Where can I find more information about the University Travel Policy?

• Travel Registration and Policies : Office of Global Affairs, UMass Amherst 

• Business & Travel Expenses : Controller's Office, UMass Amherst 

• Export Controls : Office of Research Compliance, UMass Amherst 

• Travel & Expense Program : UMass Office of the President 

• University of Massachusetts Travel Policy : UMass Office of the President

• TARMAC Criteria for High-Risk Destinations and Elevated Cybersecurity Risk Destinations : UMass Office of the President

What are the IT related risk assessment guidelines mentioned in the Travel Policy? 

The guidelines for Umass Amherst IT risk review can be found at Data Management Standard for Travel.docx 

What is the role of IT Risk Management in the international travel approval process? 

IT Risk Management reviews the risks of international travel to the university’s computing devices and/or data and works with the traveler to mitigate IT related risks. 

What should I do if I need to travel with, or access export-controlled data? 

Travelers who are planning on traveling with or will have access to export controlled data or technology while traveling are required to participate in Export Control and IT Risk reviews. Options and guidance for travelers will be discussed during these reviews. 

What is the purpose of the Data Management Standard for Travel? 

The Data Management Standard for Travel is intended to provide guidance to University Travelers from UMass Amherst on how the Travel policy will be applied as it relates to traveling with University Devices or data or accessing it while traveling internationally.

Who does this standard apply to? 

The standard applies to all international university travelers[1] at UMass Amherst who intend to bring university devices, as well as all international university travelers who will have in their possession or will have access to university data during their travel.  

[1] As defined in the Board of Trustees Policy

When should I report an IT-related incident? 

Information security incidents should be reported to Information Security at @email as soon as possible to help mitigate risks. 

This includes, if your devices, data, or IT accounts were accessed without authorization, data protection requirements were bypassed, data was exposed, malware was potentially installed, etc.  

General IT support is available for travelers here: Get Tech Help : UMass Amherst Information Technology : UMass Amherst 

What are the requirements for traveling with university devices? 

University devices must always have the appropriate level or protection on them, especially during travel.  At a minimum, this includes the Foundational Information Security controls. Different types of data may have requirements for additional controls. 

Can I bring my university laptop on international travel? 

If the destination is designated as a high cybersecurity risk, a travel risk review needs to be done to determine appropriate system and data management recommendations.

What should I do if I need a loaner laptop for travel? 

Request a loaner laptop through the Loaner Item Form in the UMass Amherst IT Service Portal. See here for additional information about the Laptop Lending program.

What are my options for operating systems or software on loaner laptops?

Windows and Mac laptops are available and come pre-loaded with basic software that has been reviewed and approved for international travel.  

Details can be found on the Laptop Lending Program page. 

Can I use my personal laptop for University business travel? 

We discourage the use of personal laptops on university business travel because they generally don’t have the required protections in place. The University provides Loaner Laptops for travelers to use to help mitigate risks to their devices and data.   

If the personal device is used to access, transmit, process, or store University Data, it must always have the appropriate level or protection on them, especially during travel.  At a minimum, this includes the Foundational Information Security controls. 

The personal laptop would be subject to the same review as university equipment, if it is intended to be used to access, transmit, process, or store University Data, and requires the same security controls to mitigate risks. 

View additional information related to using personal devices for university business. 

What security measures should I take if using personal devices for university business? 

We discourage the use of personal laptops on university business travel because they generally don’t have the required protections in place. The University provides Loaner Laptops for travelers to use to help mitigate risks to their devices and data.   

If the personal device is used to access, transmit, process, or store University Data, it must always have the appropriate level or protection on them, especially during travel.  At a minimum, this includes the Foundational Information Security controls. 

The personal laptop would be subject to the same review as university equipment, if it is intended to be used to access, transmit, process, or store University Data, and requires the same security controls to mitigate risks. 

View additional information related to using personal devices for university business. 

What security measures should I follow while traveling with University Data? 

• Virtual Private Network (VPN) 

• Foundational Controls 

What should I do if my university device is lost or stolen during travel? 

If a device containing university data or a university owned device has been lost or stolen, email: @email and/or contact the IT Service Desk. Get Tech Help : UMass Amherst Information Technology : UMass Amherst 

What is the purpose of a separate IT account for International Travel? 

If the risk of someone getting access to your IT account is identified as part of the risk assessment process, or at your choosing, a separate account, containing limited information, can be created for use while traveling. 

Do I have to use a separate account for International Travel 

A separate account may be offered as a risk mitigation measure during the risk assessment process. Any University traveler may opt to have a travel account created to mitigate risks. 

Will my IT accounts be suspended or restricted while I am traveling? 

This is an option offered to travelers to help mitigate risks. If it is determined that restricting an account is the preferred way to mitigate the risks to the data that the accounts have access to, then IT can assist with scheduling and configuring the account to be inaccessible during the the agreed upon time frame. The account can be scheduled for restriction when you depart for a high-risk destination. It can also be scheduled to be unrestricted when leaving such a destination. When your account is unrestricted, you can resume using your account and will not need to reset your password. Please note, email will continue to be delivered to your account while it is restricted, though it will not be accessible during the time of the restriction.  

Please see above for information regarding separate travel accounts. 

If I have support issues while traveling with a separate account, how do I get timely support? 

Contact the IT Service Desk. They can also help with transferring data out of your travel account into your primary account when you return.