Policy 7230A - Department of Administration

11. Personnel Security
These Personnel Security Mandatory Procedures support the Enterprise Security Policy
(ITEC 7230 Rev 1), and the Acceptable Internet Use Policy (ITEC 1200).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
11. Personnel Security
11.1. Acceptable Usage
11.1.1. Establish Acceptable Usage Baselines (6 sets) (6 sets)
11.2. Personnel Operations
11.2.1. Establish Pre-Hiring Processes (4 sets) (3 sets)
11.2.2. Hire Employees in a Structured Fashion (3 sets) (1 set)
11.2.3. Transfer Employees in a Structure Fashion (4 sets) (2 sets)
11.2.4. Terminate Employees in a Structured Fashion (3 sets) (1 set)
11.3. Maintain Records
11.1. Acceptable Usage
The following are the Mandatory Procedures that support the Acceptable Usage
section of the Default Security Requirements:
11.1.1. Establish Acceptable Usage Baselines
Acceptable Usage Baselines define what qualifies as appropriate and
inappropriate behaviors during the course of day to day operations:
11.1.1.1 Internet and e-Mail Usage
Internet and e-mail usage must be restricted as both activities make
use of public and unsecured networks.
11.1.1.2 System and Computer Usage
Systems and system components are the property of the
organization.
11.1.1.3 Software and Data Usage
The software the organization provides and the data it creates and/or
manipulates is the property of the organization.
11.1.1.4 Telephone Usage
The telephone system, including all telephones and fax machines, is
the property of the organization.
11.1.1.5 Materials Usage
The office materials, supplies, etc. are the property of the
organization and are to be used for business purposes only.
11.1.1.6 Sanctions
Violation of any of the constraints of the security policies or
procedures will be considered a security breach and depending on
the nature of the violation, various sanctions will be taken.
26