Acceptable Usage Policy

1. Purpose

This policy states what the Organisation allows and forbids when people use its information, systems, networks, devices and communication services. It lets every user know the limits before acting, lets the Organisation protect customer data and its own, and lets managers respond to misuse consistently and fairly.

The policy has four aims:

• to prevent loss, leakage, corruption or unauthorised use of information held or processed by the Organisation;
• to keep systems available and free of malware, unlicensed software and unapproved services;
• to protect users, customers and the Organisation from offensive, unlawful or harassing material and conduct;
• to tell users plainly that their use of Organisation resources is monitored, why, and by whom.

2. Scope

The policy applies to every person who uses Organisation information or technology, wherever they are and whatever device they use: employees, directors, contractors, consultants, interns, temporary staff, seconded staff and the staff of suppliers who have been given Organisation accounts or devices. These people are called users.

• In scope: Organisation-owned desktops, laptops, tablets, smartphones, servers, printers, network equipment and removable media; personal devices that are approved to hold or reach Organisation information; email, messaging, voice and video services; internet and intranet access; cloud and software-as-a-service accounts provided or paid for by the Organisation; social media use that refers to the Organisation or its customers; and all information in any form that the Organisation owns or holds for others.
• Out of scope: a user's private activity on a private device that neither touches Organisation information nor reaches Organisation networks. Conduct in such cases remains subject to the code of conduct and applicable law.
• Customers and visitors who use the guest wireless network are bound only by the guest network terms, which follow section 6.10 (Wireless access).

Where a customer contract sets a stricter rule than this policy, the stricter rule applies to the work done for that customer.

3. Terms and Definitions

4. Roles and Responsibilities

4.1 Accountability notes

Every user is personally accountable for what is done with their account and device. Managers are accountable for what their team members are authorised to do. The IT function is accountable for the configuration that prevents or permits an action; a control that exists only on paper does not discharge this duty.

Where this policy is silent, a user must choose the more cautious course and ask the IT function or the Head of IT Security before acting.

5. Application and General Principles

The policy applies from the user's first day until the day the user's access is withdrawn, and some duties (confidentiality and return of assets) continue afterwards. No user may use Organisation resources until they have been told about this policy and have accepted it using the form in Annexure A.

1. Organisation resources exist to carry out the Organisation's business. Use for any other purpose is a privilege, limited by section 6.1, and can be withdrawn.
2. A user must not do through a personal account, device or service what this policy forbids on an Organisation one.
3. A user must not try to bypass, disable or weaken a security control. If a control blocks legitimate work, the user raises a request; the user does not work round it.
4. A user must not attempt to reach information, systems or areas they have not been authorised to use, even if technically able to.
5. A user must not use another person's credentials, and must not let another person use theirs.
6. A user who sees a violation or a weakness must report it using the route in section 9, and must not test it to prove it exists.
7. Ignorance of this policy is not a defence. The Organisation will make the policy easy to find on the intranet and will brief users when it changes.

6. Acceptable Use Policy Statements

6.1 Personal Use

Limited personal use of Organisation resources is allowed because a rigid ban would be unrealistic and would encourage users to hide what they do. The allowance exists on trust and ends if the trust is abused.

6.1.1 Conditions for personal use

• Personal use must be occasional, brief and outside the user's agreed work periods or during breaks; it must not delay or reduce work, and must not exceed about [30 minutes] a day in total.
• It must not use significant bandwidth, storage or printing, and must not create cost for the Organisation; streaming of long video, large downloads and personal printing in volume are not personal use.
• It must not expose the Organisation to malware, legal claims, loss of reputation or breach of a customer contract.
• It must not involve running a private business, paid freelance work, trading, betting, or fundraising for any cause.
• It must not involve political campaigning, religious promotion or any activity that could be read as the Organisation's position.
• It must not use the Organisation's name, logo, address or email signature for a private purpose.
• Family members and friends must not use Organisation devices or accounts for any purpose.

6.1.2 Examples

A user who is unsure whether an activity is personal use asks the line manager before doing it.

6.1.3 No expectation of privacy

• Personal use does not change ownership of the device, data or account. Personal items on Organisation resources are monitored in the same way as business items under section 6.2.
• The Organisation is not responsible for the loss, damage or disclosure of personal files stored on its devices or services, and may delete them at any time.
• At exit, users must remove personal files before returning a device. The Organisation will not search for or recover personal files after the device has been returned or wiped.

6.2 Monitoring

The Organisation monitors the use of its resources. Users are told this at joining and on every sign-in banner, and no user should expect privacy in anything created, sent, received or stored on Organisation resources, except where law gives a specific protection.

6.2.1 Purposes of monitoring

• to detect and prevent security incidents, malware, data leakage and unauthorised access;
• to confirm that this policy and customer contract terms are being followed;
• to maintain the logs needed to investigate incidents and respond to lawful requests from authorities;
• to manage capacity, performance and licences;
• to investigate a reported or suspected violation, with the approvals in this section;
• to protect the safety of staff and the integrity of the Organisation's reputation.

6.2.2 What is monitored

6.2.3 Safeguards on monitoring

1. Monitoring is automated by default. A person reads the content of a user's email, files or messages only after a written request is approved by the Head of IT Security and the Head of HR, with the Legal and privacy lead consulted, using the form in Annexure D.
2. Requests must state the suspected violation, the accounts and dates needed, and the shortest scope that will do. Approval lapses after [14 days] unless renewed.
3. Monitoring data is available only to named members of the security operations team and the investigators appointed for a case. Every access to it is itself logged.
4. Covert monitoring of an individual is permitted only where a serious offence or fraud is suspected, and only with written approval from senior management and the Legal and privacy lead. It stops as soon as the purpose is met.
5. The Organisation does not intentionally inspect traffic to personal banking, health, or government service sites. These categories are excluded from content inspection and from routine reports, although the fact of a connection may still be logged.
6. Findings from monitoring are used only for the purposes above. They are not used to rank performance or to profile individuals who are not under investigation.
7. A user may ask what monitoring data is held about them. Requests go to the Legal and privacy lead, who answers within the period set in the Data Protection and Privacy Policy.

