Exhibit A.pdf

STATE OF SOUTH CAROLINA DEPARTMENT OF JUVENILE JUSTICE

POLICY AND PROCEDURES

Title: Acceptable Use of Information and Technology Resources

Policy No.: 129 Page 1 of 7

Folder 100: Agency Management Policy Owner: Information Security and Privacy

Applicability:

☒ All DJJ Staff/Employees ☐ Administrative Services ☐ Chief of Staff ☐ Community Services ☐ Educational Services ☐ Facility Rehabilitation and Health Services ☐ Legal Services ☐ Physical Plant Management ☐ Safety and Law Enforcement Services ☐ Security and Operations ☐ Treatment and Support Services ☐ SCDJJ Volunteers/Contractors/Interns

Standard Operating Procedure Required:

☐ YES ☒ NO

Effective Date:

Replaces: 11/17/2020

APPROVED

L. Eden Hendrick Executive Director

POLICY STATEMENT: It is the policy of the South Carolina Department of Juvenile Justice (SCDJJ or Agency) to ensure the secure, ethical, and effective use of its information and technology resources. This policy establishes standards and responsibilities for authorized users when accessing and utilizing Agency information and technology resources. Any employee, volunteer, or contractor using any Agency information or technology resource is in acceptance of this policy and other related policy terms.

Definitions:

Agency Information Technology Resources: Computers, printers and other peripherals, programs, data, local and wide area networks, and the Internet connectivity provided by the agency for business purposes. Before being issued any agency technology resources employees must sign the Acceptable Use of Information Resources Policy Acknowledgment Form 129A, and the Confidentiality Agreement Form 129B.

Business Purpose: Activities necessary to perform duties, tasks, responsibilities and related activities required to execute identified job purpose and description.

PROCEDURAL GUIDELINES:

A. Intended Use

1. Agency Information technology resources will only be used for Business Purposes.

Such use must comply with federal, State, and Agency policies, standards, procedures, and guidelines related to security, privacy, copyright protection, and licensing agreements.

12/17/2025

129 Acceptable Use of Information and Technology Resources Pages: 2 of 7

2. The information technology resources provided by the Agency will be used, maintained, and protected as follows:

a. Users only access agency information, systems and networks through agency approved devices.

b. Users will only utilize Agency systems and networks for business purposes except for occasional incidental use as further described in this policy.

c. Users will comply with access controls/restrictions (e.g., proper use/protection of passwords) to protect Agency data, systems, and networks at all times.

d. Users will protect all confidential/private information accessed necessary to perform business purposes from unauthorized use or disclosure.

e. Users will adhere to copyright and trademark laws and software license agreements at all times.

f. Users will immediately report by email to the IT help desk any suspected information and/or cyber security breaches or incidents.

g. Users will not tamper with, disengage, or interfere with any safeguard or measures which protect SCDJJ information resources and/or data from threats and vulnerabilities.

h. Upon separation/termination of employment or contractor/volunteer status, users will return any and all information, equipment, software, devices, or other resources provided by SCDJJ, in accordance with Policy 232, Employee Separation.

B. Unacceptable Use

1. Unacceptable use impedes the work of others, needlessly squanders IT resources, may unintentionally damage the IT infrastructure, and affects the Agency’s ability to carry out its work.

This section defines activity considered unacceptable use of SCDJJ information technology resources. The following list is not intended to be exhaustive but is intended to provide a framework for activities that constitute unacceptable use.

Unacceptable use includes the following:

a. Users will not distribute, transmit, or store any material or correspondence on Agency provided information technology resources that is threatening, obscene, harassing, pornographic, offensive, or discriminatory.

