The intent of this policy is to define the organization’s requirement for providing employees, users, authorized third parties, and system administrators with access to systems, applications, and data.

Given the organization’s Data Classification Policy, role-based access controls will be defined for each job function. Each job description will have job tasks and functions defined that may require access to systems, applications, and data. Depending on the sensitivity of the job function, access to sensitive data may be required.

The physical scope of this policy shall include the following domains within the seven domains of a typical IT infrastructure (see figure on next page):

• Workstation Domain—Workstation, laptop, and endpoint devices
• LAN Domain—Network backbone, distribution, and edge LAN switches
• Remote Access Domain—Public Internet or other wide area network service
• System/Application Domain—Virtual servers, servers, server farm switches, and virtual networks

The operational and management scope of this Access Control Policy shall include:

• Authorization—New hire, HR onboarding, and role-based access controls are defined.
• Identification—Unique login ID is provided.
• Authentication—Temporary password is provided requiring user to change to complex and very strong password.
• Accounting—Audit trails, logs, and user additions and deletions.

Access controls—The process and procedures for how authorized users are to gain access to the network, systems, applications, and data.

Active Directory—Windows system that provides identification and authentication for access to the LAN.

Authentication—The process of ensuring that the individual is who he or she claims to be by asking for a password or series of questions to verify the individual’s identity.

Authorization—HR onboarded new hire is authorized to obtain role-based access controls based on the job duties and tasks required.

Identification—The assignment of a user ID or login ID for the user.

Multifactor authentication—After the initial login ID and password are used, another method of user authentication is enabled such as two-factor authentication using a hard token or soft token passcode.

Role-based access controls—Within an organization, different job functions require different access to different IT systems, applications, and data. Role-based access controls define access to IT systems, applications, and data based on the role or job function required.

Security information event management (SIEM)—A sophisticated log aggregation system that can analyze audit trails and logs, and correlate events and security incidents on an IP data network. The SIEM is the central data repository for audit trails and logs of IT assets where threat analysis is performed.

Separation of duties—A security control where roles and responsibilities are shared and distributed to privileged system administrators so that all the power is not with one individual.

Two-factor authentication (2FA)—Provides identification of users by means of the combination of two different components. These components may be something the user knows, something the user possesses, or something inseparable from the user. Two-factor authentication is a type of multifactor authentication.

User ID/login ID—A unique identifier that is given to an authorized user. User IDs and login IDs can be a user’s email address or other username assigned within Windows Active Directory (AD) or where all user IDs and login IDs are created.

POLICY

All employees, authorized users, and authorized third parties shall be granted access to the organization’s network, systems, applications, and data as needed to perform their job responsibilities.

The following defines the security controls for access controls:

• HR onboarding must be completed prior to the new hire obtaining their login credential (authorization).
• Access privileges are determined based on least privileges necessary to perform job responsibilities (authorization).
• Access privileges are based on role-based access controls.
• Security awareness training must be completed within 1 week of hire after receiving the login credentials.
• Each employee, authorized user, and authorized third-party representative must have and will be assigned a unique user ID and password for the following (authentication):
  • Access to the organization’s workstation/laptop screensaver (same as Active Directory password)
  • Access to the organization’s LAN via Windows Active Directory ID and authentication
  • Role-based access to the systems, applications, and data required of the job responsibilities
• Users are not to share their user ID or password with anyone.
• Users are to abide by the organization’s password management standard requiring the user to have a 12-character, complex, and stringent password (e.g., 1 capital, 1 lowercase, 1 number, 1 character, no reuse, etc.) Alpha-character names or numbers that have meaning to the individual are not permitted to be used (e.g., names of children or pets, birth year, graduation year, street address number, etc.).
• Users shall utilize their AD login credentials when remotely accessing the network plus must use 2FA via a soft-token solution.
• All user login attempts and logout attempts must have audit trails and logs sent to the organization’s syslog or security information event management (SIEM) server for log aggregation.
• All Windows event code messages and logs (local and remote users) must be sent to the organization’s syslog or SIEM server for log aggregation.
• System administrators shall have proper separation of duties providing a hierarchical privileged access to the network, systems, and applications and different functions.

NONCOMPLIANCE OR POLICY VIOLATIONS

Noncompliance with this policy definition will be monitored, tracked, and handled by the Human Resources department, the employee’s department head, and the Information Technology department.

All employees, authorized users, and authorized third parties that are in violation of this policy will be required to work with the Human Resources department and Information Technology department to remediate.

This remediation effort may include review of policies and procedures, retaking the security awareness training course, and/or other disciplinary actions.

REVISIONS

This policy shall define acceptable use of the organization’s IT assets, Internet, email, systems, applications, and data. This policy shall also define unacceptable use.

The scope of this enterprise-wide policy encompasses the entire organization and all employees, authorized users, and authorized third parties who are granted access controls to the IT infrastructure.

All employees, contractors, and authorized third parties that are provided with a login ID and password must comply with this acceptable use policy. This policy mandates that all employees, contractors, and authorized third parties take special precautions as they pertain to the access, use, handling, storage, and transmission of sensitive data as part of normal day-to-day operations and business functions.

DEFINITIONS

Cipher-text—Data that cannot be seen or comprehended given that it is encrypted or scrambled and is unreadable.

Clear-text—Data that can be seen and comprehended given that it is displayed “as is.”

