Sample IT Purchasing Policy Template

It is the responsibility of any employee or Board Member of {COMPANY-NAME}, who uses a {COMPANY-NAME} owned mobile device to access corporate resources, to ensure that all security protocols normally used in the management of data on conventional storage infrastructure are also applied here.

It is imperative that any {COMPANY-NAME} owned mobile device that is used to conduct {COMPANY-NAME} business be utilized appropriately, responsibly, and ethically. Failure to do so will result in immediate suspension of that user’s account. Based on this, the following rules must be observed:

• Access Control
  • IT reserves the right to refuse, by physical and non-physical means, the ability to connect mobile devices to {COMPANY-NAME} and {COMPANY-NAME}-connected infrastructure. IT will engage in such action if it feels such equipment is being used in such a way that puts {COMPANY-NAME}’s systems, data, users, and members at risk.
  • Prior to initial use on the {COMPANY-NAME} network or related infrastructure, all mobile devices must be registered with IT. {COMPANY-NAME} will maintain a list of approved mobile devices and related software applications and utilities, and it will be stored in the IT Document Storage location. Devices that are not on this list may not be connected to the {COMPANY-NAME} infrastructure. To find out if a preferred device is on this list, an individual should contact the {COMPANY-NAME} IT Department Service Desk.
  • Although IT currently allows only listed devices to be connected to the {COMPANY-NAME} infrastructure, it reserves the right to update this list in the future.
  • End users who wish to connect such devices to non-corporate network infrastructure to gain access to {COMPANY-NAME} data must employ, for their devices and related infrastructure, a company-approved personal firewall and any other security measure deemed necessary by the IT Department. {COMPANY-NAME} data is not to be accessed on any hardware that fails to meet {COMPANY-NAME}’s established enterprise IT security standards.
  • All mobile devices attempting to connect to the {COMPANY-NAME} network through an unmanaged network (i.e. the Internet) will be inspected using technology centrally managed by {COMPANY-NAME}’s IT Department. Devices that are not corporate issued are not in compliance with IT’s security policies and will not be allowed to connect except by provision of the Personal Device Acceptable Use and Security Policy. {COMPANY-NAME} owned laptop computers may only access the corporate network and data using a Secure Socket Layer (SSL) Virtual Private Network (VPN) or Internet Protocol Security (IPSec) VPN connection. The SSL or IPSec VPN portal Web address will be provided to users as required. Smart mobile devices such as Smartphones, PDAs, and UMPCs will access the {COMPANY-NAME} network and data using Mobile VPN software installed on the device by IT.
• Security
  • Employees using mobile devices and related software for network and data access will, without exception, use secure data management procedures. All mobile devices containing stored data owned by {COMPANY-NAME} must use an approved method of encryption to protect data. Laptops must employ full drive encryption with an approved software encryption package. No {COMPANY-NAME} data may exist on a laptop in clear text. All mobile devices must be protected by a strong password. Refer to the {COMPANY-NAME} password policy for additional information. Employees agree to never disclose their passwords to anyone, particularly to family members, if business work is conducted from home.
  • All keys used for encryption and decryption must meet complexity requirements described in {COMPANY-NAME}’s Password Policy.
  • All users of corporate owned mobile devices must employ reasonable physical security measures. End users are expected to secure all such devices used for this activity whether they are actually in use and/or being carried. This includes, but is not limited to, passwords, encryption, and physical control of such devices whenever they contain {COMPANY-NAME} data. Users with devices that are not issued by {COMPANY-NAME} must adhere to the Personal Device Acceptable Use and Security Policy.
  • To ensure the security of {COMPANY-NAME} equipment, mobile devices will be transported and stored as specified in the “Mobile Device Transport and Storage” procedure.
  • Passwords and confidential data should not be stored on unapproved or unauthorized non-{COMPANY-NAME} devices.
