IT Acceptable Use Policy

NRF IT Acceptable Use Policy

1. Purpose

The computers, workstations, servers, networks, data storage systems, and associated IT services at the UK High-Field Solid-State NMR National Research Facility (NRF) are intended to support scientific research, instrument operation, data acquisition, data processing, training, and facility administration.

Access to NRF computing resources is granted for the duration and purpose of approved facility activities and may be modified, restricted, or withdrawn where necessary to support facility operations, security, or compliance requirements.

Users are expected to use NRF computing resources responsibly, professionally, and in accordance with common sense. The NRF operates a shared national facility, and the actions of individual users must not compromise the work of others, the operation of the instruments, or the security of the facility.

Use of NRF computing resources is also subject to:

University of 糖心TV Information Management and Information Security Policies: /services/secretarytocouncil/info-security/im-policy-framework/policies/
- With particular emphasis on the University Acceptable Use Policy: /services/secretarytocouncil/info-security/im-policy-framework/policies/imp09/
JANET Acceptable Use Policy:
Applicable UK laws and regulations, for example, but not limited to, the .
Any additional requirements imposed by software licences, equipment manufacturers, funding bodies, or research sponsors.

2. Scope

This policy applies to all authorised users of NRF computing resources, including:

Facility staff
Visiting researchers
Academic and industry users
Students
Collaborators
Contractors
Any other authorised users.

Unless otherwise stated, authorisation under this policy means approval from NRF staff or another person explicitly designated by NRF management. Where practical, users are encouraged to obtain such approval in writing (i.e., by email).

3. General Principles

Users must:

Use NRF computing resources only for legitimate research, teaching, training, administrative, or facility operational purposes.
Respect the security, integrity, and availability of facility systems.
Avoid activities that could disrupt instrument operation or negatively affect other users.
Follow instructions provided by NRF staff regarding use of computers, networks, storage systems, and instrument control computers.
Report suspected security incidents, vulnerabilities, or misuse promptly.
Use computing resources in a manner consistent with good scientific practice and professional conduct.

The guiding principle is simple: use NRF systems in the same way you would expect a responsible researcher to use professionally managed University computing facilities.

3.1. Accessibility and Reasonable Adjustments

The NRF is committed to ensuring that its facilities, systems, and services are accessible to all authorised users.

Users may make use of accessibility technologies, assistive devices, and other reasonable adjustments that enable them to access NRF computing resources effectively and safely.

Examples include, but are not limited to:

Screen readers and speech-output software.
Screen magnification and visual assistance tools.
Alternative keyboards, pointing devices, or input devices.
Speech recognition and dictation software.
Accessibility features built into operating systems and applications.
Other assistive technologies required to support accessibility needs.

Users requiring accessibility-related adjustments are encouraged to discuss their requirements with NRF staff so that suitable arrangements can be made where necessary.

Accessibility-related software, hardware, or system configuration changes required to support a user's access needs will not be considered unauthorised modifications under this policy, provided they have been agreed with NRF staff and do not compromise system security, stability, or instrument operation.

The NRF will make reasonable efforts to accommodate accessibility requirements. Requests for accessibility adjustments will be considered on a case-by-case basis and implemented wherever reasonably practicable while maintaining the security, safety, and reliable operation of facility systems.

4. Common-Sense Rule

The NRF operates on a trust-based model. This policy cannot anticipate every possible situation.

If an activity would reasonably be considered:

Illegal
Unethical
Disruptive to facility operations
Detrimental to other users
A security risk
Inconsistent with the purpose of a national research facility

then it should not be undertaken without prior authorisation.

When in doubt, ask NRF staff before proceeding.

5. Prohibited Activities

The following activities are prohibited unless explicitly authorised in writing by the NRF management and, where appropriate, University IT Services.

