Company IT policy

Introduction

This is a very brief summary and should only be used as the basis for a fuller policy, customised to your own specific requirements.

This policy sets out the obligations and expectations on employees of the Company including contractors and temporary staff, who use the Company’s IT facilities for internet and email purposes. It is important that IT facilities are used responsibly, are not abused, and that staff understand the legal professional and ethical obligations that apply to them.

Authorisation

No person is allowed to use Company IT facilities who has not previously been authorised to do so by the Company IT Department / Line Manager. Unauthorised access to IT facilities is prohibited and may result in either disciplinary action or criminal prosecution.

Legislation

All users shall comply with the relevant legislation. This includes the following:

Data Protection Act 1998/Freedom of Information Act 2000.

Any information which the Company holds is potentially disclosable to a requester under one of these pieces of legislation. This includes emails too.

Users need to be sure that they are not breaching any data protection when they write and send emails. This could include but is not limited to:

Passing on personal information about an individual or third party without their consent.

Keeping personal information longer than necessary.

Sending personal information to a country outside the EEA.

Email should where possible be avoided when transmitting personal data about a third party. Any email containing personal information about an individual may be liable to disclosure to that individual under the Data Protection Act 1998. This includes comment and opinion, as well as factual information. Therefore this should be borne in mind when writing emails, and when keeping them.

Computer Misuse Act 1990

This Act makes it an offence to try and access any computer system for which authorisation has not been given.

Copyright Design and Patents Act 1988

Under this Act it is an offence to copy software without the permission of the owner of the copyright.

Defamation Act 1996

Under this Act it is an offence to publish untrue statements which adversely affect the reputation of a person or group of persons.

Terrorism Act 2006

This Act has makes it a criminal offence to encourage terrorism and/or disseminate terrorist publications.

Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000.

This allows for any organisation to monitor or record communications (telephone, internet, email, and fax) for defined business specific purposes.

Responsibilities

All Users are expected to act in a manner that will not cause damage to IT facilities or disrupt IT services. Any accidental damage or disruption must be reported to IT / Line Manager as soon as possible after the incident has occurred. Users are responsible for any IT activity which is initiated under their username.

Use of the internet

Use of the Internet by employees is encouraged where such use is consistent with their work and with the goals and objectives of the Company in mind. Reasonable personal use is permissible subject to the following:

Users must not participate in any online activities that are likely to bring the Company into disrepute, create or transmit material that might be defamatory or incur liability on the part of the Company, or adversely impact on the image of the Company.

Users must not visit, view or download any material from an internet site which contains illegal or inappropriate material. This includes, but is not limited to, pornography (including child pornography), obscene matter, race hate material, violence condoning messages, criminal kills, terrorism, cults, gambling and illegal drugs.

Users must not knowingly introduce any form of computer virus into the Company’s computer network.

Personal use of the internet must not cause an increase for significant resource demand, e.g. storage, capacity, speed or degrade system performance.

Users must not “hack into” unauthorised areas.

Users must not download commercial software or any copyrighted materials belonging to third parties, unless such downloads are covered or permitted under a commercial agreement or other such licence.

Users must not use the internet for personal financial gain.

Users must not use the Internet for illegal or criminal activities, such as, but not limited to, software and music piracy, terrorism, fraud, or the sale of illegal drugs.

Users must not use the internet to send offensive or harassing material to other users.

Use of the internet for personal reasons (e.g. online banking, shopping, information surfing) must be limited, reasonable and done only during non-work time such as lunchtime.

Use of gambling sites, online auction sites and social networking sites such as, but not limited to, Facebook, LinkedIn, Youtube, Twitter, Bebo, Flickr, MySpace etc is not permissible.

Staff may face disciplinary action or other sanctions (see below) if they breach this policy and/or bring embarrassment on the Company or bring it into disrepute.

Good practice

The Company has good practice guidelines for dealing with email when staff are out of the office for longer than three days. When activating the “out of office” facility messages should name an alternative member of staff for correspondents to contact if necessary. This will ensure that any important messages are picked up and dealt with within required timescales.

During periods of absence when highly important emails are anticipated, the employee (or manager) should make arrangements for notification and access By another appropriate member of staff.

Where sensitive and confidential information needs to be sent via email for practical reasons, please be aware that email is essentially a non-confidential means of communication. Emails can easily be forwarded or archived without the original sender’s knowledge. They may be read by persons other than those they are intended for.

Users must exercise due care when writing emails to avoid being rude or unnecessarily terse. Emails sent from the Company may be interpreted by others as Company statements. Users are responsible for ensuring that their content and tone is appropriate.

Emails often need to be as formal and businesslike as other forms of written correspondence.

Users should delete all personal emails and attachments when they have been read and should also delete all unsolicited junk mail. In the process of archiving emails, users should ensure inappropriate material is not archived.

The Company provides a current and up to date automatic virus checker on all networked computers. However, caution should be used when opening any attachments or emails from unknown senders. Users must best endeavour to ensure that any file downloaded from the internet is done so from a reliable source. It is a disciplinary offence to disable the virus checker. Any concerns about external emails, including files containing attachments, should be discussed with the IT / Line Manager.

Legitimate access to prohibited material

There may be circumstances where Users feels that the nature of their work means that they are required to access or use material prohibited under this policy. If so, this should be discussed with the Line Manager concerned. The Company is legally responsible for the content and nature of all materials stored on/accessed from its network.

Remote users

Users may sometimes need to use Company equipment and access the Company network while working remotely, whether from home or while travelling. The standards set out in this document apply whether or not Company equipment and resources are being used.

Monitoring

All resources of the Company, including computers, email, and voicemail are provided for legitimate use. If there are occasions where it is deemed necessary to examine data beyond that of the normal business activity of the Company then, at any time and without prior notice, the Company maintains the right to examine any systems and inspect and review all data recorded in those systems. This will be undertaken by authorised staff only.

Any information stored on a computer, whether the information is contained on a hard drive, USB pen or in any other manner may be subject to scrutiny by the Company. This examination helps ensure compliance with internal policies and the law. It supports the performance of internal investigations and assists in the management of information systems.

Penalties for improper use

Withdrawal of facilities

Users in breach of these regulations may have access to Company IT facilities restricted or withdrawn.

Disciplinary action

Breaches of these regulations may be dealt with under the Company’s disciplinary procedures. It may lead to termination of employment from the Company.

Breaches of the law

Where appropriate, breaches of the law will be reported to the police.

Updating this document

This document may need to be updated by the time you read this.

We would be grateful if you could offer any additional information.