Flexible Staff Requirements and Other Conditions of Flexible Work

Safety and Health

Staff working remotely must maintain a safe and secure workspace free from hazards. Unless the University is informed otherwise, a staff member’s remote workspace is understood to be a work surface (desk or table), seat, computer and accessories, telephone, and a designated location for storing hard copy records, if applicable. Work performed outside of this remote workspace is not authorized by the University.

Staff must report any work-related injuries that occur during remote or on-campus work to their manager and the Boston University Occupational Health Center at the earliest reasonable opportunity and within 24 hours.

Expenses

Staff who work a hybrid schedule or fully remotely at their own request will not be reimbursed for home office equipment (e.g., personal computers and furniture) or services (e.g., internet and phone service), unless otherwise required by law. The University is not responsible for the operating costs, maintenance, property or liability insurance, or other expenses for a staff member’s home or other remote work location. University insurance does not cover staff members’ personal property used for hybrid or fully remote work. Commuting costs to a staff member’s on-campus or remote work locations are not paid by the University.

Staff who are required by the University to work remotely will be provided or reimbursed for certain equipment or expenses as agreed upon with the applicable school, college, or department.

Grant or contract funds may not be used to purchase work equipment for hybrid or fully remote work or to reimburse hybrid or fully remote work expenses unless such purchases or expenses are explicitly budgeted and approved in the award agreement.

Work Space, Technology/Equipment, and Data Security

Schools, colleges, and departments offering flexible work arrangements and staff with such arrangements must ensure that the physical space, technology, and data security requirements below are met. Schools, colleges, and departments may also adopt additional requirements specific to their work, including specialized requirements for ensuring confidentiality of information.

Staff must fully comply with the University’s Data Protection Standards and all other IS&T-related policies when working remotely.

Physical Space

Staff working remotely should work from a space that is appropriate for the type of work being done. The space should generally be private so that others cannot overhear confidential conversations or meetings or view computer screens that contain sensitive information. For staff who do not have a private remote workspace available, schools, colleges, and departments should consider whether alternative ways of complying with the University’s Data Protection Standards are feasible.

Staff who work with physical documents must have a secure location to store those documents and a secure method to destroy papers or media that contain sensitive information. Schools, colleges, and departments must consider how physical documents or media are exchanged between the staff member and the University to ensure the security is adequate under the Data Protection Standards.

Staff members may not hold in-person work meetings at their remote work location.

Technology/Equipment

Equipment:  Staff in positions requiring a computer must be provided with a single set of necessary equipment from the list of BU Standards upon the start of their employment with the University. As a general rule, schools, colleges, and departments will not provide staff who work a hybrid schedule or fully remotely at their own request with any additional computers or accessories (e.g., mouse, keyboard, external monitors) for on-campus offices or remote work locations. The University will also not provide other home office equipment (e.g., furniture) to staff who work a hybrid schedule or fully remotely at their own request.

Internet Connection:  Staff with hybrid or fully remote work arrangements must have a stable, non-public internet connection with sufficient bandwidth to participate in video meetings and other regular activities. The University will not pay for internet service for staff who work a hybrid schedule or fully remotely at their own request.

Technology-Related Challenges: Staff are responsible for addressing technology-related issues at the remote work location, except for issues with equipment provided by the University, which should be communicated to a staff member’s manager.

Data Security

All University employees must protect University data as described in the Data Protection Standards. Schools, colleges, and departments that offer hybrid or fully remote work arrangements should consider the types of University data that remote staff will access and use by referring to the University’s Data Classification Policy. Schools, colleges, and departments should confirm that devices to be used with University data meet Minimum Security Standards, and may require staff who have access to University-owned equipment (such as laptops) for hybrid or fully remote work to use them. Schools, colleges, and departments will instruct staff with hybrid or fully remote work arrangements about use of University systems to transmit and store data, as well as specific security requirements based on the nature of the work.

Staff must ensure that the computers or other technology used to access University data meet the Minimum Security Standards for that data. Staff who use personal devices should ensure that those devices meet the requirements for Endpoint Devices set out in the Minimum Security Standards. In particular, staff should follow the University’s best practices, including the following:

• secure all devices that will access, use, or store University data;
• ensure that devices and the software they run are patched and updated;
• ensure that devices are running software to protect them from viruses, spyware, and other malicious behavior;
• use the University’s VPN to access University information systems that require it, or any Restricted Use data (as defined in the Data Classification Policy); and
• ensure that University data is stored in appropriate University systems, databases or repositories as required by the Department and the University’s Record Retention Policy, rather than on personally owned devices.

In the event that a device that is used to access or store University data is lost, infected with a virus or malware, subject to a phishing attack, or otherwise compromised, notify the University’s Incident Response Team immediately. In the event of a cybersecurity incident that impacts a personal device used to access or store University data, the staff member must fully cooperate with the University’s investigation, which in some cases may involve providing the device to IT for forensic investigation.

University Property

All equipment the University provides to a staff member, whether used on campus or in connection with a flexible work arrangement, remains the property of the University and must be returned upon separation from employment or at any other time upon notice from the University.

Nature of Employment

Nothing in the guidelines alters the at-will nature of employment for any staff member.