Fitness to Practise Policy

1. Definitions

1.1. This Policy interprets the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" as described in RFC 2119 to indicate the level of requirement associated with specific actions, processes, or behaviours.

1.2. This Policy adopts the Crown Prosecution Service definitions of cyber-dependent and cyber-enabled offences. 

1.3. The Policy lists these and other relevant definitions in Related Policy Documents, Appendix A Supporting Documents and Appendix B Fitness to Practise Procedure.

4. Policy Statement

7.    The University has a responsibility to determine suitability for entry and to investigate complaints or allegations made about students enrolled on any programme. If a programme has an associated professional accreditation e.g. MSc Counselling, then guidance produced by the professional body should be referred to when assessing suitability for entry or conducting a complaint investigation.

This Fitness to Practise Policy shall apply to any complaints, allegations or information, from whatever source, which relates to the following matters (note: this list is not exhaustive):

• Behaviour that could put the student or others at risk;

• Conduct that is incompatible with the desired characteristics of a professional practitioner, ranging from minor misdemeanours to serious misconduct;

• Conduct which is considered to be ‘misconduct’ under the University’s Code(s) of Student Discipline;

• Any criminal charges or convictions;

• Competence including a lack of capability, attendance or engagement, which could prevent the student from performing their chosen profession safely and effectively.

The above applies even where the conduct or behaviour may not be related to the work of the University, may not have taken place on University property and may not have impacted directly on other members of the University.

Code(s) of student discipline

8. The Code(s) of Student Discipline: Academic Misconduct and Non-Academic Misconduct applies to all students. Students in breach of the Code(s) of Student Discipline will be subject to the relevant disciplinary procedure and, where relevant, may be referred to this policy.

Communication 

9. All communication relating to a case triggered by this Fitness to Practise policy must use appropriate confidential methods. The limits on information distribution must be clearly defined. Communication with the applicant or student should take place within normal business hours and should only occur when the following day is a full University working day.

Communication with professional and regulatory bodies

10. The outcome of Fitness to Practise proceedings may be reported to the BACP (or other relevant professional bodies) if deemed appropriate. 

Suspension from studies or practise in cases of urgency

11. In cases of urgency, the Principal (and in their absence, the Deputy Principal and University Secretary) shall have the power to take immediate action to suspend or exclude a student temporarily from the University. These powers will only be used if it is believed that such action is necessary to protect members of the University community, service users or members of the public in general. 

12. During any period of suspension or exclusion, all reasonable efforts will be taken to minimise any academic disadvantage to the student (e.g. provision of lecture notes, sitting exams away from the main examination locations etc). Suspension pending a hearing is not a penalty.

13. Only the Principal or the Deputy Principal and University Secretary shall have the power to impose a suspension or exclusion. 

Procedure for Applicants

14. The University’s Admissions Team will notify the Chair of the Fitness to Practise Panel of any applicants declaring Criminal Convictions. Any applicant who is deemed to present a risk will have their application, and any contextual evidence gathered by the Chair, and the information will be presented to the Fitness to Practise panel in order that an assessment of risk can be conducted. 

15. The Admissions Team will notify the Chair of the Fitness to Practise Panel of any applicants who submit information as part of the application process that gives cause for concern e.g. removal from a healthcare education programme for a Fitness to Practise matter; a referee voicing concerns about suitability for the counselling profession. The Chair will undertake an investigation and present the information to the Fitness to Practise panel for further consideration.  

16. The outcomes the Panel can reach in relation to an applicant are:

(i).    A judgement that any risk is sufficiently controlled to allow the applicant to progress to the next stage of the application process.
(ii).    To reject the application on the basis that the associated risk is too high to be considered for admission to a counselling programme.

2. Purpose

2.1 Students show fitness to practise in cybersecurity when they demonstrate the skills, knowledge, judgement, and professional conduct needed to work safely, ethically, and effectively within the discipline. 

2.2. Students studying or researching cybersecurity and related subjects possess or can learn technical knowledge that carries risk if misused.