  • Any corporate owned mobile device that is being used to store {COMPANY-NAME} data must adhere to the authentication requirements of {COMPANY-NAME}’s IT Department. In addition, all hardware security configurations must be pre- approved by {COMPANY-NAME}’s IT Department before any enterprise data-carrying device can be connected to it.
  • IT will manage security policies, network, application, and data access centrally using whatever technology solutions it deems suitable. Any attempt to contravene or bypass said security implementation will be deemed an intrusion attempt and will be dealt with in accordance with {COMPANY-NAME}’s overarching security policy.
  • Employees, Board of Directors, and temporary staff will follow all enterprise- sanctioned data removal procedures to permanently erase company- specific data from such devices once their use is no longer required. For assistance with detailed data wipe procedures for mobile devices, an individual should contact the {COMPANY-NAME} IT Department Service Desk. This information is found in the IT Document Storage location.
  • In the event of a lost or stolen mobile device, it is incumbent on the user to report this to IT immediately. {COMPANY-NAME} shall employ remote wipe technology to remotely disable and delete any data stored on a {COMPANY-NAME} PDA or cell phone that is reported lost or stolen. If the device is recovered, it can be submitted to IT for re-provisioning.
  • Usage of location-based services and mobile check-in services, which leverage device GPS capabilities to share real-time user location with external parties, is prohibited within the workplace. This applies to both {COMPANY-NAME}-owned and personal mobile devices being used within {COMPANY-NAME}’s premises.
  • IT maintains the process for patching and updating mobile devices. A device’s firmware/operating system must be up-to-date in order to prevent vulnerabilities and make the device more stable. The patching and updating processes are the responsibility of IT for computing platforms (i.e. laptops). /R
  • IT maintains the process for security audits on mobile devices. Since handheld devices are not completely under the control of {COMPANY-NAME}, a periodic audit will be performed to ensure the devices are not a potential threat to {COMPANY-NAME}.
• Help and Support
  • {COMPANY-NAME}’s IT Department will support its sanctioned hardware and software but is not accountable for conflicts or problems caused by the use of unsanctioned media, hardware, or software. This applies even to devices already known to the IT Department.
  • Employees, Board of Directors, and temporary staff will not make modifications of any kind to {COMPANY-NAME} owned and installed hardware or software without the express approval of {COMPANY-NAME}’s IT Department. This includes, but is not limited to, any reconfiguration of the mobile device.
  • IT reserves the right, through policy enforcement and any other means it deems necessary, to limit the ability of end users to transfer data to and from specific resources on the {COMPANY-NAME} network.
• Organizational Protocol
  • IT can and will establish audit trails and these will be accessed, published, and used without notice. Such trails will be able to track the attachment of an external device to a PC, and the resulting reports may be used for investigation of possible breaches and/or misuse. To identify unusual usage patterns or other suspicious activity, the end user agrees to and accepts that his or her access and/or connection to {COMPANY-NAME}’s networks may be monitored to record dates, times, duration of access, etc. This is done to identify accounts/computers that may have been compromised by external parties. In all cases, data protection remains {COMPANY-NAME}’s highest priority.
  • The end user agrees to immediately report, to his/her manager and {COMPANY-NAME}’s IT Department, any incident or suspected incidents of unauthorized data access, data loss, and/or disclosure of {COMPANY-NAME} resources, databases, networks, etc.
  • {COMPANY-NAME} will not reimburse employees if they choose to purchase their own mobile devices except in accordance with the Personal Device Acceptable Use and Security Policy. Users will notbe allowed to expense mobile network usage costs.
  • {COMPANY-NAME} prohibits the unsafe and unlawful use of mobile devices, including but not limited to, texting, emailing, or any distracting activity while driving, and requires this audience to comply with all state laws in which one is currently operating, regarding same, hands-free requirements, etc.
  • Before being granted a device and access to {COMPANY-NAME} resources, a mobile device user must understand and accept the terms and conditions of this policy.