129 Acceptable Use of Information and Technology Resources Pages: 3 of 7

b. Users will not use Agency information technology resources to represent the Agency in matters unrelated to their assigned work duties or responsibilities.

c. Users will not install or use hardware or software that has not been approved for their use by the Agency’s Information Technology Director.

d. Users will not share their password or user ID with any other person, nor will anyone knowingly allow any other person to utilize their password or user ID.

e. Users will not damage or destroy equipment, software, or data belonging to the Agency.

f. Users will not violate network usage policies and regulations.

g. Users will not use Agency information technology resources for commercial purposes, in support of "for-profit" activities, or in support of other outside employment or business activities (e.g., sale or purchase of goods or services).

h. Users will not send or share chain letters, fraudulent mass mailings, spam, or other types of undesirable and unwanted e-mail content using Agency information technology resources.

i. Users will not shoulder surf (i.e., looking over someone’s shoulder) in order to obtain user access information.

j. Users will not use, import, or export data using portable storage devices (e.g., flash drives) unless such devices are issued or approved by the Agency’s Information Technology Director.

k. Users are strictly prohibited from connecting personal devices such as laptops, tablets, and smartphones to the Agency’s network.

l. Users will not store, access, or transmit Agency data on any personal devices, regardless of whether they are connected to the network.

C. Incidental Use

1. Users may make occasional and incidental personal use of SCDJJ information technology resources to access family, medical, educational, weather, or news information/sites related to urgent personal matters. However, such occasional/incidental use should not include storing personally identifiable information on agency issued devices or systems.

129 Acceptable Use of Information and Technology Resources Pages: 4 of 7

2. Occasional or incidental personal use of information technology resources may be allowed with supervisor’s approval. Any approved uses must comply with all agency policies, be limited in time and scope, and must not interfere with the employees’ duties or the performance of agency systems (such as excessive bandwidth or storage use.)

3. While this policy does not enumerate every required or prohibited behavior, it is intended to support sound judgement by providing guidance. Employees who are uncertain about whether a particular incidental use of state-provided resources is permissible should seek prior approval from their supervisor. Employees are required to cover costs incurred by any personal incidental use.

D. Guidelines For Youth Use

1. Any use of computers, electronic devices, or access to the internet or external communication platform, hardware, software, games or digital resources must be preapproved by the Deputy Director of Administrative Services, Deputy Director of Law Enforcement Services and the Deputy Director of the programmatic area before allowing access to youth.

2. Youth must always be under continuous direct sight and sound supervision, by authorized educational or security trained employees to ensure safety, security, and appropriate use of agency information technology resources.

3. Youth are strictly prohibited from using any agency-issued computer, tablet or any other electronic device assigned to an employee. No exceptions.

4. Youth are strictly prohibited from using an employee’s personal electronic device, cell phone, computer, tablet or any other electronic device at any time. No exceptions.

5. A youth may not use an employee’s Agency-issued cell phone except under the supervision of that employee in limited circumstances as outlined in SCDJJ Policies 209, Cell Telephones (State-Issued and Personal) and 902 Scope of Social Work Services.

a. In such cases, staff must maintain one-on-one, direct sight and sound supervision of the youth during use.

b. If a youth uses the device inappropriately, the supervising employee may be subject to progressive disciplinary action.

6. Any employee action or failure to act, including negligence, oversight, or disregard of duties, that results in a youth gaining unauthorized access to computers, electronic devices, the internet, external communication platforms, hardware, software, games, or other digital resources will be considered a violation of this policy and may result in progressive disciplinary action.

129 Acceptable Use of Information and Technology Resources Pages: 5 of 7

E. Mobile Devices

The loss or theft of state-issued equipment that stores or accesses Agency systems, networks, or data can result in unauthorized or unlawful access. Employees who use mobile devices to store or access Agency data must follow SCDJJ Policy 209, Cell Telephones (State-Issued and Personal).

Use of personal devices to access Agency systems, networks, or data is strongly discouraged. If an employee chooses to use a personal device for this purpose, that device and its contents may be subject to disclosure under the Freedom of Information Act

(FOIA).

F. Monitoring and Privacy Expectations

Employees should have no expectation of privacy when using any state-issued systems, devices, or information technology resources. The Agency may monitor, intercept, access, record, read, copy, or seize any communication, data, or files stored on or transmitted through its systems. This includes information stored on hard drives, removable media, or cloud services connected to Agency resources.

SCDJJ may inspect or seize any Agency-issued device, and any data on or transmitted through it, at any time. All network and technology activities may be logged and reviewed for operational, security, legal, or forensic purposes. These actions may occur without prior notice under the authority of Agency Executive Leadership.

Failure to adhere to the requirements of this policy, the Acceptable Use of Information Resources Policy Acknowledgement Form 129A, and the Confidentiality Agreement Form 129B may result in disciplinary action up to termination, in accordance with Policy 228, Employee Progressive Discipline.

G. Social Media

1. Social media on state-provided devices and systems is to be used only for business communications and for the purpose of fulfilling an employee's job duties, in accordance with SCDJJ Policy 132, SCDJJ Social Media.

2. The following guidelines apply to employee use of social media, both on and off duty and via agency or personal devices. An employee who publishes any information about the Agency, another employee, or youth in any public medium will be subject to disciplinary action in accordance with SCDJJ Policy 228, Employee Progressive Discipline, if they do any of the following:

a. Involves the employee, their coworkers, or the Agency in any kind of dispute or conflict with other employees or third parties.

b. Interferes with the work of any employee or the agency.

129 Acceptable Use of Information and Technology Resources Pages: 6 of 7

c. Creates a harassing, demeaning, or hostile working environment.

d. Disrupts the smooth and orderly flow of work within the workplace, or the delivery of Agency services.

e. Harms the goodwill and/or reputation of the Agency among its constituents or in the community at large.

f. Tends to place in doubt the reliability, trustworthiness, or sound judgment of the person or entity which is the subject of the information.

H. Retention of Information

Computer information is retained in compliance with SCDJJ Policy 123, Retention and Disposition of Departmental Records using Attachment 123A, Abbreviated Retention Schedule (General and Specific).

STANDARDS AND REFERENCES:

Criminal Justice Information Services ECPOL PS-8 (External)

RELATED FORMS AND ATTACHMENTS:

Form 129A, Acceptable Use of Information Resources Policy Acknowledgment Form Form 129B Confidentiality Agreement Attachment 123A, Abbreviated Retention Schedule (General and Specific)

STANDARD OPERATING PROCEDURES:

None

REFERENCED POLICIES:

123, Retention and Disposition of Departmental Records 132, SCDJJ Social Media 209, Cell Telephones (State-Issued and Personal) 228, Employee Progressive Discipline 232, Employee Separation

POLICY/TRAINING REQUIREMENT:

This policy applies to all employees, volunteers, contractors, interns, and vendors that access the Agency’s information resources and technology, including employees affiliated with NCIC and third parties. This includes, but is not limited to internet access, email, applications, computing devices, electronic information, and information processing systems.

All employees, volunteers, contractors, interns, and vendors are required to review this policy and sign the Acceptable Use of Information Resources Policy Acknowledgment Form 129A and Confidentiality Agreement Form 129B within 30 calendar days of the publication of this policy and annually thereafter. Failure to sign the Acceptable Use of Information Resources Policy Acknowledgment Form 129A within 30 days of receiving notice will result in the disabling of the employee’s Agency user account.

https://powerdms.com/link/DJJSC/document/?id=2016021 https://powerdms.com/link/DJJSC/document/?id=3621678

129 Acceptable Use of Information and Technology Resources Pages: 7 of 7

This policy will be reviewed at least annually by all employees to ensure its continued relevance, accuracy, and compliance with applicable standards and regulations.

UPDATES/REVIEWS:

December 2025, Substantive revisions September 14, 2018, Agency and policy reorganization April 7, 2025, InfoSec and IT reviewed

Document Revision History Table Revision Date Version Description of Change Approval Date

12/2025 1.0 Substantive updates and revisions for CJIS compliance.

12/15/2025