5.1 Security and System Abuse

Users must not:

Attempt to gain unauthorised access to any system, account, network, data, or service.
Attempt to bypass security controls or access restrictions.
Elevate or escalate privileges beyond those granted to them.
Create administrator accounts or grant themselves additional permissions.
Use password-cracking, penetration-testing, vulnerability-scanning, or hacking tools.
Interfere with, disable, circumvent, or remove security controls or monitoring systems.
Probe, scan, or test systems or networks for vulnerabilities without explicit authorisation.
Attempt to conceal activities from system administrators or security monitoring systems.

5.2 Spectrometer and Instrument Control Systems

Instrument-control computers are dedicated scientific systems and are not general-purpose computing platforms.

Users must not:

Modify operating system settings unless specifically authorised.
Install software into system directories, shared application areas, or protected operating system locations without approval from NRF staff.
Create new directories or files outside their own user space under /opt/nmrdata and /opt/pp, without first discussing with the LMT.
Change spectrometer or instrument-control software configurations.
Modify user permissions or account settings outside their own user space.
Connect unauthorised hardware or peripheral devices.
Disable security or management software.
Perform actions that could compromise instrument performance, operational safety, system stability, or data integrity.

5.3 Remote Access and Network Access

To maintain security and operational stability, remote access to NRF systems is tightly controlled. Remote access is permitted only through NRF-approved mechanisms and may be restricted or withdrawn at any time for operational, security, or compliance reasons.

Remote access to NRF systems is permitted only through methods approved by the NRF. As of October 2026, the only approved remote-access solution is TeamViewer, or another service explicitly designated by the NRF for this purpose.
Users must not establish alternative remote-access methods without prior approval from NRF staff.
Personal remote-desktop software, remote-control applications, reverse tunnels, VPN endpoints, proxy services, or equivalent mechanisms are prohibited unless specifically authorised.

In particular:

SSH access into or out of NRF systems is prohibited unless explicitly authorised in advance.
Any approved SSH access will normally be limited to users with appropriate University of 糖心TV credentials and will be subject to the constraints of the facility's network architecture and security requirements.
Users must not attempt to bypass network restrictions or establish alternative communication channels into or out of spectrometer control computers.

5.4 Illegal or Inappropriate Activity

Users must not:

Use NRF systems for any unlawful purpose.
Access, create, store, distribute, or transmit illegal content.
Engage in fraudulent, deceptive, malicious, or harmful activities.
Harass, threaten, intimidate, or abuse other users.
Violate copyright, intellectual property rights, software licence agreements, or contractual obligations.
Use NRF systems in a manner that would bring the facility, the University of 糖心TV, JANET, or partner organisations into disrepute.

5.5 Resource Misuse

Users must not:

Conduct cryptocurrency mining or related activities.
Run distributed computing workloads unrelated to approved research.
Operate botnets, proxy servers, peer-to-peer file-sharing services, or unauthorised public-facing services.
Consume excessive computing, storage, or network resources unrelated to approved facility activities.
Use facility systems for unauthorised commercial purposes.

The NRF's computing resources are intended to support approved scientific activities and must not be used for personal profit-generating or speculative activities.

5.6 External Communications and Vendor Support

A reasonable amount of troubleshooting is a normal part of conducting experiments and research.

However:

Users should inform NRF staff when issues appear to involve instrument hardware, system software, facility infrastructure, or cybersecurity concerns.
If a user believes it necessary to seek assistance from an external vendor or service provider, NRF staff should be informed in advance wherever practical.
This includes contacting equipment manufacturers or service providers, such as Bruker, regarding facility equipment, software, diagnostics, troubleshooting, remote support, or configuration issues.
NRF staff may coordinate such interactions to ensure that support activities are consistent with operational, contractual, and security requirements.

6. Software Installation

To ensure optimal use of allocated instrument time, users should not routinely install or update software during their visit to the NRF. Where possible, requests for the installation of new software should be submitted to NRF staff in writing well in advance of a visit. Such requests will be considered on their technical, operational, licensing, security, and support implications, and will not be unreasonably refused.

