Acceptable Usage Policy - Portals
Icanio provides computer devices, networks, and other electronic information systems to meet missions, goals, and initiatives and must manage them responsibly to maintain the confidentiality, integrity, and availability of its information assets. This policy requires the users of information assets to comply with company policies and protects the company against damaging legal issues.
Anyone breaching the information security policy may be subject to disciplinary action. If a criminal offence has been committed, further action may be taken to assist in the prosecution of the offender(s). If you do not understand the implications of this policy or how it may apply to you, please seek advice from your immediate manager in the first instance.
- All staff members working for Icanio, who have access to the organization's and/or client’s information.
- This policy applies to the physical security of the company’s information systems, including, but not limited to, all company-owned or company-provided network devices, servers, personal computers, mobile devices, and storage media.
- Additionally, any person working in or visiting the company’s office is covered by this policy.
- All staff members, vendors, and third-party employees who have access to Icanio’ information processing systems and the data contained in them. This includes the data accessed by licensed third parties, which is, in turn, deployed to and used by their clients.
- All stakeholders and interested parties who are relevant to the operations of Icanio.
- All digital and non-digital assets that play a role in the creation, storage, transmission, and disposal of information come under the purview of this policy.
The Chief Information Security Officer (CISO) and the Information Security Steering Committee (ISSC) members are responsible for defining the organization’s vision and objectives related to information security and for enforcing this policy.
The ISO is a part of the Information Security Steering Committee (ISSC) and is responsible to ensure that the policy is communicated to all stakeholders and implemented within the organization.
- Usage does not negatively impact the corporate computer network.
- Usage does not negatively impact the user’s job performance.
- The following is never permitted: spamming, harassment, communicating threats, solicitations, chain letters, or pyramid schemes. This list is not exhaustive but is included to provide a frame of reference for types of activities that are prohibited.
- The user is prohibited from forging email header information or attempting to impersonate another person.
- Email is an insecure method of communication, and thus information that is considered confidential or proprietary to the company may not be sent via email.
- It is company policy not to open email attachments from unknown senders, or when such attachments are unexpected.
- Email systems were not designed to transfer large files and as such emails should not contain attachments of excessive file size.
- Does not include posting or sharing of non-business-related information messages to large numbers of users through Icanio Network.
- Posting to a public newsgroup, bulletin board etc. with an ICANIO email or IP address representing Icanio to the public is not permitted.
Confidential data must not be:
- Shared or disclosed in any manner to non-employees of the company.
- Should not be posted on the internet or any publicly accessible systems.
- Should not be transferred in any insecure manner.
Please note that this is only a brief overview of how to handle confidential information and that other policies may refer to the proper use of this information in more detail.
The user should make reasonable efforts to avoid accessing network data, files, and information that are not directly related to his or her job function. The existence of access capabilities does not imply permission to use this access.
The following actions shall constitute unacceptable use of the corporate network:
This list is not exhaustive but is included to provide a frame of reference for types of activities that are deemed unacceptable.
The user may not use the corporate network and/or systems to:
- Engage in activity that is illegal under local, state, federal, or international law.
- Engage in any activities that may cause embarrassment, loss of reputation, or other harm to the company.
- Disseminate defamatory, discriminatory, vilifying, sexist, racist, abusive, rude, annoying, insulting, threatening, obscene, or otherwise inappropriate messages or media.
- Engage in activities that cause an invasion of privacy.
- Engage in activities that cause disruption to the workplace environment or create a hostile workplace. Make fraudulent offers for products or services.
- Perform any of the following: port scanning, security scanning, network sniffing, keystroke logging, or other IT information gathering techniques when not part of an employee’s job function.
- Install or distribute unlicensed or “pirated” software.
- Reveal personal or network passwords to others, including family, friends, or other members of the household when working from home or remote locations.
Blogging and social networking are not allowed from the corporate computer network or corporate provided endpoints / devices. No information detrimental to the company or confidential data / identifiers are to be published anywhere unless specified and approved by the Icanio Management.
The user must not identify himself or herself as an employee of the company in a blog or on a social networking site done personally. The user assumes all risks associated with blogging and/or social networking.
Actions detrimental to the computer network or other corporate resources, or that negatively affect job performance are not permitted.
The Internet is a network of interconnected computers of which the company has very little control. The user should recognize this when using the Internet and understand that it is a public domain and he or she can come into contact with information, even inadvertently, that he or she may find offensive, sexually explicit, or inappropriate. The user must use the Internet at his or her own risk. The company is specifically not responsible for any information that the user views, reads, or downloads from the Internet.
Personal Use. The company recognizes that the Internet can be a tool that is useful for both personal and professional purposes. Personal usage of company computer systems to access the Internet is permitted as long as such usage follows pertinent guidelines elsewhere in this document and does not have a detrimental effect on the company or the user’s job performance.