2.3. This Policy sets out how the University responds to behaviour or conduct that raises concerns about a student’s safe, ethical or professional use of technical knowledge or cybersecurity capability, whether that behaviour occurs on campus or elsewhere.

2.4. The Policy explains how the University assesses fitness to practise in cybersecurity, complementing existing complement disciplinary procedures and how the University investigates concerns about behaviour, conduct, or capability that may affect a student’s suitability to enter or remain on a programme.

2.5. The Policy requires the University to apply recognised cybersecurity competency and ethics frameworks, criminal law obligations, and sector expectations for safe and responsible behaviour.

3. Scope

3.1. The University applies this policy to all enrolled students on programmes in the Department of Cybersecurity and Computing within the Abertay on campus portfolio applies from the point of enrolment and continues throughout the student’s studies. 

3.2. Students who breach the Code(s) of Student Discipline fall under the University’s Disciplinary procedure. The University may refer such cases to the Fitness to Practise procedure when the behaviour raises concerns about the student’s suitability, capability, insight or risk in relation to cybersecurity practise.

3.3. The University applies this policy to cyber-dependent offences, and may apply it to cyber-enabled offences, when the student falls within the scope of this policy and their taught cybersecurity content, technical skill, or cybersecurity knowledge forms a significant factor in the concern.

4. POLICY STATEMENT

4.0.1. The University has a duty to assess the suitability of enrolled students who enter or participate in programmes that include cybersecurity-related taught content.

4.0.2. This Policy applies even when the conduct or behaviour does not occur on University property, is not directly connected to University activity, or does not directly involve other members of the University community, where that conduct raises concerns relevant to cybersecurity capability, suitability or risk.

4.0.3. The Procedure that enacts this Policy should seek to resolve matters proportionately and as efficiently as possible.

Enrolled Students

4.1.1. The University has a responsibility to determine a student’s suitability for their field of study.

4.1.2. Students must comply with all relevant University disciplinary and conduct policies.

4.1.3. Students in breach of the Code(s) of Student Discipline will be subject to the Disciplinary Procedure and, where relevant, may be referred to the Fitness to Practise Procedure.

4.1.4. This Policy applies to any non-academic misconduct referral that raises concerns about a student’s suitability to study or practise responsibly within cybersecurity or a related discipline.

4.1.5 This Fitness to Practise Policy shall apply to any matters, from this non-exhaustive list:

• Conduct that is incompatible with the expected standards and behaviours of a cybersecurity practitioner, for example those defined by the UK Cyber Security Council Professional Standards.

• Conduct raising concerns about a student’s insight, judgement or trustworthiness in handling cybersecurity tools or knowledge.

• Criminal charges or convictions that relate to cyber enabled or cyber dependent offences.

4.1.6. Where a non-academic misconduct referral identifies a Fitness to Practise (Cyber) case that referral must follow the Fitness to Practise Procedure (Cyber) for those aspects of non-academic misconduct that fall under the Fitness to Practise Policy (Cyber).

Student Awareness and Agreement

4.2.1. Students enrolled on programmes in the Department of Cybersecurity and Computing must confirm that they understand the expectations and responsibilities that apply to the study of cybersecurity. Students will confirm via a form embedded in the VLE which will be shared with the students by the relevant module or programme lead. 

4.2.2. The University must provide students with clear information about the professional standards, ethical expectations and legal responsibilities that apply when they access cybersecurity teaching material, tools, or environments.

4.2.3. Students must acknowledge these expectations before they receive access to in-scope cybersecurity content, including practical activities, specialist systems, or controlled teaching environments. Students will acknowledge these expectations via a form embedded in the VLE which will be shared with the students by the relevant module or programme lead.

4.2.4. All modules, or sections of modules, that deliver in-scope cybersecurity content must follow a consistent approach to student awareness and agreement, so that all enrolling, transferring, and incoming exchange students receive the same level of information and expectation regarding behaviour.

Communication

4.3.1. All communication relating to a case triggered by the Fitness to Practise Policy (Cyber) must use appropriate confidential methods.