Where monitoring involves personal data, the Organisation follows the Digital Personal Data Protection Act, 2023 and its Rules [confirm the current requirement], and applicable law in each jurisdiction where it operates, such as the EU General Data Protection Regulation. The Data Protection and Privacy Policy sets the lawful basis, notices and rights that apply.

6.2.4 Monitoring of privileged users

Activity by privileged accounts is recorded in more detail, including commands run and changes made, and is reviewed independently of the person who holds the privilege. Privileged users must not turn off, edit or delete logs, and must not review monitoring data about themselves or their direct colleagues unless a second person approves.

6.3 Archiving

Business information must be kept so that it can be found, relied on and, when the time comes, disposed of. A user's mailbox, local disk or personal drive is not a records store.

• Records of business, customer and legal value (contracts, approvals, decisions, customer correspondence, incident reports) must be saved in the document management system, with the owner and classification recorded, and not left only in an email or on a laptop.
• Email is archived automatically by the IT function after [12 months] in the live mailbox and held in a searchable archive for the period in the retention schedule of the Documents and Records Management Procedure, normally [7 years] for business correspondence unless a shorter or longer period is set.
• Users must not delete, alter, hide or move messages or files in order to avoid retention, investigation or disclosure. Deleting at the end of the retention period is done by the IT function, not by users.
• A legal hold, issued by the Legal and privacy lead, suspends deletion for the information named in it. Users and the IT function must comply on the day it is received.
• Archives are access-controlled, encrypted, backed up and tested for retrieval at least [once a year] under the Backup and Restoration Policy.
• Personal archives (such as local mail files on a laptop or private cloud archive) are not allowed.

6.4 Confidentiality

Users handle information that belongs to the Organisation, its customers and its staff. The duty of confidence applies whether or not a document is marked, and continues after the person leaves.

6.4.1 Duties of every user

• Use confidential information only for the purpose it was given for, and share it only with people who have a need to know and are authorised to receive it.
• Mark and handle information according to its classification as set in the Information Classification and Handling Policy.
• Do not discuss confidential matters in lifts, public transport, restaurants, open-plan areas, social media or any place where others may hear or see.
• Do not photograph screens, whiteboards or documents with a personal phone, and do not record meetings unless all participants have been told and the Organisation permits it.
• Lock the screen whenever leaving a device, clear the desk of printouts, and collect print jobs at once. Dispose of paper in the shredding bins provided.
• Check the recipient list before sending. Use the approved secure file-sharing service for external transfers of confidential information, and never use personal email, personal messaging or personal cloud storage.
• Do not share customer data with anyone who is not covered by the customer contract, and do not use customer data for testing, training of tools or demonstrations unless it has been masked as set out in the Systems Acquisition, Development and Maintenance Policy.
• Report any suspected leak immediately, including one you caused by mistake. Prompt reporting is treated as a mitigating factor.

6.4.2 Confidentiality undertakings

• Every user signs a confidentiality undertaking, or accepts equivalent contract terms, before gaining access to confidential information.
• The duty of confidence continues for [five years] after exit for general business information and without limit for customer data and trade secrets, unless law or the contract says otherwise.
• Nothing in this policy stops a person from making a protected disclosure to the authorities or using a whistle-blowing channel that the Organisation provides.

6.4.3 Visitors and third parties

Visitors, suppliers and customers on site are registered, escorted outside public areas, and shown no more than they need. Users must not leave third parties alone with unlocked devices, open papers or visible screens, and must check that a person has signed a confidentiality agreement before sharing confidential information with them.

6.5 Intellectual Property

Work done for the Organisation produces assets such as source code, designs, documents, data sets, methods and customer deliverables. Respect for ownership rules protects the Organisation, its customers and the people whose work it relies on.

• Unless a written agreement says otherwise, everything a user creates in the course of work, using Organisation resources or on Organisation time belongs to the Organisation, and the user must not claim, sell or publish it.
• Users must install and use only software for which the Organisation holds a licence. Duplicating licensed software or media beyond the licence, using keys or cracks, and sharing licence keys outside the Organisation are forbidden.
• Before using open-source code or components in a product or customer deliverable, the user must have the licence approved by the IT function, which keeps the register of components and their licence terms.
• Users must not copy, download or distribute third-party text, images, music, video, fonts, data or software without the right to do so, and must credit sources where required.
• Users must not reverse engineer, decompile or probe third-party software or services except where a contract or written authorisation from the Head of IT Security allows it for a stated security purpose.
• Customer-owned materials are used only for the customer's work and returned or destroyed as the contract states.
• Users must not give the Organisation any information that they hold under a duty of confidence to a former employer or other party. Doing so can create liability for both.
• Content produced with the help of generative AI tools must follow the Employee AI Usage Policy, including the rules on what may be entered and how outputs are checked.
• The Organisation's name, logos and trademarks are used only as the brand guidelines allow. Users must report suspected infringement of the Organisation's rights to Legal.

6.6 Security Responsibilities of Users

Security is part of every role. The detailed rules follow, but each user also has these standing duties.

• Complete the security awareness training assigned to you within [30 days] of the due date and pass any assessment.
• Keep devices, software and security tools up to date and do not stop automatic updates or scans.
• Protect devices and papers from loss, theft and overlooking, in the office, at home and while travelling.
• Treat unexpected links, attachments, calls and messages with suspicion. Report them using the phishing report function; do not reply to them or forward them to colleagues.
• Report any security event, near miss or weakness to the service desk or the security mailbox at once, in any case within [one hour] of noticing it. Further detail is in the Information Security Incident Management Policy.

6.7 Passwords and Log-in IDs

A log-in ID says who did something; the password or other factor proves it. If either is shared, guessed or stolen, the Organisation can no longer tell who acted. The rules here support the Access Control Policy and the User Access Management Procedure.

6.7.1 Log-in IDs

• Each user has a unique log-in ID, issued by the IT function against an approved request. IDs are never reused for another person.
• Shared, generic or group log-in IDs are not allowed, except for named service or break-glass accounts approved by the Head of IT Security. Each such account has an owner, a documented purpose, controls on its use and a review at least every [6 months].
• Administrators use a separate privileged ID for administrative work and a normal ID for email and browsing.
• Accounts unused for [90 days] are disabled; accounts unused for [180 days] are deleted after owner confirmation.

6.7.2 Passwords and other authentication factors

• Choose passwords that others cannot guess. The system rejects known breached and common passwords; do not try to get round this by adding a digit or symbol.
• Use a different password for every account. Never use an Organisation password on a personal or third-party site.
• Keep passwords in the approved password manager. Do not write them on paper, notes, spreadsheets, chat, tickets or unprotected files, and do not save them in a web browser unless the browser is configured and approved by the IT function.
• Never disclose a password, one-time code or multi-factor prompt to anyone, including a manager, colleague, the service desk or someone claiming to be from IT. The IT function will never ask for it.
• Reject unexpected multi-factor prompts and report them at once; repeated prompts mean the password is already known to an attacker.
• Change a password straight away if you suspect it is known to another person, and report the event within [one hour].
• Temporary passwords issued at account creation or reset must be changed at first use and expire after [24 hours] if unused.
• After [5] failed attempts the account is locked for [15 minutes] or until the IT function verifies the owner and unlocks it. Password resets are done only after the owner's identity is checked by the method in the User Access Management Procedure.

6.7.3 Sessions and screens

• Screens lock automatically after [5 minutes] of inactivity on desktops and laptops, and after [2 minutes] on devices used in public areas. Users also lock the screen manually whenever they step away.
• Remote access and sensitive application sessions end after [30 minutes] of inactivity, or at the interval the application owner sets for higher-risk systems.
• Users must not leave a signed-in session on a shared or public computer and must not allow a browser to remember credentials on one.
• Where biometrics are used, they are an additional factor or a local unlock method only, and are never used to authenticate to systems that do not support them securely.

6.8 Desktops and Laptops

Desktops and laptops are the main route by which information leaves or malware enters the Organisation. They are issued and configured by the IT function, and the baseline below applies to every one of them, owned or approved.

6.8.1 Issue, configuration and ownership

• Devices are issued against an approved request, recorded in the asset register under the Asset Management Procedure, and remain the Organisation's property.
• The IT function installs a standard image with security tools, disk encryption, a firewall, automatic updates and device management. Users must not remove or disable them.
• Users do not have local administrator rights. If a task needs them, the user requests a time-limited elevation through the ticketing tool and the IT function approves it.
• Only approved software on the catalogue may be installed. Users must not install, download or run software that is not approved, including games, peer-to-peer tools, remote-control tools, tunnelling tools and browser extensions that read page content.
• Devices are not lent to colleagues, family or friends and are not left with repair shops. The IT function arranges all repair and maintenance.

6.8.2 Protection baseline

6.8.3 Physical protection and travel

• Keep the device with you or lock it away. Do not leave it visible in a vehicle, hotel room, meeting room or reception desk, and never in checked luggage.
• Use a privacy screen filter when working in public places, and do not work on Confidential information where others can see the screen.
• Use a cable lock or lockable drawer in the office when away from the desk for long. Lock rooms where desktops hold Confidential information.
• Before international travel to destinations on the Organisation's high-risk list, the user asks the IT function for a clean travel device and does not carry other devices or media containing Organisation data.
• Carry devices in hand baggage, and follow any customs or border instruction, but report to the IT function as soon as practicable if a device was taken from sight or inspected.

6.8.4 Loss, theft and return

• A lost or stolen device is reported to the service desk within [one hour] of noticing, day or night, and to the police where it was stolen. The IT function locks the account, remotely wipes the device and begins incident handling.
• A device that is suspected of infection is disconnected from the network and reported; it is not cleaned or restarted by the user.
• Devices are returned when the user leaves, changes role, or no longer needs the device. The IT function wipes them using the Asset Disposal Process.

6.8.5 Personal computers

Personal computers must not store Organisation information or connect to the internal network. Where remote working from a personal computer is approved, it is done only through the approved virtual desktop or browser-based service that prevents data from being copied to the personal computer, as the Mobile Device and Teleworking Policy sets out.

6.9 Smartphones and Tablets

Phones and tablets hold email, contacts, files and authentication apps, and are lost more often than laptops. They are subject to the Mobile Device and Teleworking Policy and the Mobile Device Management Procedure; the rules below are the user-facing minimum.