Encryption—Utilizes a cryptographic algorithm to encode messages or information in a way that only authorized recipients can decode the message or information.

Information security—The tenets of information security include confidentiality, integrity, and availability. Information security, as a whole, is the responsibility of all employees and authorized users of the organization’s network, systems, applications, and data.

Sensitive data—Data that is under a regulatory compliance law or is sensitive as defined by the organization.

ACCEPTABLE USE POLICY

POLICY

All authorized users (employees, contractors, or authorized third parties) that require access to the organization’s IT assets, systems, applications, and data must read, acknowledge, and sign this Acceptable Use Policy prior to being granted login credentials.

More importantly, this policy shall define what is acceptable use and what is unacceptable use of the organization’s owned IT systems, applications, and data.

ACCEPTABLE USE

• Be aware and be accountable for your own actions when using organization-owned IT assets, especially when sensitive data is accessed or transmitted.
• Use provided computer equipment, hardware, and software applications, including use of the public Internet, to do your job functions and tasks only. Limited and reasonable use of computer equipment and networks for personal reasons is acceptable only if it does not result in any additional costs, loss of work time, or abuse to organization-owned IT assets and resources.
• Protect your user ID, password, and computer from unauthorized use. You are responsible for all activities on your user ID or that originate from your computer.
• Ensure that no sensitive data is screen captured or cut and pasted into separate or stand-alone documents, or saved to unapproved data storage devices such as CDs, DVDs, or USB thumb drives. External storage media, such as a CD, DVD, or USB thumb drive, must use encrypted/password protected files or have encryption enabled on the media device itself.
• Use only legal versions of copyrighted software that meets vendor license requirements as authorized by the Information Technology department.
• Be aware of where you put sensitive data if on shared resources. These resources include server disk storage space, shared LAN drives, and other data repositories.
• Use the Internet and electronic mail for business purposes only.
• Exercise caution when opening emails or attachments, clicking on imbedded URL links in emails, or clicking on email attachments. Do NOT open anything from an email address that is not familiar. Contact the Information Technology department if you are uncertain about the authenticity of a suspicious email that you receive.
• If you receive junk text messages, junk emails, or spam email marketing messages, contact the Information Technology department to assist with your email spam filter and eliminating the receipt of unnecessary email messages in your inbox.
• Only use devices that have been approved by the organization for business functions. This includes workstations, laptops, tablets, smartphones, and encrypted USB thumb drives or external drives. If you are unsure as to whether a device is approved or not, please request the Information Technology department to check if the equipment in question is located on the list of company-approved products.

UNACCEPTABLE USE

• Any violation of local, state, or federal laws or regulations and organization policies, including but not limited to inappropriate uses discussed herein, is considered unacceptable use. Users in violation of this may result in immediate loss of use and access privileges, disciplinary action, or termination of employment.
• Do not use the same password for two or more accounts and do not use personal passwords as business passwords (or vice versa).
• Do not reuse passwords.
• Do not store passwords on paper or in any file near or around your workspace area unencrypted—memorize or use a secure password management tool.
• Do not use your computer, the Internet, email, or social media (Facebook, YouTube, Instagram, Twitter, etc.) in a manner that would reflect adversely on the organization. This includes activities like storing or transmitting pornography, accessing pornography websites, sending chain email messages, sending unofficial advertising, soliciting or selling via email, and other uses that are incompatible with public service. Material that is fraudulent, harassing, embarrassing, sexually explicit, profane, obscene, intimidating, defamatory, or otherwise unlawful or inappropriate may not be sent by email or other form of electronic communication (such as bulletin board systems, newsgroups, or chat groups) or displayed on or stored in the organization’s computers.
• The organization does not permit access to external webmail such as Hotmail, Gmail, or Yahoo Mail for personal use.
• Do not do things that could harm the organization’s computers or networks or that could damage or destroy information stored on the network. This includes spreading malicious software such as a computer virus, malware, ransomware, or other attack.
• Do not install any personally owned hardware or software to any organization-owned workstation, laptop, printer, server, or any other type of IT equipment without advance notification and approval from the Information Technology department. This includes use of external USB thumb drives that are not provided by the organization’s Information Technology department.
• Do not do anything that could violate software licensing or copyright laws. This includes:

  (1) Providing copies of software to anyone else

  (2) Installing software on organization-owned computer equipment without notifying and getting advance approval of the Information Technology department

  (3) Downloading software from the Internet without advance approval from the Information Technology department

  (4) Modifying or altering installed software without advance approval from the Information Technology department

• Sensitive data must never be sent through clear-text using email or another messaging application. If sensitive data must be transmitted, encryption must be used to transmit the data.
• Do not circumvent security measures or the policies or procedures documented by the organization.

NONCOMPLIANCE OR POLICY VIOLATIONS

Noncompliance with this policy will be monitored, tracked, and handled by the organization’s Human Resource department and Information Technology department.

Any employees or authorized users that are in violation of this policy will be required to work with the Human Resources department for remediation.

This remediation effort may include review of the organization’s policies, retake of the security awareness training course, or other disciplinary actions.

ACKNOWLEDGEMENT

I have read, reviewed, and acknowledge that I understand this Acceptable Use Policy as it pertains to my job responsibilities and tasks.

Employee/User:

Name

Signature

Title

Date

Human Resources:

Name

Signature

Title

Date

Supervisor/Manager:

Name

Signature

Title

Date