Workstation Security Policy

OVERVIEW

The purpose of this policy is to provide guidance for workstation security for VISUAL GRAVITY workstations in order to ensure the security of information on the workstation and information the workstation may have access to.

SCOPE

This policy applies to all VISUAL GRAVITY employees, contractors, workforce members, vendors and agents with a VISUAL GRAVITY issued or personal-workstation connected to a VISUAL GRAVITY network.

POLICY

Appropriate measures must be taken when using workstations to ensure the confidentiality, integrity and availability of sensitive information and that access to sensitive information is restricted to authorised users.

1. Workforce members using workstations shall consider the sensitivity of the information that may be accessed and minimise the possibility of unauthorised access.

2. VISUAL GRAVITY will implement physical and technical safeguards for all workstations that access electronic protected information to restrict access to authorised users

3. Appropriate measures may include:

• Restricting physical access to workstations to only authorised personnel

• Securing workstations (screen lock or logout) prior to leaving area to prevent unauthorised access

• Enabling a password protected screen saver with a short timeout period to ensure that workstations that are left unsecured will be protected. The password must comply with Password Construction Guidelines

• Complying with all applicable password policies and procedures

• Ensuring workstations are used for authorised business purposes only

• Never installing unauthorised software on workstations

• Storing all sensitive information on network servers

• Keeping food and drink away from workstations in order to avoid accidental spills

• Securing laptops that contain sensitive information by using cable locks or locking laptops up in drawers or cabinets

• Complying with the Portable Workstation Encryption Policy

• Complying with the Baseline Workstation Configuration Standard

• Installing privacy screen filters or using other physical barriers to alleviate exposing data

• Ensuring workstations are left on but logged off in order to facilitate after-hours updates

• Exit running applications and close open documents

• Ensuring that all workstations use a surge protector (not just a power strip) or a UPS (battery backup)

• If wireless network access is used, ensure access is secure by following the Wireless Communication policy

• Data from production environment databases may never be copied onto and stored on workstations

• Actual databases from production environments may only be stored on workstations once data has gone through an obfuscation process rendering personal and organisational information invalid

Policy Compliance

Compliance Measurement

The Infosec team will verify compliance to this policy through various methods, including but not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

Exceptions

Any exception to the policy must be approved by the Infosec team in advance

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.