthening UCI’s cybersecurity posture and mitigating potential risks. It includes the UC Cybersecurity Mandate 2025, IS-3 encryption compliance, and IS-12 backup compliance.
2. Who will be affected by this rollout? All employees and all locations units regardless of whether the IT infrastructure is managed centrally.
3. When will the rollout take place? The security enforcements will be rolled out in phases, see Timeline tab for more information.
4. Will there be any downtime during the rollout? No, we do not expect any downtime.
5. Who do I contact if I encounter an issue during the rollout? You can reach out to the OIT Help Desk for support.
6. What is the minimum university endpoint security standard? Visit the page “Minimum Security Standards for all devices connected to the UCI Network or accessing UCI Information“.

Cybersecurity Awareness Training:

1. What is cybersecurity awareness training? All UC employees are required to complete security awareness training annually. This is a system-wide requirement across all UC locations.
2. Where do I go for the training? Log into the UC Learning Center (UCLC) and search: “UC Cyber Security Awareness Fundamentals”.
3. When will I see the training non-compliance warning message? You will start seeing the warning message 14 days before your training is due. If the training is not completed by the due date, the warning will appear each time you log in to the web until the training is finished.
4. When will I be restricted from web applications? Access to certain web-based applications will be restricted if the required training is not completed by the due date. The enforcement of these restrictions will begin on February 10, 2025.
5. What web apps will be restricted? You will be restricted from accessing most UCI Single Sign-On applications, including:
   • UCPath – UC single payroll, benefits, human resources, and academic personnel solution for all UC campuses and medical centers.
   • Commute Parking – UCI Transportation and Parking Services.
   • Timesheets – UCI site for submitting employee timesheets.
   • Campus Groups – UCI Campus Community site.
   • FileNet – enterprise content management solution for securely storing UCI Campus and UCI Medical Center content.
6. What web applications are excluded? You will continue to have access to UCLC, ServiceNow, Canvas, Point and Click (PNC), and the VPN.
7. How can I request an extension? You can enable a one-time extension through the UCI Single Sign-On warning message. This extension will grant you continued access for 7 days. After the extension period, access will be restricted again if the required training is not completed.
8. How many times can I request the extension? You are allowed to request the extension only once.

Email Duo Multi-factor Authentication:

1. How do I self-enroll in Duo? Follow this link to self-enroll in Duo.
2. I am an alumnus, how do I request a UCI Gmail account? Contact Alumni Association.

ZotDefend Security Package:

1. What devices will be impacted? All university laptops or desktops.
2. Will smartphones be affected by this? You do not have to download the security package for your smartphone or tablet.
3. The school manages my device. Where can I get more information? Contact the school’s technical information security lead. 
4. I manage my device. How will I be impacted? Contact your local IT department.
5. What’s in the security package? The full security package includes the following components:
   – Endpoint Detection and Response (EDR)
   – Anti-malware
   – Vulnerability Scanning
   – Virtual Private Network (VPN)
   – Security Posture Checking
   – Full Disk Encryption
6. Will it impact system performance? We balance security and performance so that it will not impact user productivity.
7. Is there an exception process? The security package is only required on devices that will support it. Any other exceptions will be reviewed by OIT security on a case-by-case basis, with approvals for extremely rare cases such as if it completely impedes university work from being done. More specific details on the process will be shared by May 2025
8. How do you plan to enforce compliance? Computers used by most users without the package will be blocked from certain parts of the trusted network (Wi-Fi/VPN) and some campus services. The list of enforced services will evolve over time.
9. What are the minimum system requirements to install the security package? Windows systems require at least Windows 10 and TPM chip version 1.2 or later. No end-of-life operating systems will be supported.
10. When can I expect to receive the security package? Many centrally IT managed departments have already deployed the security package. Contact your local IT department for more information or if you need options for self-managed computers.
11. Will my personal computer be affected? It is encouraged that you use the University device your department has provided you to perform your University work. The security package can be downloaded and installed on a personal computer but we do not recommend or support it. Contact your local IT department for more information