Description
Cornell IT requires all current staff to complete Cybersecurity Training annually. New staff will be assigned the course on their start date and will have access to the training content beginning on day three of employment.
This course was developed for the broader Cornell community and includes examples, systems, policies, and questions related to student data, academic activities, campus environments, and Cornell-managed devices that may not apply directly to many Cornell Cooperative Extension roles. This article provides guidance to help CCE employees complete the training by explaining how Cornell-specific content relates to the work of Extension employees.
We all play a critical role in protecting the privacy and security of data.
Accessing the Cybersecurity Training and Attestation
- Cornell IT information and course details: https://it.cornell.edu/security-and-policy/cyber-awareness
- About the Required Training:
- All staff will receive an e-mail from Workday Learning <cornell@myworkday.com> when the course has been assigned from Cornell.
- Staff can also find the course by going to Workday Learning and looking for ITSO 100 FY27 in the "Required for You" section.
- Browser Settings: Allow pop-ups to open in your web browser.
- Completion Tracking: Please allow up to 24 hours for Workday Learning to update your completion status.
- Non-Compliance Warning: If you do not complete the training within 30 days of assignment, you will see a warning page for the following 10 days when attempting to sign in to many Cornell and CCE applications and websites. After that 10-day grace period, you may be unable to access those systems until the training is completed.
Specific Instructions for Cornell Cooperative Extension Employees
Guidance for Data-Related Questions
CCE employees should review the training and answer questions based on their own job responsibilities, which often involve working with the public, program participants, volunteers, and community partners rather than University student-focused activities. Some questions may also reference Cornell systems, such as PeopleSoft, that many CCE employees do not use. In those cases, answer based on the systems and applications you use as part of your work.
Guidance for Device-Related Questions
Some sections of the training assume employees use Cornell-owned and Cornell-managed devices. Most CCE employees use CCE-owned equipment, which is joined to the Cornell domain but is not tracked through Cornell's Certified Desktop program. Please follow the device-specific guidance below when completing the Device Security section.
Note: Although CCE devices are not managed through Cornell's Certified Desktop program, some key Cornell-supported software applications are installed on CCE computers. Learn more about these tools in the Cornell Resources section of this KB article.
Device Security section
CCE employees do not use Cornell-owned devices enrolled in the Certified Desktop program. You will generally not see any devices listed on this page because Cornell does not track CCE-owned computers through Certified Desktop. (If a device is listed, it likely means you have been assigned a Cornell-owned and managed computer through a Cornell University department or program.)
“Verify Your Certified Desktop(s)” - For the questions in this section, please use the following guidance.
Note: The wording of the applicable answer option may vary from year to year. CCE staff should select the option indicating that all devices are accounted for, even though no devices are displayed.
Click the image below to view a screenshot of this training section:
-
Question 2 - "Review the list of Certified Desktop devices assigned to you:"
- Select "All the Certified Desktop devices I use are listed above (if the list is blank, check this box.)"
- CCE-owned computers are not enrolled in Certified Desktop, so no devices will be listed.
- Question 3 - "I use one or more other devices for my Cornell work. Check all that apply:"
- Select “A Cornell-issued device not enrolled in Certified Desktop (most WCM employees and affiliates will select this option)”
- CCE-owned computers are not Cornell-issued; however, this is the most applicable option for CCE staff.
- In addition, select any other options that apply to devices you use for CCE work.
"Self-Managed, Cornell-Owned Devices" - This section asks you to acknowledge your responsibility for the security requirements of your CCE-owned device. The information below provides guidance on how the Device Security requirements apply to CCE-owned devices, including resources and information about the security controls used by CCE.
- Encryption – All CCE computers are encrypted using BitLocker to protect data stored on the device.
- Operating System Patches – Windows updates are automatically installed on CCE computers. To ensure updates are applied successfully, restart your computer regularly and whenever prompted by Windows.
- Password Protection – All CCE computers require a password for sign-in. Never share your password or NetID credentials with others.
- Computer Lock – Computers should automatically lock after a period of inactivity. If your device does not meet Cornell's required lockout timeframe, adjust the Windows screen lock settings accordingly. How to: Power settings in Windows 11 | Microsoft Support
- Device Is Used Only by You and Is Not Shared – While CCE computers may occasionally be used by multiple individuals, login credentials must never be shared. Do not allow anyone to use your computer while you are signed in with your NetID.
- Data Backup – CCE computers may be backed up using several different methods. If you are unsure how your computer or files are being backed up, contact your CCE IT support staff.
- Application Patches – Most software applications, such as Google Chrome and Adobe Acrobat, update automatically. Regularly restarting your computer helps ensure software updates are installed successfully.
- Device Firewall – CCE computers are protected by the Windows Firewall and CrowdStrike security software. These protections should remain enabled at all times.
For each CCE device assigned to you, complete this section using the guidance below. If you have more than one CCE device, click the + icon to add additional devices.
Click the image below to view a screenshot of this training section:
- Device Type
- Select your CCE device type (for example: Laptop or Desktop)
- Description
- If known, enter the computer name assigned to your CCE device (typically formatted as EXT-CTY-1234567)
- If you do not know the computer name, simply enter CCE Computer
- Meets security standards
- Select YES if the Device Security requirements listed above are being followed for this device.
- Stores High-Risk (Confidential) data
At the end of the training, you will have an opportunity to provide comments. To clarify that you use a CCE-owned device rather than a Cornell-owned device, you may enter the following:
- I use an affiliate organization (CCE-owned) device for work, which is joined to the Cornell domain but is not registered in Certified Desktop.
Guidance Related to Policies
This training references Cornell University policies, such as data retention, that may not apply directly to Cornell Cooperative Extension employees. CCE staff should follow the policies, procedures, and guidelines established by their local Association and Cornell Cooperative Extension.
Cornell Resources
- Security & Policy | IT@Cornell
- Annual Cybersecurity Training and Attestation | IT@Cornell
- “Certified Desktop” - This is a package of security tools to protect Cornell University computers. Currently, CCE computers do not have access to this full software suite but below is a list of the individual tools within Certified Desktop that CCE does utilize right now to protect our computers:
-
CrashPlan – Computer backup software
Provides secure, real-time backup, archiving, and versioning of files for computers. This helps protect us from ransomware attacks and fraud and streamlines the process of transitioning local files to a new computer.
-
CrowdStrike — Advanced endpoint protection with antivirus and anti-malware
Software runs in real time and helps prevent malware installation. It will also notify IT staff if there is potential malware on a computer.
-
Spirion — Confidential data identification software
Software that allows you to manually scan your computer to identify and remove confidential data, such as Social Security, credit card, or bank account numbers.
CCE Resources
Handouts:
CCE webinars: