5-RFP3871 - Attachment C EMWD Computing Policy.pdf

ATTACHMENT C

EMWD COMPUTING POLICY

HUMAN RESOURCES

POLICIES AND PROCEDURES

Policy: Computing Policy

Date:

November 2, 2017

Revision Date:

July 30, 2020

Approved by:

Human Resources

I. PURPOSE AND SCOPE

This policy governs EMWD technology, network use, and data confidentiality. It applies to all parties (full-time, contractor, temporary, etc.) accessing technology, data, or network resources provided by Eastern Municipal Water District.

Violation of this policy may lead to revocation of system privileges, legal action, corrective action or discipline, up to and including termination of employment.

The scope of this policy does not limit employees’ rights to engage in legitimate concerted labor related activities as defined by law.

II. POLICY STATEMENTS

Eligible employees may be issued a computer or mobile device(s) if the nature of the work and/or the need to maintain contact with EMWD and effectively complete assigned work is best accomplished using technology. Eligibility will be determined by the employee’s department Executive Management.

III. SECURITY

Users are EMWD’s most important security safeguard.

• Never share any computer or system passwords or leave an unlocked computer unattended.

• Never open suspicious files, e-mail messages, or web links.

If in doubt, call the helpdesk for guidance or contact the originating user by phone to validate the authenticity of the communication.

The following must be reported in-person or via phone to the Information Systems helpdesk as soon as you are aware of:

• Lost, stolen, or compromised device

• Lost or stolen sensitive customer, employee, or EMWD information

• Disclosure of privileged information to unauthorized parties

• Unauthorized system or network access

Specifics of computer or network security issues should be discussed only with

EASTERN MUNICIPAL WATER DISTRICT

COMPUTING POLICY

Information Systems or Risk Management, since disclosure could result in a serious breach.

IV. SOFTWARE AND CLOUD SERVICES

Staff shall not engage or commit EMWD to any software or cloud service without first seeking a review and receiving approval from Information Systems and the Purchasing and Contracts Department; to include proof-of-concept or trial installations.

Software license tracking is provided by Information Systems. Non-compliant software may be removed during regular software compliance audits without notice.

V. LIMITATIONS OF USE

Users shall abide by all applicable laws and adhere to EMWD’s Ethics, Harassment, and Social Media Policies at all times.

EMWD-issued technology (e.g., telephones, cellular devices, computers, laptops, tablets) are intended to be used for business purposes (e.g., checking EMWD e-mails, capturing field notes, etc.).

• EMWD issued e-mail addresses are to be used for EMWD business only and should not be used for registration to websites or services for personal use.

• Non-exempt employees are not required to check, read, send, or respond to work-related e-mails outside their normal work schedule unless specifically authorized based on job duties or management direction. This does not preclude staff from configuring EMWD email on a well-maintained personal device.

• Modifying, disabling, or tampering with any settings or systems that could present a security risk to EMWD is strictly prohibited.

• Accessing EMWD systems or information not directly related to a user’s work is strictly prohibited. Unauthorized review, dissemination of files or passwords, damage to systems or software, removal of files or programs, or improper use of information contained in any system may be grounds for disciplinary and/or legal action.

• Personal use of the Internet is authorized if it is not excessive or inappropriate and occurs during personal time (e.g., meal periods, breaks) provided it does not present a security risk, incur any cost or burden on EMWD, disrupt EMWD operations, or violate any EMWD policy. Other than “Open Internet” Wi-Fi, personal devices (e.g., cellular devices, computers, laptops, tablets) are not permitted on any EMWD network.

• A personal device may only be used to remotely access EMWD resources if it meets and is maintained according to in accordance with the minimum specifications as defined in EMWD staff remote access guide, distributed with a work-from-home authorization (e.g. policy, or agreement)

• Enabling or configuring a wireless (e.g. Wi-Fi, Bluetooth) hotspot within an EMWD-controlled facility is prohibited.

• Accessing, installing, or using any materials that infringe on one or more active copyrights is prohibited.

