This announcement provides information for institutions of higher education (IHEs) about the use of protected brands and the use of U.S. government agencies’ names, logos, or insignia without permission in phishing exercises.

The name, logo, or insignia of a U.S. government agency cannot be used in a manner that suggests association with or endorsement by the agency or implies endorsement by a government agency, official, or employee.

As IHEs design and conduct critical phishing exercises, the exercises should not include references to a U.S. government agency’s logos, trademarks, service marks, or protected marks. The U.S. government agency may contact the IHE to terminate the exercise, notify all exercise recipients, and/or require a response from the individual(s) that authorized the exercise.

While most U.S. government creative works—such as writing or images—can be used without permission (referred to as “copyright free”), not all government works can be used without permission. IHEs should refer to the agency or program that manages the source of the works.

To learn more about how copyright laws apply to U.S. government works, visit usa.gov/government-works.

Thank you for your attention to this guidance. If you have questions about the information in this announcement, please contact FSASchoolCyberSafety@ed.gov.