• Any phone or tablet that reads Organisation email or holds Organisation data must be enrolled in mobile device management. Enrolment gives the Organisation the right to apply security settings, separate work data from personal data, and remotely remove work data. It does not allow the Organisation to read personal messages, photographs or browsing history.
• A passcode of at least [6 digits] is required, with automatic lock after [2 minutes] and wipe or lockout after [10] failed attempts. Biometric unlock may be used as a convenience.
• Device storage must be encrypted, and the operating system must be updated within [14 days] of a release. Devices that cannot be updated to a supported version are not allowed to hold Organisation data.
• Jailbroken or rooted devices, and devices with unofficial app stores or profiles, are not allowed.
• Install apps only from the official store, and not those that ask for access that the function does not need. The IT function may block apps in the work profile.
• Do not use personal messaging apps, personal email or personal cloud services to send or store Organisation information.
• Do not take photographs or screen recordings of confidential material; do not leave the phone unattended in meeting rooms; turn off Bluetooth and wireless sharing when not needed.
• Avoid public charging points and unknown cables; use your own charger or a data blocker.
• Report a lost or stolen device within [one hour]. The IT function will remotely wipe the work data and, for Organisation-owned devices, the whole device.
• When roaming abroad, use the Organisation's approved data plan or VPN, and do not connect to unknown wireless networks.
• Before a phone is sold, repaired, handed on or replaced, the user must remove the work profile through the IT function; for devices owned by the Organisation, the IT function wipes it.

6.10 Wireless Access

Wireless networks are open to anyone within range, so they are controlled more tightly than cables. The Network Security Procedure carries the technical detail.

• Users must connect Organisation devices only to the networks listed above, or to other networks only when the VPN is switched on.
• Users must not install or connect wireless access points, routers, range extenders, hotspots or bridges to the Organisation network, and must not use their phone to create a hotspot for an Organisation device while connected to the Organisation network.
• Users must not try to find, capture or interfere with wireless traffic, scan the networks, or connect to networks they have not been given access to.
• Wireless devices such as printers, speakers or cameras may be connected only after the IT function has approved them, and they must be placed on the network assigned for them.
• Disable Bluetooth discoverable mode and wireless file-sharing features on devices when not needed.
• Report unexpected networks that use the Organisation's name, or sudden loss of connection with prompts to re-enter credentials, to the service desk.

6.11 Removable Electronic Media

Removable media is one of the easiest ways to move data out of the Organisation unseen and to bring malware in. Use is blocked unless there is a business reason.

• Writing to removable media is disabled by default on all devices. A user who needs it submits a request through the ticketing tool, naming the data, purpose, period and recipient; the line manager and the IT function approve. Approvals last no more than [90 days] and are recorded.
• Only media supplied by the IT function may be used. It is encrypted, labelled with its asset number, and issued against the asset register. Personal drives, phones used as storage, and drives found, received or given at events must not be connected to any Organisation device.
• Media received from outside is scanned on an isolated scanning station before use. Files from customers are accepted via the approved file-sharing service in preference to media.
• Confidential data written to media must be encrypted and the key or password sent separately from the media. The media is kept in locked storage when not in use, and carried by hand, or by approved courier with tracking, when it moves between sites.
• Lost or stolen media is reported as a security incident within [one hour]. The device owner records what it held.
• Media no longer needed is returned to the IT function, which erases it by the method required in the Asset Disposal Process and records the erasure. Users must not throw away or reuse media themselves.
• The IT function reviews the media inventory and the list of exceptions [quarterly]. Media not returned or traced is treated as lost.

6.12 Offensive Material

People have the right to work without being exposed to material or behaviour that they find degrading, threatening or hostile. The Organisation also needs to avoid legal liability for such material on its systems.

• Users must not create, access, store, display, send, forward or request material that is pornographic, sexually explicit, violent, abusive, discriminatory, harassing, defamatory, threatening, or that promotes hatred, extremism, illegal acts or self-harm. Offence is judged by its likely effect on a reasonable person, not the intent of the sender.
• This applies to email, chat, shared documents, images, video, audio, desktop backgrounds, social media posts that identify the Organisation, and any material shown on screens or played aloud in the workplace.
• A user who receives such material unsolicited must not forward it or delete it before reporting; they report it to the line manager or HR and to the service desk, who guide how it is to be preserved. Unsolicited receipt is not itself a violation.
• A user who sees a colleague view or share offensive material, or who is targeted by it, may report it in confidence to HR or through the whistle-blowing channel. Retaliation against a person who reports in good faith is itself a disciplinary matter.
• Material that appears to be illegal, such as child sexual abuse material, is not opened further, copied or forwarded by anyone. The user reports it immediately to the Head of IT Security, who involves Legal and, if required, law enforcement.
• People whose role requires them to handle such material, such as the security operations team during an investigation or Legal, may do so only with written approval from the Head of IT Security and under controls that limit viewing and copying.
• The web filter blocks the categories listed in the web filtering rules. A user who believes a site was blocked in error requests review; a user must not use proxies or anonymisers to reach blocked sites.

6.13 Games, Jokes, Entertainment and Other Non-business Material

Items in this section are not offensive in themselves, but they waste time and bandwidth, carry malware, create risk of leaks and blur the line between work and play. The same principle applies to all: use must not interfere with work, security or the reputation of the Organisation.

6.13.1 Games and recreation

• Games, including those that come with an operating system, game stores, game launchers and browser games, must not be installed or played on Organisation devices or networks, except for a game used by an approved training or testing programme.
• Gambling, betting, lotteries, prediction markets and cryptocurrency trading or mining are not permitted on Organisation resources.
• The Organisation may provide recreational facilities (a common room, a separate network) where personal devices may be used for entertainment. These facilities have no access to Organisation systems.