• EMWD technology may never be used for personal gain or an employee’s personal, religious, political, commercial ventures, or any activity that would cause an obstruction or disruption to work.

• Use of technology, even personal devices used for EMWD business, may be subject to discovery under the California Public Records Act.

EMWD data, sensitive documentation, or intellectual property shall be shared and used only in connection with EMWD business. EMWD data may not be used for any other purpose, in an aggregated or disaggregated manner, without explicit authorization from EMWD’s designated representative. EMWD data, credentials, documentation, and intellectual property shall be stored and managed securely and within the United States at all times. If a contractor operates or stores data outside the United States, any exceptions must be clearly defined and negotiated as an addendum to a contractor’s agreement.

VI. LIABILITY

EMWD contractors and any associated third parties that expose EMWD technology or data to harm, misuse, or theft may be held legally and financially responsible for actions resulting from the violation.

VII. SPECIAL ACCESS REQUESTS

Authorization must be obtained from Information Systems before any contractor or visitor device may be connected to any EMWD network. Notice must be given to the Information Systems helpdesk in advance of the planned engagement.

Remote access to EMWD systems must be granted by a Department Director. No EMWD computers or networks may be remotely accessed by users who have not received prior authorization.

Use of hosted document or file sharing platforms (e.g. Box, Dropbox, Google Drive, etc.) must be granted by a Director-level employee and receive further approval by Information Systems. No EMWD computers or networks may be configured for real-time document synchronization to these platforms.

VIII. PRIVACY

EMWD reserves the right to examine any information transmitted or stored on EMWD technology. Such examinations may occur at any time and may or may not include advance notification to the employee. If examination is performed as part of an investigation, it will be coordinated with the employee’s department head and the Human Resources department.

Privacy of personal communications using EMWD technology cannot be expected. EMWD-related communication via personal technology may also be examined in the course of an investigation, a Public Records Act request, or other litigation.

EMWD may wipe devices or erase any data stored on EMWD-issued technology.

IX. RECORDS MANAGEMENT/RETENTION

All stored or transmitted data is the property of EMWD and shall not be shared with other parties without permission from the department’s respective Executive Management. Exporting or saving EMWD records to removable media as a means of circumventing EMWD records management policies is prohibited.

Records related to ongoing or potential litigation or any investigation must be retained and cannot be disposed of, even if the retention period has been met, except as advised by legal counsel. Please refer to EMWD’s Records Retention Policy for details.

Employees and contractors affirm that any copies of EMWD data will be permanently deleted when no longer required under an active EMWD project, retention policy, or agreement.

Employees should contact their supervisor or Records Management for further assistance.

X. USE OF TECHNOLOGY WHILE DRIVING

Employees shall comply with all applicable laws and regulations regarding the use of mobile technology while operating a motor vehicle.

Please refer to EMWD’s Vehicle Use Policy for further guidance.

XI. TERMINATION OF USE

EMWD may revoke access to EMWD technology at any time. All EMWD-issued devices must be returned in working order prior to separation from EMWD employment.

XII. FURTHER GUIDANCE

The Information Systems helpdesk is always available to assist with questions or clarification on specific technical aspects of this policy.

CONTRACTOR/NON-EMPLOYEE ACKNOWLEDGEMENT

Please complete and forward the following form to the Information Systems Department to receive access to EMWD’s technology, data, or network resources. Only hand-written signatures will be accepted. PLEASE PRINT CLEARLY.

DATE: FIRST (please print): LAST (please print):

MY SIGNATURE BELOW INDICATES THAT I HAVE READ AND UNDERSTAND EMWD'S

COMPUTING POLICY. I AGREE TO THE CONDITIONS OF THE COMPUTING POLICY AND CAN BE

HELD LEGALLY LIABLE FOR VIOLATIONS OF THIS THE POLICY:

SIGNATURE:

EMWD EXT. OR PHONE #: COMPANY NAME:

EMAIL ADDRESS:

EMWD CONTACT RELATED TO BUSINESS BEING PERFORMED NAME:

DEPT: EXT: