Compliance Narratives

Judgment of Compliance

Narrative

Sam Houston State University (SHSU) maintains the integrity and security of its distance and correspondence education programs. The university takes comprehensive measures to ensure the integrity of educational credentials, to protect student privacy, and to notify students of any additional fees associated with identity verification in distance and correspondence education.

Students Registering for Distance and Correspondence Courses Are the Same Students Participating in the Courses, Completing the Courses, and Receiving Credit

SHSU employs several methods to verify that the student who registers for a distance or correspondence education course is the same student who participates in and completes the course and receives credit. A framework of measures is employed, predicated on technical systems, authentication best practices, policy, and peripheral services. This framework is designed to ensure the integrity of educational credentials, protect student privacy, and notify students of any additional fees associated with identity verification in distance and correspondence education by leveraging the following components.

Technical Systems

SHSU uses multiple systems to manage and authenticate student identities and support online learning. A controlled access portal regulates access to the software and systems utilized by students who register in distance learning. This ensures the technical reliability and security of online platforms where educational activities take place. This prevents unauthorized access and ensures that only legitimate users can participate in the educational process.

MySam

The controlled student access mentioned above is managed and authenticated via MySam. MySam is the portal, or “front door,” to the Banner Student Information System (SIS). Once logged in, MySam allows authenticated users the ability to access personalized content, university information, and secure systems, such as Banner Self Service (BSS), the academic advising and degree audit tool, the Learning Management System (LMS) Blackboard®, as well as other software programs peripheral to the academic experience, such as Microsoft Outlook for email [1].

Blackboard

SHSU students completing online coursework do so through Blackboard, SHSU’s LMS. Access to Blackboard provides SHSU students right of entry and right to use courses for which they are registered. Blackboard courses contain lectures, discussions, assignments, examinations, and grades, as well as tool extensions for synchronous learning, web conferencing, group work, and student-to-student/student-to-instructor communication. Students may access content only for courses in which they are enrolled. To verify the authenticity of the registered student, Blackboard uses MySam, which subsequently routes all access requests through a centralized authentication server, leveraging both single-sign-on and multi-faction authentication. Only authenticated users obtain access to the LMS [2].

Banner

Sam Houston State University utilizes the Banner Student Information System (SIS), a comprehensive platform that provides students with access to a variety of essential academic and administrative functions. Access to Banner is controlled through the centralized portal, MySam, which helps ensure that the distance education students who access this service are the same students who participate in, complete, and receive coursework credit. Only by authenticating through the MySam portal, students can perform a wide range of activities to manage their distance education experience effectively [3]. These include the following:

• Course Registration: Search for and register for courses each semester. Add or drop classes, view available sections, and manage course load.
• Schedule Viewing: View current and past class schedules, including times, locations, and instructors.
• Grades: View grades for completed courses and overall academic performance.
• Transcripts: Request official transcripts, view unofficial transcripts, and track the status of transcript requests.
• Billing and Payments: View account balance, pay tuition and fees, and manage payment plans.
• Financial Aid: View financial aid status, accept or decline awards, and track disbursements.
• Contact Information: Update personal contact information, including addresses and phone numbers.
• Emergency Contacts: Maintain and update emergency contact details.
• DegreeWorks®: A tool integrated within Banner that helps students track their progress toward degree completion, including completed courses and remaining requirements.
• Academic Advising: Schedule appointments with academic advisors and view advising notes and recommendations.
• Enrollment Verification: Request verification of enrollment for various purposes, such as insurance or employment.
• Holds and Alerts: View holds on the account that may prevent registration or other actions, and understand the steps needed to resolve them.
• Notifications: Receive important notifications and updates from the university regarding deadlines, events, and other critical information.

Email Encryption

Protects data transmission and storage, ensuring that student information remains confidential and secure from unauthorized access or breaches [4].

Authentication Best Practices

These measures provide an additional layer of security beyond just a password or centralized technological systems, ensuring that the person accessing the system is indeed the authorized student. This reduces the risk of impersonation or unauthorized access.

Secure Login and Passcode

All students are required to use a unique login and password. This secure authentication method ensures that only enrolled students can access course materials and participate in online activities. Upon acceptance, students activate their accounts via a secure University web portal, establishing passwords according to strict security guidelines. Usernames are pre-assigned, emphasizing the creation of strong passwords and safeguarding usernames. Guidelines and recommendations are disseminated through various channels, including the User Accounts Password Policy IT-02 [5].

Single Sign-On (SSO) and Multi-Factor Authentication (MFA)

SHSU employs SSO and MFA (via the DUO app) to strengthen the security of student logins. SSO allows students to use one set of login credentials across multiple applications, reducing the risk of password-related breaches. MFA adds an extra layer of security by requiring two or more verification factors, such as a password and a code sent to a mobile device, ensuring that only authorized users can access their accounts [6].

