Is this policy enough? 2

[Albion]

This is our Internet and Computer acceptable use policy. The powers that be seem to think it is enough to cover the company under all circumstances. I on the other hand, after looking at sample policies on the internet, am starting to wonder why other companies have policies which are pages and pages long. Can you read my policy and let me know what you think? This way I can produce some evidence from people in the field to show the powers that be why we should keep or revamp the current policy. Any suggestions would be appreciated.


--
Our e-mail, computer and Internet systems are company property. These systems are in place to facilitate your ability to do your job efficiently and productively to that end, these systems are solely for business purposes, and any personal use is prohibited. We may intercept, monitor, copy, review and download any communications or files you create or maintain on these systems. These guidelines MUST be followed.

1: When using the Internet, confidential material must be properly encrypted to prevent interception by third parties.
2: E-mail messages may not reveal trade secrets, proprietary financial information, or infringe upon copyrighted materials.
3: All user passwords must be disclosed to the company. This includes logon and encryption passwords.

Your communications and use of our e-mail, computer and Internet systems will be held to the same standard as all other business communications. This includes compliance with our anti-discrimination and anti-harassment policies. We expect you to use good judgment in your use of our company’s system. [User name here] should be notified of unsolicited, offensive materials received by any employee on any of these systems.

Failure to abide by these rules or consent to any interception, monitoring, copying, reviewing and downloading of any communications or files is grounds for discipline, up to and including termination.
--

-cm

 

[Kjonnnn]

I dont think this has to do with "trustworthy" employees. But mispat, if you even wish to punish "the bad" employees, it is in your best interest to have a written policy so that the rules are objectively seen BEFORE such an infraction, and by which you cant point to and said you violated this in the company policy. In an employment situation, u open yourself up to lawsuits without having written policy when u want to discipline or termination someone..

 

[dwmatteson]

In my environment (medium sized not-for-profit organization), I prefer to let users have unrestricted use of the Internet as long as they use it responsibly. When I have evidence of that trust being abused, away go the Internet privileges.

Assuming that you prefer to restrict Internet access, you could take care of many of these problems with a well-configured firewall and/or content filtering software (e.g., SurfControl).

With the firewall you could:
* block outgoing Internet traffic from all but a few static IP addresses (assign these static addresses to those who absolutely require Internet access, as NinaToo suggests).
* block the ports for streaming audio/video applications.
* block traffic from outside addresses that have been particularly troublesome in the past.

The content filtering software would let you:
* allow access to the Internet but block sites that you've defined as unacceptable.
* monitor traffic and determine who's abusing (this is a little Big Brother for me; I just walk around and pay attention).

You could go further of course, but those are just some ideas. Solutions like that would take a lot of worry off your shoulders, enabling you to do the rest of your job!

Of course, you have a responsibility to users (and your tech staff!) to let people know about these restrictions/measures so that people know you're serious and that you can actually enforce your policy. A policy that you can't implement and enforce is sort of like having a watch-hamster protecting your house. Not gonna happen.

Don

 

[visualuser]

I didn't read all the messages on this topic, but this might be a suggestion. Our company put a &quot;Windows Warning&quot; in the registry where when your pc boots, you have to click <OK> at the message. We put a lot of info about the pc being company info and pretty much gave a few rules. They see if every time the pc boots and they click ok. They know the rules now!

That's just a suggestion.....