HKUST Drupal Platform - Terms and Conditions
Users need to fulfil the following requirements when they use the Drupal Hosting service to host their websites.
Role and Responsibilities
A business owner (or project owner) owns the Drupal account and the website contents or data that the account is hosting. Besides defining all business requirements of the websites, a project owner also needs to appoint a technical owner (or a vendor) to help take care of the technical requirements imposed by hosting service.
Policies and Guidelines
Account owners should observe and follow the policies and guidelines below.
Cybersecurity Requirements
- Review the Cyber Security Policy and ensure the hosted websites and their data fulfill the requirements whenever appropriate. Specifically,
- High-risk websites or data are not allowed in the Drupal Hosting platform.
- Register your production websites in CITARS http://itsc.ust.hk/cyber-security/citars. Review and update the record regularly if it has already been registered in CITARS.
- Work with ITSC to resolve website vulnerabilities as soon as possible when a cybersecurity breach or threat has been identified.
- If you are outsourcing your websites to vendors, please make sure your vendors have a maintenance plan for the entire lifespan of your websites.
- Health-check scanning is not required before website production.
Account Renewal & Archival
Hosting accounts will be valid for one year initially. Your departmental Cybersecurity coordinators (CSCs) will receive email notification from ITSC when it's time to renew the Drupal sites. If your CSCs do not respond to our emails by the deadline listed in the emails, the websites will then be disabled and archived.
In case the websites are no longer needed, please ask your departmental CSCs to inform us to arrange to remove and archive the websites.
Regular Security/ Maintenance, End-of-life Schedule and Migration
The Drupal hosting platforms will be regularly patched for security updates. It would, although it is rare, potentially affect your websites when applying the security updates. The technical owners (or your vendors) are required to resolve the issues if it happens.
When a Drupal platform reaches the end of its supported date (i.e. end-of-life date) and there won’t be any security updates available, users having websites on that Drupal platform will need to migrate their website contents to another supported platform with the latest software in order to protect their websites from potential cybersecurity attacks (e.g. website defacements, information leakage or alteration, and etc.). The migration may affect website contents and layout if it is upgraded from a very old version. Technical owners and vendors are required to resolve the issues after migration.
End-of-life Schedule
|
Drupal Platforms |
End-of-life (EOL) Dates (estimated*) |
|
Drupal 7.50-7.59 |
2020 |
|
Drupal 8.0 or later |
2021 |
Notes: * The EOL dates listed in the table are estimation only and will be updated after the official announcements from the Drupal community.