Review policy: Acceptable Use Policy

Purpose

This Policy tells everyone at Tidewell IT how to use company equipment, accounts, and information responsibly. It protects our systems, our customers' data, and the people who use them.

Scope

This Policy applies to all employees, contractors, and interns, and to every device, account, and service that Tidewell IT provides or that is used for work, wherever the work is done.

Policy statements

Company equipment and accounts

1. Company equipment and accounts are for work. Limited private use is allowed when it does not harm security, performance, or the work of others.
2. Accounts are personal. Nobody shares an account or lets another person work under it.
3. Equipment and access are returned on the last working day of a contract or assignment.

Company and personal devices

1. Work is done on managed company devices. A personal device may reach email and the intranet only after the Service Desk has enrolled it.
2. A device locks its screen after 5 minutes without use, and the user locks it by hand whenever it is left unattended.

Passwords and authentication

1. Passphrases have at least 14 characters and are never reused for another service.
2. Multi-factor authentication is required on every staff account and on every privileged or remote access path.
3. Privileged accounts are separate from daily accounts, and daily work is never done with a privileged account.

Email web and messaging

1. Staff check the sender and the link before they open an attachment or sign in through a message.
2. Customer data is never sent through personal email or private messaging accounts.
3. Suspected phishing is reported to the Service Desk and is not forwarded to colleagues.

Software

1. Only software from the approved catalogue is installed on company devices. The Service Desk handles requests for other software.
2. Endpoint protection stays switched on and is never removed or bypassed.
3. Software that the maker no longer supports is removed or isolated.

Customer data on endpoints

1. Customer data stays in the customer environment or in approved company systems.
2. Personal devices keep no customer data, and company laptops keep it on local disks only while a task needs it.

Reporting events

1. Anyone who suspects a security event, such as a lost device, a strange message, or unexpected access, reports it to the Service Desk at once, at servicedesk@tidewell-it.example or by phone.
2. Reporting in good faith never leads to a penalty.

Monitoring

1. Tidewell IT logs the use of its systems to protect them, and keeps security logs for 12 months.
2. Monitoring follows the Personal Data Protection Policy and looks at content only when an incident requires it.

Roles and responsibilities

The ISMS Manager owns this Policy. The Service Desk Lead enrols devices, issues accounts, and handles reported events. The HR Lead hands this Policy to every starter. Every person is responsible for their own use of company equipment and accounts.

Exceptions

An exception needs a written request to the ISMS Manager that states the reason, the risk, and an end date. Exceptions to the authentication rules are not granted.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process, and may end a contract. Serious breaches that harm a customer are reported to the Management Board.

Related documents

• Information Security Policy
• Access Control Policy
• Remote Working and Mobile Devices Policy
• Information Classification and Retention Policy
• Incident Response Policy

Review

The ISMS Manager reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.