This policy ensures that BrandLock’s IT resources efficiently serve primary business functions, provide security for electronic data, and comply with all applicable regulations. It covers 30 policy domains from acceptable use to BYOD.
All computer equipment, peripherals, and software are BrandLock property provided for business purposes. This policy supersedes all previous IT policies of BrandLock LLC.
Disciplinary Action: Violation may result in termination, loss of access privileges, and civil/criminal prosecution.
Review: Board of Directors, COO, and IT staff review at least annually. All staff must review and accept annually.
Outlines acceptable use of computer equipment. Applies to all employees, volunteers, directors, contractors, consultants, temporaries, and third-party affiliates.
All electronic files on BrandLock equipment are BrandLock property and not private. IT may access at any time. Access requests must be authorized by departmental supervisors.
Limited personal use permitted if it doesn’t interfere with duties or result in costs. All files remain BrandLock property.
All staff sign Acceptable Use receipt upon starting. Retained by IT management.
Least privilege principle enforced. No single user can authorize, perform, review, and audit a single transaction. Monthly review: 30 days inactive → notification; 45 days → disablement. Independent audit reviews may occur at any time.
Covers laptops, notebooks, tablets, smartphones, and any BrandLock-owned device on unmanaged networks.
Audit trails track all device activity. Access monitored without notice. Enterprise-sanctioned data removal on device retirement. Unsafe mobile device use (texting while driving) prohibited. Users sign Mobile Device Agreement (Exhibit A) before access.
Prevents exposure of confidential data to unauthorized individuals. Applies to: day planners, file cabinets, briefcases, confidential reports/lists/statements, electronic devices, keys, printouts on printers/copiers/fax machines, portable media (CDs, flash drives), workstations, desks, and white boards.
Covers all electronic financial services: website, email, web account access, fund transfers, online applications, bill paying, mobile banking.
Suspected unauthorized access reported to regulatory and law enforcement per incident response procedures.
All confidential material outside BrandLock network must be encrypted. Never email SSNs, account numbers, PINs, DOBs externally without encryption. No non-BrandLock email (Hotmail, Yahoo, AOL) for business.
36-month retention. Older emails, deleted/archived items, appointments/tasks/notes beyond retention auto-purged.
Access control between trusted/untrusted networks, traffic blocking per ruleset, hiding internal systems, logging, robust authentication, and VPN connectivity.
Packet filtering (by address/port/protocol), application proxy (every packet examined), stateful inspection (monitors active connections). Protects against IP spoofing, DoS attacks, and information disclosure.
Covers: computers, printers, handheld devices, servers, networking equipment, floppy disks, backup tapes, CDs/DVDs, hard drives, flash memory, and all portable storage.
All disposition centrally managed by IT: data backup, tag removal, approved external agents for sanitization/recycling/destruction, chain of custody documentation per legal and environmental regulations. Where assets haven’t reached end of life, residual value pursued through reselling, auctioning, or donating.
Annual simulated incidents test response. Results documented and shared. Plans updated for lessons learned and industry developments. Team members trained annually.
All purchases with BrandLock funds are company property. All requests submitted to IT via Service Desk.
Equipment >$300 with semi-permanent assignment tracked via Asset Management Program (identification, assignment, tracking, lifecycle, reporting, disposition). Annual hardware replenishment review.
Unauthorized remote access, software piracy, illegal activities, transmitting threatening/obscene materials. No downloading/installing software without IT authorization. No deliberate malware propagation.
Sexually explicit/inappropriate sites blocked; display/storage prohibited. Excessive Internet use, games, streaming restricted. Personal use limited to break room PCs. All sensitive transmissions must be encrypted.
Critical for forensics analysis and detecting compromise indicators. Periodic risk assessments determine capture scope.
All components use NTP for time synchronization enabling cross-source correlation.
Baseline behavior tracked over time to detect anomalies. Retention balances privacy, investigation needs, and cost. Thresholds define response levels. Centralized log management infrastructure provides common record management.
Ensures NCUA Part 748 compliance. Protects confidentiality, security, and integrity of member non-public personal information.
Regular security training via meetings and tutorials. Employees trained to recognize/report unauthorized access attempts. New employees receive security orientation. Annual audit by Information Security Officer.
Only IT-waivered systems access BrandLock networks. All APs/base stations registered. SSID must not contain identifying info.
Exhibit A: VPN Agreement — signed by each user before access.
Governs personally-owned laptops, tablets, smartphones for corporate data access. Access is a privilege, not a right.
Centrally manage BYOD program: onboarding, monitoring, terminating on separation. IT can install anti-virus, restrict apps, limit network resources, wipe data on loss/termination, and inspect all devices on unmanaged networks.
Must maintain current anti-virus/anti-malware. Signed Third Party Agreement required (VP approval). IT can provide cellular hot spot if needed.
Fixed monthly reimbursement may be offered per Mobile Device Procedure. Users personally liable for device and carrier costs beyond reimbursement.
Exhibit A: BYOD Agreement — signed before enrollment.
Passwords are the front line of protection. A poorly chosen password may compromise BrandLock’s entire corporate network.
Required to mitigate risk to confidential data and system integrity. Applies to all equipment owned or leased by BrandLock — servers, desktops, routers, switches, and all electronic devices.
Covers all BrandLock facilities housing information systems: data centers, data rooms, switch/wiring closets.
Ensures BrandLock makes appropriate cloud adoption decisions. Covers public cloud, private cloud, and hybrid models.
Establishes standards for base configuration of internal server equipment owned and/or operated by BrandLock.
Establishes guidelines for safe social media usage, protecting BrandLock information while leveraging social media for business.
Determines when security failures or breaches have occurred. Monitoring detects in real-time; auditing detects after the fact.
Establishes standards for periodic vulnerability assessments across all computer and communication devices on BrandLock premises. Denial of Service testing is not performed.
Governs the development, maintenance, and security of BrandLock’s public-facing web properties.
Ensures all workstations are provisioned and operated per company-defined security standards. VP of IT has overall responsibility for confidentiality, integrity, and availability of BrandLock data.
Establishes server virtualization requirements for acquisition, use, and management. Encompasses all new and existing workloads.
Secures and protects BrandLock information assets when connecting to Wi-Fi networks — both corporate and public.
Covers employees who regularly perform work from a remote office. Arrangements are case-by-case, focusing on business needs.
Exhibits A & B: Telecommuting Equipment Agreement and Telecommuting Equipment Inventory — signed before start.
Establishes a defined IoT structure to ensure data and operations are properly secured. IoT devices include appliances, thermostats, monitors, sensors, and portable items that measure, store, and transmit information.
Addendum A: IoT Device Usage Request Form — submitted to IT before device deployment.