Remote_Access_Policy.md

1. Overview

Remote access to our corporate network is essential to maintain our Team’s productivity, but in many cases this remote access originates from networks that may already be compromised or are at a significantly lower security posture than our organization’s network. While these remote networks are beyond the control of [ORG’S NAME]’s policy, we must mitigate these external risks the best of our ability.

1. Purpose

The purpose of this policy is to define rules and requirements for connecting to [ORG’S NAME]'s network from any host. These rules and requirements are designed to minimize the potential exposure to [ORG’S NAME] from damages which may result from unauthorized use of [ORG’S NAME]’s resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical [