IT Security Policy
Security standards for IT infrastructure and services
Purpose
Establish standards for the secure and efficient use of endpoint devices and IT resources, protecting data and supporting the organization's mission.
Scope
Applies to all users, contractors and devices that access IT resources, including laptops, mobile phones, cloud systems and platforms that process organizational data.
Standards
Responsible Use of Resources
- Handle IT assets securely and responsibly.
- Register all assets in the Asset Inventory and maintain network and configuration documentation.
- Immediately report losses, thefts or suspicious activity.
- Implement procedures for secure data deletion and device reuse.
Device and Network Security
- Keep systems up to date with anti-malware software and vulnerability management.
- Configure firewalls, encryption and secure authentication on all devices.
- Isolate critical subnets in the event of attacks and disable vulnerable protocols.
- Segregate network administration from normal traffic and continuously monitor network security.
Clear Desk and Clear Screen Requirements
- Keep sensitive information under lock and key and protect devices when not in use.
- Configure automatic logout and collect printouts immediately.
- Erase whiteboards and screens after use.
- Perform final sweeps when vacating offices or remote workspaces.
Laptops
- Keep software up to date and apply secure password practices.
- Lock devices after inactivity and use approved encryption.
- Protect confidential data and securely delete information when returning devices.
- Training in the secure use of online resources and web filtering.
Mobile Phones
- Use secure authentication and encryption; securely delete data before disposing of the device.
- Install security and web filtering tools.
- Training in secure web use and compliance with filtering policies.
Remote Work
- Ensure a secure physical environment and protected storage of sensitive information.
- Use VPN, encrypted communication and secure remote access solutions.
- Follow backup, firewall and anti-malware protocols.
- Compliance monitoring and auditing, and revocation of access when employment ends.
Equipment Maintenance
- Maintain equipment according to the vendor's specifications, with authorized and supervised staff.
- Document failures and preventive and corrective maintenance.
- Implement confidentiality agreements and security measures for remote or off-site maintenance.
- Apply secure equipment disposal procedures.
Monitoring and Review
- Periodic inspections of IT assets to ensure compliance.
- Immediate correction of deviations.
- Annual review of the policy to keep it aligned with threats and cybersecurity best practices.