Isms form a07 4 acceptable use policy

Acceptable Use Policy

ISO/IEC 27001 Toolkit Version 8 ©CertiKit

Acceptable Use Policy [Insert Classification]

Implementation Guidance (The header page and this section must be removed from final version of the document)

Purpose of this document This document sets out the responsibilities of the employee for the use of information and of assets associated with information and information processing facilities and asks them to sign to say that they understand them.

Areas of the standard addressed The following areas of the ISO/IEC 27001:2013 standard are addressed by this document: Annex A A.7 Human resources security A.7.2 During employment A.8 Asset management A.8.1 Responsibility for assets A.8.1.3 Acceptable use of assets

General Guidance This is effectively a summary of several other documents, the key aspect being that this document requires a signature. In many organizations the signed acceptable use policy is required before access to IT systems is granted and the forms are kept in case of any later disputes.

Remember that if you change any of the supporting policies then this document may need to be updated.

Review Frequency We would recommend that this document is reviewed annually.

Toolkit Version Number ISO/IEC 27001 Toolkit Version 8 ŠCertiKit.

Version 1

Page 1 of 9

[Insert date]

Acceptable Use Policy [Insert Classification]

Document Fields This document may contain fields which need to be updated with your own information, including a field for Organization Name that is linked to the custom document property “Organization Name”.

To update this field (and any others that may exist in this document): 1. Update the custom document property “Organization Name” by clicking File > Info > Properties > Advanced Properties > Custom > Organization Name 2. Press Ctrl a on the keyboard to select all text in the document (or use Select, Select All on the ribbon) 3. Press F9 on the keyboard to update all fields 4. When prompted, choose the option to just update TOC page numbers If you wish to permanently convert the fields in this document to text i.e. so that they are no longer updateable, then you will need to click into each occurrence of the field and press Ctrl Shift F9.

If you would like to make all fields in the document visible then go to File > Options > Advanced > Show document content > Field shading and set this to “Always”. This can be useful to check that you have updated all fields correctly.

Further detail on the above procedure can be found in the Toolkit Completion Instructions within the Project Resources folder.

Copyright notice Except for any third party works included in this document, as identified in this document, this document has been authored by CertiKit, and is © copyright CertiKit except as stated below.

CertiKit is a trading name of Public I.T. Limited, a company registered in England and Wales with company number 6432088 and registered office at 5 Falcons Rise, Belper, Derbyshire, DE56 0QN.

Licence terms This document is licensed on and subject to the standard licence terms of CertiKit, available on request, or by download from our website. All other rights are reserved. Unless you have purchased this product you only have an evaluation licence. If this product was purchased, a full licence is granted to the person identified as the licensee in the relevant purchase order. The standard licence terms include special terms relating to any third party copyright included in this document.

Version 1

Page 2 of 9

[Insert date]

Acceptable Use Policy [Insert Classification]

Disclaimer Please Note: Your use of and reliance on this document template is at your sole risk. Document templates are intended to be used as a starting point only from which you will create your own document and to which you will apply all reasonable quality checks before use. Therefore please note that it is your responsibility to ensure that the content of any document you create that is based on our templates is correct and appropriate for your needs and complies with relevant laws in your country. You should take all reasonable and proper legal and other professional advice before using this document. CertiKit makes no claims, promises, or guarantees about the accuracy, completeness, or adequacy of our document templates, assumes no duty of care to any person with respect its document templates or their contents, and expressly excludes and disclaims liability for any cost, expense, loss or damage suffered or incurred in reliance on our document templates, or in expectation of our document templates meeting your needs, including (without limitation) as a result of misstatements, errors and omissions in their contents.

