Cybersecurity Code of Conduct

1. Introduction

2. General Guidelines

• Cybersecurity is everyone's responsibility. Follow all established policies, procedures, and standards related to cybersecurity.
• Never share access to company systems and data with unauthorized personnel.
• Do not bypass security controls or disable security features on any company device.

Consequences

• Failure to adhere to the cybersecurity Code of Conduct may result in disciplinary action, up to and including termination of employment.

3. Data Handling

• All data should be classified according to its level of sensitivity and controlled accordingly.
• Sensitive data should only be accessed by authorized personnel through secure systems.
• When handling sensitive data, make sure that it is secured and not left unattended.

Consequences

• Any unauthorized sharing of sensitive data may result in disciplinary action, up to and including termination of employment.

4. Password Protection

• All electronic devices and accounts with access to company systems and data must be secured with a strong password.
• Do not share your password with anyone, including peers, contractors, or third-party vendors.
• Use password management tools and avoid writing passwords down or storing them in an unsecured location.

Consequences

• Any unauthorized use of an account due to password sharing may result in disciplinary action, up to and including termination of employment.

5. Software Usage

• Only authorized software and apps should be installed on company systems.
• Software and apps should be kept up to date with the latest patches and updates.
• Do not install any unapproved software, including personal or freeware programs.

Consequences

• Any unauthorized installation of software or failure to keep it up to date may result in disciplinary action, up to and including termination of employment.

6. Reporting Security Incidents

• Any detected or suspected security incidents should be immediately reported to the IT or security department.
• Do not attempt to investigate or resolve a security incident independently or destroy any evidence.

Consequences

• Failure to report any incident or unauthorized attempt to resolve it may result in disciplinary action, up to and including termination of employment.

7. Conclusion