4.3.2. The limits on information distribution must be clearly defined.

4.3.3. All communication should meet a minimum service level agreement of a three working day response time.

4.3.4 Communication with the applicant or student should take place within normal business hours and should only occur when the following day is a full University working day.

Stakeholder Notification

4.4.1. When the Fitness to Practise Procedure (Cyber) is triggered for a student, the University must notify the relevant Head of Department and Programme Leader.

4.4.2 When the Fitness to Practise Procedure (Cyber) begins to progress for a student, the University must notify the relevant programme leader.

4.4.3. When the Fitness to Practise Procedure (Cyber) is concluded for a student, the University must notify the relevant Head of Department and Programme Leader.

Communication with Professional and Regulatory Bodies

4.5.1. The University may report relevant matters to law enforcement or professional bodies where required by law or agreement.

Suspension from Studies or Practise in Cases of Urgency

4.6.1. In cases of urgency, the Principal and the Deputy Principal and University Secretary shall have the power to take immediate action to suspend or exclude a student temporarily from the University. These powers will only be used if it is believed that such action is necessary to protect members of the University community, service users or members of the public in general.

4.6.2. During any period of suspension or exclusion, all reasonable efforts will be taken to minimise any academic disadvantage to the student (e.g. provision of lecture notes, sitting exams away from the main examination locations etc). Suspension pending a hearing is not a penalty.

4.6.3. Only the Principal and the Deputy Principal and University Secretary shall have the power to impose a suspension or exclusion.

Appendix A - Supporting External Documentation

Bradner, S. (1997) Key words for use in RFCs to Indicate Requirement Levels. RFC 2119. Network Working Group. Available at: https://www.rfc-editor.org/info/rfc2119

Crown Prosecution Service (2025) Cyber / online crime. The Crown Prosecution Service. Available at: https://www.cps.gov.uk/types-crime/cyber-online-crime

Appendix B - Fitness to Practise Procedure (Cyber)

B.1 Overview

B.1.1. This document outlines the procedure tied to the Fitness to Practise Policy (Cyber). Outlining the various procedures for the applicable process mentioned in the Policy.

B.1.2. The Procedure below contains:
       (i)    Procedure for Students – Initial Investigation.
       (ii)   Procedure for Students – Stage 1.
       (iii)  Procedure for Students – Stage 2.
       (iv)  Right to Appeal.
       (v)   Fitness to Practise Policy (Cyber) Flowchart.

B.2 Procedure for Student - Stage 1

B.2.1. The Stage 1 meeting should be scheduled as soon as practicable following the initial investigation. The student should normally be given at least five working days' notice of this meeting.

B.2.2. An invitation to the Stage 1 meeting should be sent by email to the student and should include:

• The nature of the concern, and why it merits a Fitness to Practise rather than a non-academic misconduct;

• The date, time and location of the meeting;

• The meeting attendees. Normally the meeting will be chaired by the Head of Department or a Programme Leader and observed by another member of University staff;

• Confirmation of the student’s right to be accompanied at this meeting by another member of the University community i.e. a fellow student, a member of staff or a member of the Students’ Association;

• A copy of this procedure.

B.2.3. Students with additional support requirements should arrange additional assistance for the meeting (i.e. a signer if they have a hearing impairment).

B.2.4. If the proposed date or time of the meeting are not suitable for the student or their companion, the re-arranged meeting will take place no later than five working days after the original date.

B.2.5. Failure to attend by the student, without advance notification will not prevent the Panel from considering the matter and reaching a decision.

B.2.6. Matters which concern repeat professional issues, or are sufficiently serious, may be referred directly to Stage 2 of this Procedure.

B.2.7. This approach may be taken where, for example:

• A student has previously had a sanction imposed at Stage 1 of this procedure and a further referral is made for a similar repeat professional issue.

• In circumstances where a concern has been raised by a member of the public which is deemed to be sufficiently serious and limited in ambiguity that immediate action should be taken.

B.2.8. At the Stage 1 meeting, the Panel chair shall set out the nature of the allegation complaint or information. The student should be made aware of the potential outcomes of the meeting.

B.2.9. The outcomes the Fitness to Practise (Cyber) Stage 1 Panel can reach in relation to are: 

• That no further action or remedial action may be taken.

• That one or both of the following sanctions may be imposed:

  • A period of close monitoring of the student's performance and/or conduct.

  • A formal reprimand to remain on the student's record for the duration of their study.

• That the case may be referred to Stage 2 of this Procedure.

B.3 Procedure for Students - Stage 2

B.3.1  The Stage 2 Meeting will normally be convened as soon as reasonably practicable after completion of Stage 1 of this Procedure. The student should normally be given at least five working days’ notice of this meeting.

B.3.2  An invitation to the Stage 2 meeting should be sent by email to the student and should include:

(i)      The nature of the concern, and why it merits a Fitness to Practise rather than a non-academic misconduct;

(ii)     Any information established during Stage 1;

(iii)    The date, time and location of the meeting;

(iv)    The meeting attendees. Normally the meeting will be chaired by the Head of Department or Programme Leader and observed by another member of University staff;

(v)     Confirmation of the student’s right to be accompanied at this meeting by another member of the University community i.e. a fellow student, a member of staff or a member of the Students’ Association;

(vi)    The student’s right to provide a written or oral statement at the meeting;

(vii)    The student’s right to review documents in advance of the meeting;

(viii)   The student’s right to submit documents in advance of the meeting;

(ix)     The University’s and the student’s right to call and question witnesses;

(x)     How the meeting will be conducted – case laid out, questioning of witnesses, consideration of evidence, deliberations in private;

(xi)    The potential outcomes of the Stage 2 meeting;

(xii)   A copy of this policy.

B.3.3  To ensure sufficient time is allocated, students must inform the Chair in writing at least three working days in advance of the meeting of the Panel if they intend to call witnesses.

B.3.4  Witnesses will not be provided with a set of papers as their role is to provide relevant evidence to the panel and not to question those in attendance or provide a character reference for the student.

B.3.5  Students with additional support requirements should arrange appropriate assistance for the meeting (i.e. a signer if they have a hearing impairment).

B.3.6  If the proposed date or time of the meeting are not suitable for the student or their companion, the re-arranged meeting will take place no later than 5 working days after the original date.

B.3.7  Failure to attend by the student, without advance notification, will not prevent the Panel from considering the matter and reaching a decision.

B.3.8  A Stage 2 Fitness to Practise Panel will normally comprise of:

(i)      The Vice-Principal (Faculty of Design, Informatics and Business) (Chair);

(ii)      A cybersecurity programme leader who is not the programme leader of the student;

(iii)      A cybersecurity academic;

(iv)     If applicable, a member of the University’s IT Infrastructure & Cybersecurity team;

(v)      An elected member of the Students’ Association with appropriate training.

B.3.9  The Panel may co-opt an individual with experience of a Fitness to Practise Panel at another higher education institution if necessary and practicable.

B.3.10 Training for the Students’ Association representative will be provided by the Department of Cybersecurity and Computing.

B.3.11 Non-chairing members of the panel may not be members of staff who:

(a) have been involved at Stage 1 or,

(b) reported the allegation, complaint or information being considered, cannot sit on the Panel at Stage 2.

although these staff may be called as witnesses.

B.3.12  A member of Academic Services will be in attendance to record the decision of the Panel.

B.3.13  A Stage 2 Fitness to Practise Panel must decide the following:

(a) Based on the evidence provided, has the allegation or complaint been proven on the balance of probabilities; and

(b) Whether the facts prove and call into question the student’s fitness to practise cybersecurity by reference to the relevant ethical principles.

B.3.14  The Committee may impose one or more of the following sanctions:

(i)      Close monitoring of the student’s performance and conduct;

(ii)      A written or oral reprimand;

(iii)     Suspension of matriculated student’s status for a period;

(iv)     Suspension of access to University facilities, such as IT and library services;

(v)     Exclusion for a period not exceeding one academic year;

(vi)     A recommendation is made to the Programme Assessment Board that the student is unable to progress to the next stage and instead is required to re-enrol;

(vii)    Recommendation to withdraw the student from their programme of study.

