Acceptable Use Policy
Purpose and scope
This policy sets the rules for using RODMENA's information, systems and devices, and the information customers entrust to us. It applies to everyone who works for or with the company, on every system we operate. It works alongside our Information Security Policy and our Data Protection Policy.
Information
Use company and customer information only for the work you were given it for. Customer data is always confidential. Do not copy it to personal accounts, personal storage or any service the company has not approved, and keep it in the company's own apps.
Systems and accounts
Each account belongs to one named person. Never share your credentials, and keep multi-factor authentication switched on for every key account. If you hold administrator rights, use them only for the task they were granted for.
Devices
Work devices use full-disk encryption and lock the screen automatically. A personal phone or computer may be used for company work only if it has a screen lock, current updates and full-disk encryption, and the company accounts on it use multi-factor authentication. Do not work over public or open Wi-Fi unless the traffic is protected, for example by your phone's own hotspot. Report a lost or stolen device to the Director at once.
Email and messaging
Use the company's email and messaging accounts for company work. Check where a link goes before you open it, and do not open an attachment you did not expect. Send customer data only to the people the work requires, and only through a channel the customer has agreed.
Internet and software
Install only software that the work needs, from its official source. Do not use company systems for anything unlawful, offensive or harmful to the company or its customers.
Reporting
Report a suspected weakness, breach or misuse to the Director and to security@rodmena.co.uk at once. Nobody will ever be penalised for a report made in good faith.
Responsibilities
The Director owns this policy and reviews it at least once a year. Anyone who breaks it may lose access to company systems, and serious breaches are dealt with under their contract.