Version 1

Page 3 of 9

[Insert date]

Acceptable Use Policy [Insert Classification]

[Replace with your logo]

Acceptable Use Policy

Document Classification: Document Ref. Version: Dated: Document Author: Document Owner:

Version 1

Page 4 of 9

[Insert Classification] ISMS-FORM-A07-4 1 [Insert date]

[Insert date]

Acceptable Use Policy [Insert Classification]

Revision History Version Date

Revision Author

Summary of Changes

Distribution Name

Title

Approval Name

Version 1

Position

Signature

Page 5 of 9

Date

[Insert date]

Acceptable Use Policy [Insert Classification]

Contents 1

INTRODUCTION ....................................................................................................................................... 7

2

ACCEPTABLE USE POLICY .................................................................................................................. 8

Version 1

Page 6 of 9

[Insert date]

Acceptable Use Policy [Insert Classification]

1 Introduction [Organization Name] takes the subject of information security very seriously. We have a duty to protect the information that we collect and use for the benefit of the organization and its customers. As an employee, you will be expected to comply fully with all of the information security policies that are in place and to report any breaches of these policies of which you may become aware.

This document gives a summary of the main points of the relevant policies and asks you to sign to say that you have read it and understand its provisions.

Anyone breaching information security policy may be subject to disciplinary action. If a criminal offence has been committed further action may be taken to assist in the prosecution of the offender(s).

If you do not understand the implications of this policy or how it may apply to you, please seek advice from your immediate manager in the first instance.

This control applies to all systems, people and processes that constitute the organization’s information systems, including board members, directors, employees, suppliers and other third parties who have access to [Organization Name] systems.

The following policies and procedures are relevant to this document: • • • • • • • • • • • • •

Information Security Policy Electronic Messaging Policy Internet Acceptable Use Policy Mobile Device Policy Teleworking Policy Privacy and Personal Data Protection Policy Cloud Computing Policy Asset Handling Procedure Software Policy Access Control Policy Anti-Malware Policy Information Security Incident Response Procedure IP and Copyright Compliance Policy

Version 1

Page 7 of 9

[Insert date]

Acceptable Use Policy [Insert Classification]

2 Acceptable Use Policy Please ensure you have read the following summary of the main points of the organization’s policies with regard to information security.

1. I acknowledge that my use of [Organization Name] computer and communications systems may be monitored and/or recorded for lawful purposes.

2. I accept that I am responsible for the use and protection of the user credentials with which I am provided (user account and password, access token or other items I may be provided with) 3. I will not use anyone else’s user account and password to access company systems 4. I will not attempt to access any computer system to which I not been given access 5. I will protect any classified material sent, received, stored or processed by me according to the level of classification assigned to it, including both electronic and paper copies 6. I will ensure that I label any classified material that I create appropriately according to published guidelines so that it remains appropriately protected 7. I will not send classified information over the Internet via email or other methods unless appropriate methods (e.g. encryption) have been used to protect it from unauthorised access 8. I will always ensure that I enter the correct recipient email address(es) so that classified information is not compromised 9. I will ensure I am not overlooked by unauthorised people when working and will take appropriate care when printing classified information 10. I will securely store classified printed material and ensure it is correctly destroyed when no longer needed 11. I will not leave my computer unattended such that unauthorised access can be gained to information via my account while I am away 12. I will make myself familiar with the organization’s security policies and procedures and any special instructions relating to my work 13. I will inform my manager immediately if I detect, suspect or witness an incident that may be a breach of security or if I observe any suspected information security weaknesses in systems or services

Version 1

Page 8 of 9

[Insert date]

Acceptable Use Policy [Insert Classification]

14. I will not attempt to bypass or subvert system security controls or to use them for any purpose other than that intended 15. I will not remove equipment or information from the organization’s premises without appropriate approval 16. I will take precautions to protect all computer media and mobile devices when carrying them outside my organization’s premises (e.g. leaving a laptop unattended or on display in a car such that it would encourage an opportunist theft) 17. I will not introduce viruses or other malware into the system or network 18. I will not attempt to disable anti-virus protection provided at my computer 19. I will comply with the legal, statutory or contractual obligations that the organization informs me are relevant to my role 20. On leaving the organization, I will inform my manager prior to departure of any important information held in my account

Declaration I have read the information security policy summary above and agree to comply with its contents and those of any other relevant policies of which the organization may make me aware.

Name of User:

Signature of User:

Date:

A copy of this statement should be retained by the User and [Organization Name].

Version 1

Page 9 of 9

[Insert date]