DATA PROTECTION
User Access Records:
User access records must be available and accurate at all times detailing which
employees have access to each of our systems and the specific information they are
able to view/edit. Records should include all needed information for the specific
system/information being accessed.
User Access Administrators:
Only specific team members can grant/revoke system and user access, determined
by their roles and responsibilities. The number of employees with this ability is
limited and determined by skill set, job requirements, and business needs.
User Access Administrators cannot complete audits and review of user access for
systems and information they grant access. Whenever possible, someone other than
themselves should update their own profiles/user access, but it is understood that
in some circumstances, this cannot be prevented. When this occurs, User Access
Administrators making changes to their own profiles/access levels/information,
must have a manager sign-off prior to completing changes and once completed, the
changes must be verified for accuracy.
DATA / INFORMATION PROTECTION
Screen Lock/Privacy Screens:
Employees must never leave their computer unattended with information in view
and/or being logged into software. Employees should lock their computer screen
when they are away from it, regardless of the duration.
If needed, privacy screens should be utilized to prevent others from seeing
unauthorized information.
Accessing Systems/Information Through Networks (Wi-Fi) and Devices:
Company information and systems are the property of the company and covered by
company policies regardless of how, when, and where they are accessed.
Whenever possible, company information and systems should be accessed through
secure company networks/Wi-fi, and company issued devices. However, it is
understood employees/ system users may access company information and systems
utilizing personal devices as well as outside company networks/Wi-Fi.