NTNU uses MachForm for creating digital forms to support work processes that do not have their own solutions or dedicated form systems.

Contents

• Variants
• Use and area of application
• Rules for use
  • Data routine
  • Function-tags
• Secure use
  • Your responsibility as a form owner and super user
  • Scanned copies
  • Encrypting content
• Limitations for attachments
• Signature, authentication, and pre-filled data
• Support

The Records Management Division (DOKU) owns the form system but is not responsible for the specific forms. The IT Division develops and maintains the form system.

Variants

There are two variants of MachForm, with different access:

• Internal (blue): Forms only available for employees and students, requiring Feide-login
• External (red/orange): Forms available to anyone

Use and area of application

MachForm is a general form-system for gathering data associated with work processes. It does not have support for advanced work or data flows, but responses can be downloaded as Excel-sheets, or sent as text or PDF-files by email to one or more recipients.

Data shall not be stored in the system over time, but retrieved and deleted frequently. MachForm is a data-gathering tool, and is not suitable for long-term storage of data. The rules dictate that every form shall have a data routine for the use of and gathering of data, as well as when they will be deleted from the system.

The system is mainly used for formal processes or formal forms that fall under the definition: “Gathers data used in a process or function at NTNU or the unit”. Responsibility for and ownership of the form belongs to the units, and DOKU is second line support for building, developing integrations, and overall use. Where forms are utilized across units the responsibility and ownership belong to DOKU, unless one of the involved units have a formal ownership and thus responsibility.

MachForm shall not be used for informal forms, such as invitations to social gatherings. Instead, Microsoft Forms should be used. Error reports are sent via a form on NTNU Help.

DOKU wishes to contribute to the standardization of forms belonging to NTNU. Units and responsible personnel can contact DOKU for assistance with this work, including an assessment of data collection. It is recommended that forms are exported and stored locally so that you have a backup.

Rules for use

1. Every form shall be tagged like this:
   1. One tag with “Ansvar: UNIT”, indicating which unit owns the form
   2. One tag with “Funksjon: FUNCTION”, indicating what function the form serves
   3. One tag for each unit that utilizes the form, for “KOMM”, “IT”, and “DOKU”. Use established abbreviates where available
   4. If the form is being developed, tag it “Utkast” to indicate that it is a draft
   5. No other tags shall be used
2. As a general rule, forms shall utilize set dates and times for when the form is open and closed for answers
   1. This is done in the form’s settings
   2. The exception is when the form is continually open for answers
3. Those units that create a form are obligated to clarify their responsibility for the use of the form, through the above tagging and declaring a data routine to DOKU
   1. The data routine shall specify how data is treated, who is responsible for assuring that it is deleted and when, as well as describe the purpose of the form
4. No sensitive personal or confidential information shall be gathered in the forms
   1. Information gathered shall mainly be classified as Internal
   2. The unit is itself responsible for compliance with laws in the gathering of data
5. Forms that lack tagging, a data routine, gathers sensitive personal or confidential, or has not been in used since the previous semester can be closed and possibly deleted
   1. Notice regarding violation of rules and administration of existing forms will be given to the unit’s super user via email, thereby to the unit’s leadership via established channels in lieu of an answer
   2. The deadline for replying to inquiries is normally two weeks before the form is closed, thereafter four weeks before the form with associated data is deleted
   3. In especially serious cases the form may be closed immediately, but not deleted before consultation with the relevant unit
6. Discontinued forms shall be closed when not in use anymore, and thereby deleted

Data routine

Data routines shall include purpose, ownership, function associated to work process, and how gathered data will be treated, stored, and deleted. Every formal form shall have an associated data routine, submitted through the form «Rutinebeskrivelse for skjema» in NTNU Help, stored by DOKU. The form asks five questions:

1. Hvilken enhet eier skjemaet? Enter the full name of the unit that owns, maintains and utilizes the form.
2. Hva er navnet på skjemaet? Enter the full name of the form.
3. Hvor ligger skjemaet? Choose MachForm Intern (blå) or MachForm Ekstern (rød/oransje), depending on where the form is stored
4. Hvilken funksjon eller arbeidsprosess bidrar skjemaet til? Describe what the form is used for and why the unit is utilizing it.
5. Hvor lenge oppbevares innsamlet data i MachForm? Describe the type of data that is gathered, as well as when and who will delete it form MachForm.