6.13.2 Jokes, chain messages and mass mailing

• Users must not create or send jokes, cartoons, chain letters, hoaxes, petitions, appeals, or unsolicited messages to large groups, whether internal or external.
• Humour that targets any person or group, even if meant lightly, is subject to the Offensive material section.
• Mass messages to the whole Organisation are sent only by the people and teams authorised by the Head of Communications, and by the IT function for service notices.
• Users who receive a chain message or virus warning do not forward it; they report it to the security mailbox and delete it.

6.13.3 Streaming, downloads and bandwidth

• Streaming of audio or video, large downloads, and use of file-sharing or peer-to-peer services are allowed only for business or training purposes, and where the IT function has approved the service.
• Users must not download executable files, scripts, archives, plug-ins or extensions from the internet except through the approved software catalogue.
• The IT function may throttle, block or time-limit traffic that harms business use, and publishes the categories and thresholds it applies.

6.13.4 Social media and public forums

• Users who post in a personal capacity must not suggest that they speak for the Organisation, and must not disclose Confidential information, customer names, incident details, unreleased products, or internal photographs or screenshots.
• Users must not use their Organisation email address to register on social media except for approved professional networks, and must not engage with customers' complaints or security issues on public channels; they pass them to the owner of the official channel.
• Only authorised people, trained by the Head of Communications, may post on official Organisation accounts. Credentials for these accounts are held in the password manager with multi-factor authentication.
• Users must not post material that harasses colleagues, customers or competitors, or that could harm the reputation of the Organisation. The code of conduct applies to online conduct.
• Users must not accept contact from, or give details to, unknown people who ask about the Organisation's systems, staff, customers or projects. They report such contact to the security mailbox.

6.13.5 Messaging and collaboration tools

• Only collaboration, chat, video-conference and file-sharing tools provided or approved by the IT function may be used for Organisation business.
• Channels that include external guests must be set up by their owners with the guests named, a purpose recorded, and reviewed every [6 months].
• Users must not turn on external sharing links with public access for Confidential information, and must remove links no longer needed.
• Users must not share meeting links publicly, and meeting hosts must use waiting rooms and remove unknown attendees when the subject is Confidential.

6.13.6 Personal cloud storage, unapproved software and shadow IT

• Organisation information must not be placed in personal email, personal cloud storage, personal note-taking tools, code repositories outside the Organisation, online converters, translators, or paste sites.
• A user who needs a tool that is not in the catalogue raises a request. The IT function evaluates security, privacy, licensing and cost within [10 working days] and either adds the tool or explains why it is not acceptable.
• Where shadow IT is found, the IT function stops access, moves or deletes the data, and informs the line manager. Repeated use is a disciplinary matter.

6.13.7 Generative AI tools

Public or unapproved generative AI services must not receive Confidential information, personal data, source code or customer material. Approved tools may be used only as set out in the Employee AI Usage Policy, and outputs must be checked by the user before they are relied on or shared.

6.13.8 Internet use summary

6.14 Clear Desk and Clear Screen

• At the end of the day, and whenever away for more than [15 minutes], users remove papers, notebooks, removable media and badges from the desk and lock them in a drawer or cabinet. Whiteboards in shared rooms are wiped and flipcharts are removed or destroyed after meetings.
• Printouts of Confidential information are collected from the printer immediately, are never left on printers, scanners or photocopiers, and are shredded in the secure bins when no longer needed. Use of secure print release is mandatory where it is provided.
• Screens are positioned away from windows, public walkways and visitors. Users minimise or close confidential windows when someone approaches.
• Notes with passwords, access codes or customer data on sticky notes, monitors or under keyboards are forbidden.
• The facilities team and security guards check floors after hours [weekly] and report unsecured papers, devices and keys to the Head of IT Security.

6.15 Printing, Scanning and Copying

• Print only what is needed. Documents that are Confidential or Restricted are printed to a secure queue and collected in person, and are labelled as the Information Classification and Handling Policy requires.
• Scan and copy devices must not send documents to personal email addresses or to external storage. Scan-to-email is limited to internal addresses unless the IT function has approved the use.
• Users must not print at public print shops, hotel business centres or other third-party places for Confidential information.
• Faulty printers are reported to the service desk. Users must not allow a third party to repair a printer that holds disks without the IT function present, since stored images can contain Confidential information.
• Paper copies of Confidential material that are taken out of the office need the information owner's approval, and are logged out and in.

6.16 Working Away from the Office

Remote working is described in the Mobile Device and Teleworking Policy. The following everyday rules apply to the use of Organisation resources outside the premises.

• Use only Organisation-approved devices, the Organisation VPN or virtual desktop, and the approved collaboration tools.
• Work in a place where conversations and screens cannot be heard or seen by others. Use headphones for calls that involve Confidential information, and do not take such calls in public places.
• Home networks must use current encryption, a changed router password and updated firmware. Smart speakers, cameras and voice assistants in the work area are switched off or muted during calls that discuss Confidential information.
• Do not use public computers, cafe or hotel business centres or shared household computers for Organisation work.
• Do not move business data to personal cloud storage or devices in order to continue working when the connection is poor. Raise a ticket and wait for a supported solution.
• Tell the IT function if you plan to work from another country for more than [5 working days], since law, customer contracts and device controls may differ.

6.17 Voice, Video and Conferencing

• Meetings that discuss Confidential matters are held on approved platforms with passcodes or waiting rooms, and with attendees checked against the invitation.
• Recording of meetings needs the host's decision, the participants' knowledge, a stated purpose, and storage in the approved location with the same classification as the content. Recordings of customer meetings follow the customer contract.
• Do not share the full desktop when a single window will do; close messages and notifications before sharing a screen.
• Voicemail and chat history are business records and are subject to the same monitoring and retention rules as email.
• Telephone callers who ask for information about staff, customers, systems or security arrangements are verified through a call-back to a known number. When in doubt, take their details and refer them to the owner.

