Users Accessing Company Data
Overview
An overview of steps detailing the best way of accessing the company’s data.
Purpose
The purpose is to keep the company’s data as safe as possible. This is a list of steps that will ensure the company’s data does not fall into competitors or malicious hands.
Scope
The scope includes any authorized employee of the company. Once an employee has been entered in the system, they will receive a valid log on and temporary password to the company’s network.

Policy 4.1 After an employee has received a new temporary password they are required to log on to the system within 48 hours and set up their own secure password. 4.2 The password must have at least 10 characters and include at least one special character (!@#$%^&*?) 4.3 Passwords will be required to be changed every 90 days. 4.4 Do not write down your passwords so they are visible to others. (ie leaving a sticky note on desk) 4.5 You may only use a company assigned computing device to access the company’s network while working remotely. 4.6 When connecting to the company’s network you are required to use the company’s VPN software so the traffic is encrypted. 4.7 NEVER share data with anyone outside of the company unless authorized by a manger.

Policy Compliance 5.1 The company will ensure your compliance by requiring a password change every 90 days or if the password you selected is considered not strong enough.

5.2 A datasharing exception needs to be discussed with your manager. An example of this would be if your team is working with a 3rd party or contractor on a company project.

5.3 If it is found that you are responsible for sharing or leaking data you can be terminated.

5 Related Standards, Policies and Processes
6.1.1 Obtain login ID and initial password from HR, you will be required to log in and change it within 48 hours from your assigned computer device.
6.1.2 If password is forgotten, contact HR by phone 414-444-4444 or email HR@ITcomapny.com
6.1.3 You are required to recertify yourself on the policies every calendar year, HR will contact you.
6.2 If sitting in an isle walkway or high trafficked area use a screen guard.
6.3 Make a best effort to avoid free wi-fi connection locations such as coffee house.

6 Definitions and Terms
7.1 Datasharing – Knowingly or Un- knowingly sharing of company data with non-employees

7 Revision History * Date of Change | * Responsible | * Summary of Change | * Creation 3/2/2015 | * User accessing data | * Summary of responsible user of company data | * | * | * |

Using the SANS policy format of the 8 sections (see link in this folder or last week's folder), create your own policy based on the following: 1. Use the attached template and re-attach to this assignment. 2. Choose one of the 7 Domains of IT Responsibility 3. Choose a specific topic or technology within that Domain 4. Create all the sections that you find in a SANS policy with entries for each section. 5. Make up your own (but real) topic. DO NOT use one of the example SANS policy topics. 6. Flesh out your #4 Policy section with your own ideas of what should be here. 7. Under #5 Compliance, use the same three typical entries for 5.1, 5.2, and 5.3 8. Support your policy with a procedure with a minimum of 5 steps (place this in section 6) 9. Support your policy with at least two guidelines (place this in section 6)