For example:

1. Hvilken enhet eier skjemaet? Records Management Division
2. Hva er navnet på skjemaet? Application for approval of previously completed education
3. Hvor ligger skjemaet? MachForm Intern (blå)
4. Hvilken funksjon eller arbeidsprosess bidrar skjemaet til? Simplifies applications for integrating courses taken at other Norwegian or foreign educational institution.
5. Hvor lenge oppbevares innsamlet data i MachForm? Information about students, affiliation to faculty or department at NTNU, completed education at external educational institution, consent to retrieval of grades, description of courses, as well as attachments. The form is open for submissions continually, and answer sent automatically to the relevant recipient. Data is deleted by the Records Management Division when the application is treated and archived.

Function-tags

Use the most applicable tag, as highlighted. In the absence of an appropriate tag, ask DOKU.

• Utkast (draft): The form is under development
• Søknad (application)
  • Tildeling (allocation): Funds, resources, promotion
  • Klage (complaint): Examination
  • Begrunnelse (justification): Examination
  • Tilrettelegging (facilitation): Examination, postponement, leave
• Bestilling (order)
  • Endring (change): Create, Modify, Terminate, Delete
  • Forslag (suggestion)
  • Veiledning (guidance)
• Påmelding (registration)
  • Innmelding (registration): For courses, conferences, contracts
  • Registrering (registration): Consent, declaration of confidentiality
• Undersøkelse (survey): Questionnaire, mapping, user survey, evaluation
• Dokumentasjon (documentation): Submission of documents
• Mal (template): Form for duplication

Secure use

It is recommended that everyone with direct access to forms via the administration interface uses to-factor authentication to log in. This is set up in the account settings from the menu at the top, and you can use the same mobile app that you use for 2FA for Feide and other solutions.

Your responsibility as a form owner and super user

As an owner of or responsible for data gathering it is important that you are aware of the risks involved. NTNU, the education-sector, and acknowledged public actors have good resource that you should be familiar with:

• The page Information security for employees and students for an overview of what you must know, contact points for help at NTNU, rules and routines, courses and training, and more
• Sikresiden's resources to avoid being hacked or manipulated
• The page Data collection for an overview of rules and procedures for the gathering of data that includes personal information, which is also relevant for administrative use

Scanned copies

Forms that are an intermediary in work processes where personal information are gathered shall not receive scanned copies. MachForm is not suitable for transient storage, and submitted answers and attachments are not permanently deleted when they are deleted in the administration interface. If you have to collect such data, use the fields in the form rather than a paper copy as and attachment, and encrypt them. Instructions for how is available in Norwegian.

Encrypting content

If the fields in the form is not sufficient to replace a Word-document or similar, the attachment must be password-protected or encrypted before uploaded. On Innsida you can read about protecting Microsoft Office documents with encryption, encrypting files generally, and classification of files and documents. Adobe has a guide for PDF-files. Passwords must be sent via another, secure channel; not MachForm.

Limitations for attachments

Every single attachment cannot exceed 20 MB in size and must be correctly formatted for MachForm to accept the upload. This is necessary for attachments to be sent by email, and to avoid too large attachments being sent. Larger attachments that are publicly available, such as publications or multimedia, should be linked to in a separate field. Larger materials that are not publicly available should utilize Units Filesender-service (Norwegian), which supports very large files.

Forms that have this need should include a field to inform the user that attachments can be sent in this manner, and specify which email-address the attachments should be sent to.

Signature, authentication, and pre-filled data

MachForm Internal is integrated with Feide. This means that the respondent is authenticated with their Feide-ID, and the form can automatically fill in data available from NTNU’s source systems, such as Paga and FS. The form builder can use automatic field-filling (Norwegian), such as name, email, student number, postal address, unit, and more.

This is done to simplify the user’s completion of the form and save time, as well as avoid incorrect data in the submission. The user should be made aware of this in the form.

Support

DOKU supports the super-users in building forms, developing integrations, as well as laws, rules, and routines for use. For an overview of the super-users, se the page Local super-users of MachForm (Norwegian).

DOKUs homepage | Administrative systems for employees | Pages tagged with MachForm