6.18 Privileged and Administrator Use

People with administrative rights can bypass many controls and so are held to additional rules, which supplement the Access Control Policy.

• Use the privileged ID only for tasks that need it, and take such tasks from a ticket or an approved change under the Change Management Policy and Procedure.
• Do not browse the internet, read email or open documents from a privileged session.
• Do not read, copy or change user data except as the task demands and as approved. Do not disclose what you see in the course of administration.
• Never create backdoor accounts, disable logging or monitoring, or leave test accounts in production.
• Record the use of break-glass accounts in the ticket and rotate the credentials afterwards.
• Administrators are subject to a periodic review of their privileges every [quarter] and to enhanced awareness training.

6.19 Customer and Personal Data Handled by Users

• Users handle customer data and personal data only on systems approved for it, only for the task for which it was given, and only to the extent the contract or the Data Protection and Privacy Policy allows.
• Users must not export, download, screenshot, copy to a local drive or share customer data, except as the customer-facing procedure for the task provides and the information owner has approved.
• Where production data is needed to resolve an incident, access is time-limited and recorded in the ticket. Users must not use it for any other purpose or keep copies after the task.
• Users who suspect that personal data has been exposed report it at once under the Information Security Incident Management Policy; they do not try to put it right themselves or contact the individuals concerned.

6.20 Return of Assets and Information at Exit

1. On or before the last working day, the user returns all Organisation devices, media, badges, keys, tokens, documents and any other asset, recorded in the exit checklist under the HR Security Procedure.
2. The user removes personal files from Organisation devices before return, and hands over business files to the line manager. The user does not delete business information.
3. The user removes the work profile from any personal device and confirms in writing that no Organisation information remains on personal devices, email, cloud storage or messaging apps.
4. The IT function disables access as in section 7.8 and records the completion.
5. The user is reminded of continuing duties of confidentiality and intellectual property in the exit interview.

7. Email Usage

Email is the Organisation's main channel for written business communication and its largest source of attack. These rules apply to every mailbox on an Organisation domain and to the use of personal webmail from Organisation devices.

7.1 IT Function Responsibility

• Provide and run the email service, including availability targets of [99.5 percent] a month, support, backup, archiving and security tools.
• Create, change, suspend and remove accounts only on an approved request, within the periods in this section.
• Configure and operate the email gateway as set out in section 7.5, review its rules every [quarter], and publish the types of attachment that are blocked.
• Publish and maintain sender authentication records for the Organisation's domains (SPF, DKIM and DMARC) and review reports of spoofing [monthly].
• Keep disclaimers and confidentiality footers in place on external email, and the Organisation signature standard on user accounts.
• Provide a one-click function to report suspicious email, and answer reports within [one working day].
• Keep email logs as described in section 7.7 and make the audit trail available only to authorised investigators.
• Apply mailbox size limits, retention and archiving, and tell users in advance of any change that affects them.
• Give users training and simple guides on email use, including how to spot phishing, encrypt a message and check a recipient list.

7.2 User Responsibility

7.2.1 Business use and conduct

• The Organisation email account is a business tool. Messages sent from it are the Organisation's records, and they can be disclosed to customers, regulators and courts.
• Write messages with the same care as a signed letter: accurate, courteous and professional. Do not send anything you would not want to read out loud in a legal proceeding.
• Do not create legal commitments, agree to contract terms, change prices or accept liability by email unless you are authorised to do so.
• Use the standard signature and disclaimer. Do not alter the sender name or send as another person, except through delegated access that has been properly granted.
• Do not use Organisation email addresses for personal subscriptions, shopping, social media sign-up or any non-business newsletters.
• Do not set up automatic forwarding of Organisation email to any external address. Out-of-office replies must not reveal sensitive details such as travel dates for senior staff, or internal contacts' mobile numbers.

7.2.2 Sending information safely

• Check every recipient, especially auto-completed names, 'reply all' lists and external domains, before sending. Use blind copy only when the recipients must not see one another.
• Do not send Confidential or Restricted information by plain email unless it is encrypted as the Cryptography Policy requires. Send passwords or keys by a different channel from the data they protect.
• Send documents above the message size limit using the approved file-sharing service with expiry and access control, not by splitting the file or by personal email.
• Do not send customer personal data to a recipient who does not have a need to know it, and do not include personal data in the subject line.
• Do not send email to, or receive from, a personal address any work files, even to 'work on at home'. Use the approved remote access instead.

7.2.3 Receiving email and avoiding attacks

• Treat unexpected email, especially with urgent requests, payment or bank detail changes, gift cards, login prompts or password resets, as suspect. Verify by calling the sender on a known number.
• Do not click links or open attachments from unknown or unexpected senders. Hover over links to see where they go, and look for external-sender warnings that the gateway adds.
• Never enter credentials on a page opened from an email. Open the application from your bookmarks.
• Report suspected phishing with the report button, then delete it. If you clicked a link or opened an attachment, tell the service desk immediately; speed matters more than embarrassment.
• Do not reply to spam, click 'unsubscribe' on suspect mail or forward it to colleagues.

7.2.4 Shared mailboxes, delegation and mailbox care

• Shared mailboxes have named owners who review membership every [6 months]. Users may send from a shared mailbox only if added as members, and must not use it for personal correspondence.
• Delegated access to another person's mailbox needs that person's consent and the line manager's approval; it is recorded and reviewed every [6 months]. Delegates must not see messages marked private unless the delegation allows it.
• Users keep their mailbox in order: delete unwanted messages, save records to the document management system, and do not hold large attachments. Do not use mail folders as a document store.
• Users must not use auto-archive to local files, PST or similar personal archive files.