Users may install software only where they have appropriate permissions and where installation does not compromise system security, stability, licensing requirements, or normal facility operations.

The following principles apply:

Installation of software within a user's own home directory is generally permitted, provided it is required for legitimate research activities and does not adversely affect system performance, security, or other users.
Users must not install software into system directories, shared application areas, operating system locations, or other protected locations without prior approval from NRF staff.
Users must not modify system-wide configurations, libraries, environment settings, services, or software installations unless explicitly authorised.
Software must be appropriately licensed and relevant to approved facility activities.

NRF staff reserve the right to remove unauthorised software or configurations that present operational, security, licensing, or support concerns.

The restrictions in this section do not prevent the use of approved accessibility software, assistive technologies, or reasonable adjustments required to enable a user to access NRF facilities and services. Users should discuss such requirements with NRF staff in advance wherever practicable.

7. Data and File Management

Users are responsible for managing their data in a manner that protects valuable research outputs and supports the efficient operation of facility systems. While the NRF provides storage and backup capability in accordance with facility requirements, users are strongly encouraged to maintain their own copies of research data during and after their visit.

Users should:

Follow NRF guidance and established conventions for data storage and archiving.
Store experimental data, processing outputs, scripts, and related files in the designated locations provided by the NRF.
Follow NRF conventions for pulse sequence storage, processing workflows, and project organisation wherever possible.
Ensure that data and files are stored in locations that are included within facility backup and recovery procedures where appropriate.
Remove temporary, duplicate, obsolete, and unnecessary files when they are no longer required.

Users must not:

Deliberately circumvent facility storage arrangements or backup procedures.
Store large volumes of unnecessary data in backed-up locations.
Use backup-protected areas for long-term storage of temporary files, software installation packages, downloaded datasets, virtual machine images, media collections, or other material unrelated to scientific work being undertaken.
Create excessive numbers of files or consume storage resources in a manner that adversely affects other users or facility operations.

File Permissions and Sharing

Users should leave default file and directory permissions unchanged unless there is a specific need to share data or software with collaborators.

In particular:

Users should not routinely modify file ownership or permissions.
Users may add or remove group read/write permissions where appropriate to support collaboration within their project or research group.
Approved shared-storage locations should be used where available.
Users must not grant world-writable permissions to files or directories.
Users should not create files or directories that are writable by all users on the system unless specifically instructed by NRF staff, or indirectly via TopSpin software.
If broader access is required for a legitimate purpose, users should consult NRF staff before making changes.

External Storage Devices

Users may connect personally owned USB storage devices, including USB memory sticks and external hard drives, for the purpose of transferring or backing up their own research data.

The following conditions apply:

External storage devices should be used only for legitimate research-related purposes.
Users are responsible for ensuring that personal storage devices are free from malware and other security threats.
Personal storage devices should not be left connected longer than necessary.
Any sensitive or confidential data must be handled in accordance with University and funding-body requirements.

Users must not connect unauthorised devices, including:

Network equipment such as routers, switches, wireless access points, or mobile hotspots.
Embedded computing devices such as Raspberry Pi systems, microcontrollers, or cryptocurrency-mining hardware.
USB devices intended to emulate keyboards, network adapters, or other hardware functions.
Any device intended to monitor, intercept, modify, or bypass normal system operation or network controls.

Rationale

These storage and software-management requirements exist to support reliable operation of the facility, ensure that important scientific data and pulse sequence developments are appropriately protected, and prevent unnecessary loading of storage and backup infrastructure. Adherence to this policy increases the likelihood that valuable research outputs can be recovered if required while ensuring efficient use of shared resources.

8. Monitoring and Privacy

To protect the operation and security of the facility, the NRF reserves the right to monitor, log, audit, and investigate use of its computing resources in accordance with applicable law and University policies.

Monitoring may include:

User authentication records.
System logs.
Network activity.
Software installation records.
Security-related events.

Users should not expect complete privacy when using NRF-owned devices, systems, or networks.