The company’s computer systems and networks must not be used to download, upload, or otherwise handle illegal and/or unauthorized copyrighted content. Any of the following activities constitute violations of acceptable use policy, if done without permission of the copyright owner:
- Copying and sharing images, music, movies, or other copyrighted material using P2P file-sharing or unlicensed CDs and DVDs.
- Posting or plagiarizing copyrighted material; and
- Downloading copyrighted files that the employee has not already legally procured.
This list is not meant to be exhaustive; copyright law applies to a wide variety of works and applies to much more than is listed above.
Peer-to-Peer (P2P) networking is not allowed on the corporate network under any circumstances.
Streaming media can use a lot of network resources and thus must be used carefully. Reasonable use of streaming media is permitted as long as it is for only official purposes and does not negatively impact the computer network or the user’s job performance.
Users should expect no privacy when using the corporate network or company resources. Such use may include but is not limited to the transmission and storage of files, data, and messages. The company reserves the right to monitor all use of the computer network. To ensure compliance with company policies this may include the interception and review of any emails, or other messages sent or received, an inspection of data stored on personal file directories, hard disks, and removable media.
Excessive use of company bandwidth or other computer resources is not permitted. Large file downloads or other bandwidth-intensive tasks that may degrade network capacity or performance must be performed during times of low company-wide usage.
Personal usage of company computer systems is permitted as long as such usage follows pertinent guidelines elsewhere in this document and does not have a detrimental effect on the company or the user’s job performance.
Use of remote desktop software and/or services is allowable as long as it is provided by the company. Remote access to the network must conform to the company’s defined Policies.
Using company-owned or company-provided computer systems to circumvent any security systems, authentication systems, user-based systems, or escalating privileges is expressly prohibited. Knowingly taking any actions to bypass or circumvent security is expressly prohibited.
No company-owned or company-provided computer systems may be knowingly used for activities that are considered illegal under local, state, federal, or international law. Such actions may include, but are not limited to, the following:
- Unauthorized Port Scanning.
- Unauthorized Network Hacking.
- Unauthorized Packet Sniffing.
- Unauthorized Packet Spoofing.
- Unauthorized Denial of Service.
- Unauthorized Wireless Hacking.
- Any act that may be considered an attempt to gain unauthorized access to or escalate privileges on a computer or other electronic system.
- Acts of Terrorism Identity Theft.
- Spying.
- Downloading, storing, or distributing violent, perverse, obscene, lewd, or offensive material as deemed by applicable statutes.
- Downloading, storing, or distributing copyrighted material.
Icanio will take all necessary steps to report and prosecute any violations of this policy.
Non-company-provided equipment is expressly prohibited on the company’s network.
Personal storage devices represent a serious threat to data security and are expressly prohibited on the company’s network.
No non-company-supplied software is to be installed without written permission from the IT Manager. Numerous security threats can masquerade as innocuous software - malware, spyware, and Trojans can all be installed inadvertently through games or other programs. Alternatively, the software can cause conflicts or have a negative impact on system performance. For these reasons, the installation of non-company-supplied programs is strongly discouraged. If a certain program is required for his or her job function, the user should contact the IT Department to request permission.
If a security incident or breach of any security policies is discovered or suspected, the user must immediately notify his or her supervisor and/or follow any applicable guidelines as detailed in the Incident Response Policy.
Examples of incidents that require notification include:
- Suspected compromise of login credentials (username, password, etc.). Suspected virus/ malware/ Trojan infection.
- Loss or theft of any device that contains company information. Loss or theft of ID badge or keycard.
- Any attempt by any person to obtain a user’s password over the telephone or by email. Any other suspicious event that may impact the company’s information security.
Users must not withhold information relating to a security incident or interfere with an investigation.
This document is part of the company’s cohesive set of security policies. Other policies may apply to the topics covered in this document and as such the applicable policies should be reviewed as needed.
This policy will be enforced by the ISMS Manager and/or IT Team. Violations may result in disciplinary action, which may include suspension, restriction of access, or more severe penalties up to and including termination of employment. Where illegal activities or theft of company property (physical or intellectual) are suspected, the company may report such activities to the applicable authorities.
- The compliance with this policy and supporting policies shall be audited on a yearly basis; exceptions identified during the audit shall be immediately and appropriately addressed.
- This policy shall be reviewed annually unless there is a major change in the organization or the environment affecting the organization, in which case it shall be done on a need basis.
- This policy shall be reviewed and revised whenever a major security risk or an incident is identified.
ISO 27001:2022
5.10 Acceptable Use Policy1.0
01.10.2024
Green IT Ventures
Initial release |
Jebastin Prabhaharan |
CEO
This is to confirm that I have read and understood the above mentioned policy.
Click here to fill the acknowledgement form.