(viii)   Recommendation that the student be expelled from the University.

B.3.15  In cases where the panel make the recommendation to withdraw the student from their programme of study, they may discuss the possibility of transfer to another suitable programme.

B.3.16  The purpose of the outcomes is to protect the student and others. The Panel will work through the different outcomes from the least to the most severe (as set out above). The Panel will only consider a harsher outcome if they are satisfied that the less harsh warning or sanction is not sufficiently strong to protect the public.

B.3.17  In making the decision on whether a warning or a sanction should be made, the Panel will ensure that it is proportionate to the concern and that it is likely to effectively address the concern that has been raised.

B.3.18  When a sanction is agreed, the Chair should advise the Dean of Teaching and Learning, as the Chair of the Programme Assessment Board.

B.3.19  In cases where the outcome of A Stage 2 Fitness to Practise Panel results in a suspension/exclusion/ recommendation to withdraw, the procedure for considering a return to study should be made clear to the student by the Director of Student and Academic Services at the time of his/her interruption (noting that the Chair of the Fitness to Practise Committee may need to be consulted in relation to any requisite professional expectations).

B.4. Right to Appeal

B.4.1 The student may appeal against the decision of a Fitness to Practise Panel, but only if there are valid grounds to appeal.

B.4.2  The only valid grounds for appeal are:

a)  Procedural irregularity or,

b)  Evidence of bias or prejudice or,

c)  Substantive new evidence which has become available and which was not presented to the original panel for good reason.

B.4.3  An appeal against a decision of a Fitness to Practise Panel must be made in writing to Academic Services, stating clearly the grounds of appeal, not more than 10 working days after the date on the Panel’s decision letter. The appellant should also make explicit whether they are appealing the finding of the Panel, the sanction imposed or both the finding and the sanction.

B.4.4 On receipt of the appeal, the Director of Academic Services will review the case to determine whether there are grounds for the appeal to proceed.

B.4.5  If the appeal is deemed not to contain grounds to proceed, the student will be advised of this normally within five working days of receipt of the appeal. The student will be informed of the right to seek an independent review of the University’s decision by the Scottish Public Services Ombudsman.

B.4.6  If the Director of Academic Services considers that the appeal should proceed, the matter will be referred to an Appeal Panel.

B.4.7 To ensure that professional issues are considered, while also ensuring fairness when reaching a conclusion, the Panel must include one member from another university who has strategic experience of Fitness to Practise.

B.4.8  A Fitness to Practise Appeal Panel will normally comprise of:

(i)      An appropriate delegate for the Vice-Principal (Faculty of Design, Informatics and Business) (Chair);

(ii)      A cybersecurity programme leader who is not the programme leader of the student.

(iii)     A cybersecurity academic.

(iv)     If applicable, a member of the University’s IT Infrastructure & Cybersecurity team.

(v)      An elected member of the Students’ Association with appropriate training.

(vi)     A co-opted individual with experience of a Fitness to Practise Panel at another higher education institution.

B.4.9  The composition of the appeal panel will be individuals who were not involved in the Panels previous.

B.4.10  Where an appeal is upheld, the Appeal Panel can remove the sanction and/or refer the matter back to the Fitness to Practise Panel with recommendations for the matter to be reviewed.

B.4.11  If the appeal is rejected, the Appeal Panel will review the level of penalty imposed and may confirm it, reduce it or increase it. The decision will also be communicated to the Faculty and to Registry, in order to be lodged in the student’s record.

B.4.12  The decision of the Appeal Panel is final and concludes the University’s internal procedures.

B.4.13  A student who remains dissatisfied with the outcome of the University’s internal processes may seek an independent review of the University’s decision by the Scottish Public Services Ombudsman.

APPENDIX B - FITNESS TO PRACTICE FLOWCHART

* includes discussions with studentconduct@abertay.ac.uk as to whether the concern raised should be consider under this policy, the Student Code of Discipline: Academic Misconduct or the Student Code of Discipline: Non-Academic Misconduct.

Document Approval Date: 3 June 2026
Effective Date: 1 September 2026
Review Date: 31 August 2027