IT Policy

The security and safekeeping of computers used both inside and outside enterprise offices are the responsibility of the owner (person assigned to the computer).

The owner must sign the Receipt of Property Acknowledgement form at the time the IT Department delivers their computer and accessories.

The owner must sign the Receipt of Property Acknowledgement form at the time they return their computer and accessories.

All users are responsible for the proper use, care and cleanliness of their computer(s).

Users must always restart their computer as soon as possible when the operating systems prompts to restart (due to operating system updates or software updates).

Default settings for users are to login as standard users, not as administrators. In exceptional cases administrator permission may be granted if:

At all times while in possession of administrator permission the user must continue to use their normal user account for daily user activities (daily login, daily computer usage, etc.) and only elevate to the local administrator account for specific tasks that require permission elevation.

Problems with any computer must be reported to the IT Department as soon as possible.

The IT Department Head will set baseline specifications for enterprise computers.

The IT Department will maintain a computer asset inventory for the life cycle of the computer. To assist with this:

Staff are not permitted to own more than one (1) computer unless there is an exceptional circumstance which must then be approved by both the department manager and the IT Department Head.

The replacement, redistribution, and/or relocation of existing computers must have the approval of the IT Department Head.

The retirement/disposal/transfer of ownership of a computer is determined by the following:

The IT Department Head maintains a small inventory of spare laptops. Availability is on a first come first served basis.

Enterprise staff who borrow a spare laptop must sign a IT Devices Borrow form and take responsibility for the borrowed laptop.

The Guest network is for untrusted computers (the Enterprise does not own or manage).

Enterprise staff, contractors, guests, and long/short term visitors that are using untrusted devices may only connect to the Guest network.

Consists of wired LAN outlets and Wi-Fi SSIDs (wireless networks).

The enterprise network is for trusted computers (enterprise owned and managed).

No computer or network device is allowed to connect to the enterprise network without first discussing and obtaining approval from the IT Department.

A computer that is not enterprise owned but is managed by the IT Department is considered a trusted device and may use the enterprise network.

Consists of wired LAN outlets and Wi-Fi SSIDs (wireless networks).

Personal computers or network devices, guest computers or long/short term visitor computers that are not joined to the SMRU/TBHF domain and/or are not managed by the IT Department may not connect to the enterprise network.

If an untrusted device is approved to connect to the enterprise network then these steps must be completed (in this order) before connecting:

In an exceptional circumstance local administrator access may be granted. These circumstances are covered elsewhere in this IT Policy.

If any above items cannot be completed then the untrusted device may NOT be connected to the enterprise network.

All software requirements for the Enterprise must be well defined and then approved by the IT Department Head prior to purchase or implementation.

The approval, installation, configuration and support of all enterprise software are the responsibility of the IT Department.

Users are strictly prohibited from installing any software without prior authorisation from the IT Department. This includes, but is not limited to legal software, illegal/cracked software, games, screensavers, miscellaneous programs downloaded from the Internet, etc.

Unlicensed, illegal, cracked or pirated software must not be installed by anyone onto any enterprise computer system or resource. The Enterprise will treat installation of this type of illegal software as a serious breach of this IT Policy.

Software licence inventories will be maintained by the IT Department to ensure compliance with legislation.

Software installation media will be kept by the IT Department. Software media will not be given to users for installation outside enterprise premises unless authorized by the IT Department Head in which case the Software Media Request Form must be completed.

Software installation/activation/serial keys will not be given to users for installation. If necessary the IT Department will use AnyDesk/TeamViewer to remote control a user’s computer in order to enter the key.

All information/data held on the IT Computing Infrastructure is deemed the property of the Enterprise.

The Enterprise retains the right to access and view information/data stored on any component of the IT Computing Infrastructure. This right is exercised only if necessary in pursuit of required IT system maintenance / migrations / upgrades or solely through the IT Department Head on instruction from a member of the Directorate.

Users are not permitted to store personal multimedia data (mp3, mp4, mpg, mkv, avi, jpg, tiff, bmp, png, etc.) on enterprise servers.

Users are not permitted to store software application installation files on enterprise servers. This includes setup.exe applications downloaded from the Internet or copies of software CDs. If you require software application installation file storage then contact the IT Department who will assist in storing these types of files.

All USB external hard drives or memory sticks must be encrypted with BitLocker or FileVault (operating system dependant).

The IT Department is responsible for ensuring an effective back-up solution for server-held data/information.

Enterprise computer users are responsible for their locally stored data and must ensure they regularly back up their data to an enterprise owned External Hard Disk Drive.

The current solution is simple but not automated. Historically, automated backups have resulted in data loss due to backup problems that users did not notice (backup logs were not carefully/consistently reviewed).

The current solution requires running (double click) a script that quickly shows backup results so that users quickly see success or failure of their backup.

Desktop computer users should avoid storing data on local hard drives (C:\, D:\) and instead should store directly on enterprise servers where it is automatically protected by redundant hard drives and nightly backups.

Data must be organised as per the IT Department standards so that backups only include work related data (no personal data should ever be backed up to enterprise servers or an enterprise owned External Hard Disk Drive).

Storage quotas are implemented on enterprise servers.

The IT Department is responsible for the implementation of an effective anti-malware security strategy. All computers must have up to date anti-malware protection.

Linux and Unix are currently exempted from this policy and do not require antivirus software. These computers are either restricted to guest networks or are servers that are strictly managed by the IT Department and only used for the very specific service running on it.

The installation, configuration, and updating of anti-malware software on all Windows computers is the responsibility of the IT Department.