7.2.5 Email that carries the Organisation's name

• Anything sent from an Organisation account is taken to be on behalf of the Organisation. A user with an opinion that is personal must say so, and should not give it from the work account.
• Marketing and bulk email to customers is sent only through the approved marketing tool by trained staff, with the lawful basis and opt-out records required by applicable law and the Data Protection and Privacy Policy.

7.3 Email Account Creation Process

An account is created only for a person or function with a business need. The process below applies to every type of account; the User Access Management Procedure has the matching steps for other systems.

1. RequestThe line manager (or HR for a new joiner) raises a request in the ticketing tool with the full name, role, department, start date, account type (person, shared, role or service), the groups and shared mailboxes needed, and the end date for contractors. Target: at least [3 working days] before the start date.
2. Verify and approveHR confirms the person is on record and cleared by pre-employment checks. The Head of Department approves any non-standard mailbox, shared mailbox, distribution list or external-domain access. Target: [1 working day].
3. CreateThe IT function creates the account following the naming standard (for example first name.surname), puts it into the groups for the role, applies the mailbox size class and retention label, enables multi-factor authentication enrolment, and sets a one-time password that expires after [24 hours]. Target: [1 working day].
4. Hand overThe IT function sends the credentials to the user and the manager through separate channels, and the user signs Annexure A and, if needed, Annexure C. The account is enabled for use only when the acknowledgement is recorded.
5. RecordThe ticket records approver, dates, groups and mailbox size, and links to the acknowledgement. The account is added to the quarterly access review.

7.4 Size of Mailbox and Messages

• Larger files are sent via the file-sharing service. The gateway rejects larger messages and tells the sender why.
• Increases above the standard limit need approval from the line manager and the IT function and are reviewed every [6 months].
• Messages with attachments that cannot be scanned, such as password-protected archives, are held in quarantine and released only after review.

7.5 Gateway Security

• All inbound and outbound email passes through the Organisation's email security gateway, which applies anti-malware scanning, anti-spam filtering, link rewriting and time-of-click checking, attachment sandboxing, and impersonation detection.
• Attachment types that commonly carry malware (executable files, scripts, disk images, macro-enabled documents from outside) are blocked or stripped. The list is kept by the IT function and reviewed every [quarter].
• Outbound messages are checked against data loss rules for patterns such as identity numbers, bank details, card numbers and key material. Matches are held for review or blocked and logged. False matches are reported to the IT function for tuning.
• Transport encryption is enforced between the gateway and other mail servers wherever the other side supports it. Messages that must be encrypted end to end are handled as the Cryptography Policy states.
• The gateway adds a visible warning to messages from external senders, and flags look-alike domains and display-name impersonation of staff.
• Mail from domains that fail sender authentication, or that appear on reputation lists, is quarantined. Users can see their own quarantine and request release only for messages they were expecting; the IT function approves release of anything flagged as malware.
• Quarantined messages are held for [30 days] and then deleted.
• Users must not test the gateway by sending malware samples or phishing exercises, other than as part of authorised campaigns run by the security team.

7.6 Management Rights to Review Email Content

Email on Organisation systems belongs to the Organisation. The Organisation may read, copy or disclose it, subject to the safeguards in section 6.2.3, where one of these applies:

• a suspected violation of this policy, law or a customer contract;
• an investigation of a security incident, fraud, harassment complaint or data leak;
• access needed for continuity when a user is absent, has left, or has died, where the information cannot be obtained another way and the line manager has asked using Annexure D;
• a lawful request or order from a court, regulator or law-enforcement authority, handled by the Legal and privacy lead;
• the performance of maintenance or support by the IT function, limited to what is necessary.

Management must never read messages marked as personal or privileged without a record of the reason, and the reviewer must not use what they find for other purposes. Items outside the purpose of the review that come to light by chance are reported to the Head of IT Security only if they reveal serious wrongdoing.

7.7 Maintaining Email Logs

• The email gateway and mail servers record sender, recipient, time, size, subject, attachment names and types, scan results, delivery status and the IP address or device used for sign-in. They do not copy message bodies into logs.
• Logs are sent to the central log service, protected from alteration, and kept for [180 days] online, and longer where Legal or a contract requires it.
• Under the CERT-In Directions of 28 April 2022 [confirm the current requirement], ICT logs must be maintained for 180 days within Indian jurisdiction; the Organisation applies this period as a minimum to the logs of its email service and keeps them in India.
• Only the security operations team and appointed investigators may view logs. Every search of logs for a named user is itself recorded.
• Users are not allowed to turn off or edit logging on their devices or accounts.

7.8 Deactivation of Email Accounts

Accounts are deactivated promptly when the need ends so that former users cannot read or send mail. The timeline below applies from the user's last working day or contract end date.

• Temporary and contractor accounts are created with an end date and expire automatically on that date unless the manager renews them before.
• A deactivated account's address is not reassigned for [12 months] so that mail is not misdirected.
• A person who changes role has the groups and shared mailboxes reviewed within [5 working days] of the change.
• Departing users must not delete messages, forward messages to personal accounts, or copy their mailbox before leaving.

7.9 Email Encryption, Signatures and Records

• Confidential and Restricted information sent outside the Organisation is encrypted using the mechanism approved by the Cryptography Procedure. If the recipient's system cannot accept it, the user uses the secure file-sharing service.
• Digital signatures are used where the document type or customer contract needs proof of origin. Keys and certificates are managed under the Key Management Process; users never share them.
• Email that records a decision, approval, instruction to a customer, supplier or regulator, or a commitment is kept in line with section 6.3, and the user saves it to the record store. Retention is by content, not by the fact that it is email.
• Users who receive a data request, complaint, subpoena or legal notice by email forward it to the Legal and privacy lead within [one working day] without replying.