9. Security Responsibilities

Users are expected to make reasonable efforts to protect the security and integrity of NRF systems and data.

Users should:

Use only credentials that have been assigned to them, their project, or their research group, as appropriate.
Keep passwords, access codes, and authentication details secure and share them only where this is consistent with authorised project or research-group access arrangements.
Take reasonable steps to prevent unauthorised access by individuals outside the authorised user community.
Follow security guidance provided by the NRF and University IT Services.
Report suspected malware, compromised accounts, security incidents, or vulnerabilities to NRF staff as soon as practical.

Users should not:

Use credentials belonging to another individual, research group, project, or institution without authorisation.
Attempt to obtain, guess, disclose, or misuse credentials that have not been assigned to them.
Share credentials beyond the authorised individuals associated with a project or research group.
Circumvent security controls, auditing mechanisms, or access restrictions.

As spectrometer systems may require unattended operation, monitoring, automated processing, remote access, or support activities, users should not routinely lock or otherwise make systems inaccessible while experiments are in progress unless there is a specific operational or security reason to do so.

Reporting Security Issues

Users are encouraged to report security concerns, suspected vulnerabilities, or unusual system behaviour as soon as practical.

Examples include:

Unexpected system behaviour or crashes.
Suspected malware or ransomware.
Unauthorised software installations.
Discovery of security weaknesses or configuration issues.
Accidental access to data or resources that should not be accessible.
Suspected compromise of credentials or accounts.
Unexpected network activity or communications.
Any activity that appears inconsistent with this policy.

Reports should normally be made directly to NRF staff by email, telephone, messaging platform, or in person.

Users are asked to:

Provide a brief description of the issue.
Explain what they were doing when the issue occurred.
Include relevant screenshots, error messages, or log files where available.
Avoid extensive self-directed investigation or remediation unless requested by NRF staff.

Users will not be penalised for reporting security concerns, accidental mistakes, or vulnerabilities discovered during legitimate use of the facility, provided they act in good faith and report the issue promptly.

If a user believes a security issue presents an immediate risk to instrument operation, facility infrastructure, or research data, they should contact NRF staff as soon as possible rather than waiting until the next working day.

10. Support and Incident Reporting

The NRF aims to provide timely support to all facility users.

The NRF will endeavour to provide immediate or near-immediate in-person support during core working hours (Monday to Friday, 10:00 to 16:30, excluding University closure days and public holidays).
Support is available outside these hours where possible, but users should expect delays in response and resolution.
Users are encouraged to report issues as soon as they are identified.
Where an issue is not preventing progress, is not security-related, and does not affect instrument safety or data integrity, users are encouraged to document or highlight the issue for attention during the next core working period rather than treating it as an urgent out-of-hours matter.
Issues affecting safety, instrument operation, security, facility infrastructure, or continuation of an active experiment should be reported immediately.

11. Enforcement

Failure to comply with this policy may result in one or more of the following actions:

Immediate suspension or removal of access to NRF computing resources.
Termination of ongoing computing or instrument sessions.
Removal of data, software, or services installed in breach of this policy.
Reporting of the matter to the user's home institution, employer, or funding body.
Disciplinary action under applicable University procedures.
Reporting to law enforcement authorities where appropriate.
Recovery of costs associated with remediation, recovery, damage, or service disruption.

For users accessing the facility through peer-reviewed, funded, or allocated-access programmes, non-compliance may additionally result in:

Reduction or withdrawal of currently allocated instrument time.
Cancellation of scheduled experiments.
Restriction or suspension of future access to NRF resources.
Consideration of policy breaches in future applications for access or instrument time.

Policy Owner: The UK High-Field Solid-State NMR National Research Facility (NRF)
Related Policies: University of 糖心TV IT Regulations; JANET Acceptable Use Policy
Version: 1.0
Effective Date: 30 September 2026
Review Cycle: Every three years, or following significant policy, infrastructure, or security changes.