Remote Working and Mobile Devices Policy

Purpose

This Policy protects information when staff work outside the Utrecht office, from home, at a customer, or on the move, and when they use mobile devices for work.

Scope

This Policy applies to all employees, contractors, and interns who work away from the office, and to every laptop, phone, tablet, and personal device that is used for work.

Policy statements

Eligibility

1. Remote working is available to staff whose tasks allow it, as agreed with their line manager.
2. Staff who work remotely have completed induction awareness and sign for the equipment they receive.
3. The line manager and the HR Lead record the agreement on remote working.

Device requirements

1. Remote work is done on encrypted, managed laptops with automatic updates and endpoint protection switched on.
2. The screen locks after 5 minutes without use, and staff lock it by hand whenever they step away.
3. A device with missing updates or switched-off protection loses access to company systems until it is fixed.

Mobile devices

1. Phones and tablets that reach company email or systems are enrolled with the Service Desk, require a screen lock, and encrypt their storage.
2. A lost or stolen device is reported to the Service Desk within 1 hour. The Service Desk can wipe the device remotely, and does so when the device cannot be recovered.

Network access

1. Remote access to company systems goes through the company VPN with multi-factor authentication.
2. Public Wi-Fi is not used without the company VPN.

Workspace

1. Staff keep a clear desk and a clear screen: papers and devices with company information are put away, and the screen is hidden from others.
2. Calls about confidential matters are held where nobody can listen in.
3. Company information is not printed at home.

Travelling and off-premises

1. Devices are carried as hand luggage and are never left in a vehicle.
2. When a device is used at a customer site, the staff member follows the customer's rules in addition to this Policy.

Personal devices

1. A personal device may reach email and the intranet only after the Service Desk has enrolled it, and it is not used for administration of customer systems.
2. Personal devices keep no customer data, and the company may remove its own data and settings from them.

Customer data

1. Customer data is not kept on local disks. Staff work on it in the customer environment or in approved company systems.
2. Customer data is not copied to personal cloud storage, personal email, or private messaging.

Roles and responsibilities

The Service Desk Lead owns this Policy, enrols devices, and handles lost devices. The ISMS Manager reviews exceptions. The HR Lead includes remote working in the terms of employment. Every staff member keeps the equipment safe and reports problems at once.

Exceptions

An exception needs a written request to the ISMS Manager that states the reason, the risk, and an end date. Encryption and multi-factor authentication are not subject to exceptions.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. A device that does not meet the requirements loses access until it does.

Related documents

• Acceptable Use Policy
• Access Control Policy
• Information Classification and Retention Policy
• Information Security Policy
• Cryptography Policy

Review

The Service Desk Lead reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.