Password Management

Passwords are valid for 4 years, after which students must change them to retain access. Tutorials and FAQs are available to assist students in creating strong, hack-resistant passwords [7]. An FAQ webpage for password guidelines is made available via the Resources for Students IT@Sam webpage [8]. From the Resources for Students webpage, tutorials are provided on various practices related to computer account activation and changing passwords. Guidelines are also provided via an FAQ pop-up during the password creation and resetting process to promote the creation of hack-resistant passwords of sufficient length and strength.

Bearkat OneCard Office Integration

Student photos taken by the Bearkat OneCard Office, or uploaded remotely with a government issued ID, are integrated into Blackboard profiles and the Banner roster. Faculty can compare these photos with live images during virtual interactions, such as office hours or Zoom lectures, to verify student identities [9].

Proctored Examinations

SHSU conducts proctored exams, both in-person and online, to verify the identity of students during high-stakes assessments. Online proctoring services use advanced technology to confirm the identity of students and monitor exam conditions [10].

Policy

SHSU establishes expectations and requirements for identity verification, ensuring all students are aware of and comply with these policies. This includes stipulations on the types of identification methods used and the frequency of authentication checks [11] [12] [13].

Peripheral Services

On occasion, SHSU utilizes external services, described below, that specialize in identity verification to ensure the highest standards of accuracy and security are met.

Local Area Testing Center

Occasionally, a student may be required to visit a physical testing laboratory to take an examination. Students enrolled in distance and correspondence education programs have the option to use a testing center in their local region. These authorized examination facilities necessitate that students present an authentic and up-to-date identification document issued by a government agency at the city, state, or federal level, or by the University, before taking the exam. Physical laboratories do not accept electronic forms of identification. In addition, it is necessary for the student's first and last names to correspond with the testing request provided by the instructor. Furthermore, the photo on the ID must be easily identifiable as the student who is entering the laboratory.

Agreement for the Public Library

SHSU also aids students who need a physical testing environment by connecting them with a public library in their local area that will supervise an exam without charging any fees. When necessary, SHSU Online collaborates with a public library in the relevant area to facilitate testing arrangements for the learner. Public libraries follow standardized exam proctoring guidelines for verifying the identity of test takers, which includes confirming the validity of a government-issued identification.

By integrating these components, technical systems, authentication best practices, policy, and peripheral services, SHSU ensures that educational credentials are awarded only to legitimate students, protects sensitive student information from unauthorized access, and maintains transparency regarding any additional costs associated with the identity verification process.

Written Procedures for Protecting the Privacy of Students Enrolled in Distance and Correspondence Education Courses or Programs

SHSU has established comprehensive policies and best practice standards to safeguard the privacy of students enrolled in distance and correspondence education programs. The following institutional documents detail these policies and standards:

• Academic Policy Statement 810806, Student Educational Records [14]
• Student Privacy Information [15]
• Data Access Review Policy IT-05 [16]
• Family Education Rights and Privacy Act (FERPA) [17]
• Privacy Rights – Responsibilities as a Faculty and Staff Member [18]
• Privacy Rights – Responsibilities as a Student Employee [19]
• Privacy Rights – Parental Access to Children’s Education Records [20]
• Technology Security Training Policy IT-13 [21]
• User Accounts Management Policy IT-01 [22]
• User Accounts Password Policy IT-02 [5]
• Annual Security Awareness Training Presentation [23]
• Network Use and Vulnerability Assessment Policy IT-12 [24]
• Firewall Policy IT-21 [25]
• Information Security User Guide [26]

A comprehensive list of Information Technology policies is published on the SHSU website [27]. Regardless of course or program modality, these written policies and procedures shown above (a) define the protected student data and related FERPA regulations; (b) establish expectations for University personnel in the use of student data; and (c) provide for a system of accountability and continuous monitoring of the institution's efforts to preserve the privacy of all SHSU students.

Notifying Students at Time of Registration or Enrollment of any Projected Additional Student Charges Associated with Verification of Student Identity

SHSU ensures that students are notified in writing at the time of registration or enrollment of any projected additional charges associated with their educational experience. SHSU prohibits requiring on-campus, distance education, or correspondence education students to utilize identity verification services, which are subject to an additional fee or charge [28]. Rather, SHSU offers several identity verification options at no additional cost to students [13].

To comply with SACSCOC standards, SHSU follows the following practices:

No Additional Cost for Identity Verification

SHSU prohibits requiring the use of identity verification services that incur extra charges for on-campus, distance education, or correspondence education students. Instead, the university offers identity verification options at no additional cost to students [28].

Free Exam Proctoring Services

SHSU provides free exam proctoring services to ensure the integrity of the assessment process [13]. These services are designed to verify student identity securely and effectively without imposing additional financial burdens on students. The proctoring services include:

• Video Capture: During exams, students are recorded to ensure compliance with academic integrity policies.
• Government ID Verification: Students are required to present a government-issued ID, which is verified and recorded as part of the proctoring process.

Supporting Documentation