Remote users and users of portable computer systems and resources will be responsible in assisting in updating and upgrading antivirus software as advised by the IT Department.

All users must virus scan all external media (USB hard drive, memory sticks, memory cards, etc.) before use. The IT Department will provide assistance and training where required.

On detection of a virus, computer users must immediately notify the IT Department who will provide assistance to clean the virus and confirm no damage has been done to the computer.

Under no circumstances may users attempt to disable or interfere with the anti-malware software running on enterprise computers.

Users must ensure their computers are inaccessible if they are away from their desk even for a moment. Use one of these methods:

Users are strictly prohibited from using any methods for hacking internal enterprise systems or external public systems. This includes, but is not limited to, packet sniffing, password sniffing or password hacking.

The enterprise email system is a core application. It is strictly prohibited to use enterprise email for illegal, political, business or commercial purposes unrelated to the Enterprise.

Sending or receiving illegal or inappropriate material through the enterprise email system is strictly prohibited. If any user has problems receiving unsolicited illegal or inappropriate material then the user must inform the IT Department who will assist to filter out and reject these emails.

Limited personal use of email is permitted. Personal (approximate) use is sending/receiving email not larger than 2.0 MB to/from more than a few recipients a few times per week.

The Enterprise retains the right to limit mailbox sizes.

Global distribution lists must only be used when absolutely necessary.

Users are expected to periodically archive their mailbox to ensure their mailbox size limit is not reached and to assist in maintaining an efficient email infrastructure. Users should utilise the archiving and/or personal folder store facilities within the email system in accordance with IT Department recommendations.

The Enterprise retains the right to access and view all emails sent and received by the email system. This right is exercised only if necessary in pursuit of required IT system maintenance/migrations/upgrades or solely through the IT Department Head on instruction from a member of the Directorate.

Access to the enterprise internet is provided for work related business purposes. Users are strictly prohibited from using the enterprise internet services for illegal, political, business or commercial purposes unrelated to the Enterprise.

Users are strictly prohibited from using the enterprise internet services to access pornographic sites, hack sites, pirate software sites or any other sites serving illegal or improper content.

All Peer-to-Peer (P2P) or BitTorrent software is strictly prohibited from being installed on any computer system or resource and from being used on any enterprise provided internet service or connection.

Users are prohibited from using or subscribing to chat rooms, dating agencies or other on-line subscription Internet sites unless the site strictly pertains to work related duties.

Users are prohibited from using the enterprise internet services to access movies and series that are not work related.

Limited personal use of the Internet is permitted.

The Enterprise retains the right to monitor internet usage by users. This right is exercised solely through the IT Department Head and, where relating to a specific member of the Enterprise, and only on instructions from a member of the Directorate.

Abuse of Internet access will be dealt with severity relative to the seriousness of the abuse. Minor abuse will lead to removal of the privilege of access from an individual’s computer.

All new Active Directory user accounts must be initiated through the Head of Human Resources (HR), the Administration Manager or the Chief Operating Officer (COO).

New user account requests must be entered into the Domain and Email Account Form by the Head of HR.

Either a default level of permissions will be applied to the account or the Head of HR will advise an existing account to copy.

All Active Directory user account lockout policy is:

When HR is notified that a user is leaving (leaver) the Domain and Email Account Form is updated with departure details.

When the IT Deparment receives the Domain and Email Account Form notification:

If no request for extension is made then during a user account cleanup cycle (IT Department’s monthly process) the leavers' data and email will be archived to an enterprise server as needed, the user account(s) are deleted, and the Domain and Email Account Form is updated with this information.

If a request for extension is requested:

Quarterly reviews of all accounts in the Active Directory will be undertaken and any account that is determined to be no longer necessary will be deleted. Checks will be made with HR and Department Heads / Line Managers as required before accounts are deleted. Data and email will be archived to an enterprise server.

The Enterprise uses Microsoft native AD password policies.

All users must follow the password policy. Trying to work around or manipulate the password policy is strictly prohibited.

Users must change their passwords when prompted by the system. The system password policy is:

Users are responsible for the security of their passwords and shall not write anywhere the password is easily discoverable (sticky note on computer/monitor, label on computer/monitor, etc.).

Passwords must not be shared with anyone or divulged to anyone, not even with colleagues.

Problems with passwords must be immediately reported to the IT Department.

The installation, management, administration and maintenance of the IT Computing Infrastructure is the responsibility of the IT Department.

Physical or remote access to the IT Computing Infrastructure for management, administration or maintenance purposes is restricted to authorised IT staff.

Administrative access to enterprise servers requires an IT Department team member to have appropriate industry standard certifications for the services running on the relevant server and/or proven knowledge/experience.

The IT Department Head and the IT Department must approve delegated permissions and/or administrative permissions to any component of the IT Computing Infrastructure.

Health and safety with regards to computers are to be managed within the context of Health & Safety Policies.

The IT Department will advise on computer related training issues as required.

It is the responsibility of Department Heads to ensure appropriate computer training for their staff is identified and successfully completed.

Violations of this IT Policy or any act of deliberate sabotage to enterprise computer systems may be considered a disciplinary offence.

An email account can be provided if the individual can only carry out their work by representing themselves as SMRU/TBHF as they are communicating with 3rd parties.

For system access the individual may require specific access, as part of their contractual work, to files and information held within the enterprise server infrastructure (and their work cannot be done without this internal system access).

Reasons they require continuation of their shoklo-unt.com email + length of time required.

Reasons they require access to internal systems at the Enterprise + length of time required.