7.10 Absence and Continuity of Mailboxes

• When absent for more than [one working day], users set an out-of-office reply that names an alternate contact and does not reveal unnecessary details.
• For planned absence, the manager may be given delegated access with the user's consent. For unplanned absence, the manager may request access using Annexure D, and the Head of IT Security may grant limited access for business continuity.
• Roles that receive customer or service email must be handled through shared mailboxes with at least [two] members, so that no one person is a single point of failure.

7.11 Phishing Exercises and Awareness

• The security operations team runs simulated phishing campaigns at least [quarterly], covering all users over a year, with scenarios that reflect current attacks.
• Users who fail a simulation are given instant feedback and short training. Failures are not used for discipline, except where a user repeatedly ignores training. Results are reported in aggregate to management.
• Real reports of phishing are acknowledged within [one working day], and the outcome is shared with users so they learn what to look for.

7.12 Reporting a Policy Violation by Email

1. NoticeA user who sees or receives email that breaks this policy, or who sends one by mistake, tells the service desk or the security mailbox at once, with a copy of the message as an attachment (not forwarded to colleagues). Target: within [one hour] of noticing.
2. ContainThe security operations team recalls or quarantines the message, removes copies from other mailboxes where it can, and warns affected recipients. Target: [4 hours].
3. AssessThe Head of IT Security decides whether the case is a security incident (handled under the Information Security Incident Management Policy), a conduct matter (passed to HR) or both. Target: [one working day].
4. RecordThe case is entered in the violation register (Annexure E) and the evidence is stored with chain-of-custody notes.

8. Good Practice Principles

The rules in this policy cannot cover every case. When a situation is not clearly covered, apply these principles and ask if still in doubt.

1. Need: use only the information and access your task needs, and only for as long as it needs them.
2. Care: treat other people's information as you would want yours treated.
3. Caution: pause before clicking, forwarding, copying, sharing or paying, especially when asked to hurry.
4. Clarity: say plainly what you are asking and why when you ask for access, an exception or help.
5. Candour: report mistakes and incidents promptly; the Organisation can fix quickly what it knows about.
6. Courtesy: do not use Organisation resources in a way that would embarrass the Organisation or a colleague if it were made public.
7. Challenge: politely stop and check anyone who is following you through a secured door, asking for credentials, or using a device that is not theirs.
8. Consistency: do the same at home, on the road and in the office as you would on site.
9. Compliance: follow the instructions of the IT function about use of devices and systems, and keep your acknowledgement of this policy up to date.

9. Reporting Misuse and Incidents

Everyone is expected to report misuse of resources or breaches of this policy that they see, as well as any weakness that could lead to one.

• Reports may be made in confidence and, where the whistle-blowing policy allows, anonymously. Nobody may be penalised for a good-faith report.
• Reports are acknowledged within [one working day]. The report is triaged by the Head of IT Security, who decides whether it is a security incident, a conduct matter or an improvement idea.
• False or malicious reports are a disciplinary matter.

10. Policy Statements on Breach and Disciplinary Action

• Violations are assessed by the Head of IT Security and HR on intent, damage, repetition, seniority, and whether the person reported it. Sanctions are proportionate and may include a reminder, a written warning, withdrawal of access or devices, further training, suspension, dismissal, termination of contract and, where the law is broken, referral to the authorities.
• Deliberate evasion of controls, sharing credentials, sending customer data to personal accounts, accessing offensive material of an illegal nature and hiding evidence are treated as serious misconduct.
• Suppliers and contractors who violate the policy may have their access withdrawn and contracts reviewed.
• The Organisation may seek recovery of losses it suffers as a result of deliberate misuse.

11. Awareness and Training

12. Examples of Violations and Typical Responses

The table is a guide to proportion. Each case is judged on its facts by the Head of IT Security and HR, and the action may be lighter or heavier.

13. Compliance and Monitoring

Results are reported to senior management in the management review. Trends in violations and in the time to report lost devices are used to adjust training and controls.

14. Records and Evidence

Evidence from investigations is collected under the direction of the Head of IT Security so that it is complete and unaltered, and is held with a record of who handled it and when.

15. Where the Detail Is Kept

This policy states what users may and may not do. The following documents carry the supporting rules and steps.

• User Access Management Procedure: how accounts and access are requested, granted, reviewed and removed.
• Mobile Device Management Procedure and Mobile Device and Teleworking Policy: enrolment, remote working and use of personal devices.
• Information Classification and Handling Policy: how information is labelled and handled.
• Logging and Monitoring Policy: what is logged, who may see it and how it is protected.
• Information Security Incident Management Policy: how reports from users are handled.
• Employee AI Usage Policy: rules for generative AI tools.
• HR Security Policy and HR Security Procedure: joining, exit, disciplinary steps and training.
• Communications and Operations Security Policy: operating rules for networks, media, email and the internet.

Annexure A: User acknowledgement of the Acceptable Usage Policy

I have read and understood the Acceptable Usage Policy and I agree to follow it. I understand that my use of Organisation resources is monitored as described in it, and that breaking the policy can lead to disciplinary action.

Annexure B: Quick reference for users

Annexure C: Email account request and deactivation form

Annexure D: Request to access a user's content or monitoring data

Annexure E: Violation register

16. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

17. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

18. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Access Control Policy
• Mobile Device and Teleworking Policy
• Information Classification and Handling Policy
• HR Security Policy
• Employee AI Usage Policy
• Logging and Monitoring Policy
• Information Security Incident Management Policy
• User Access Management Procedure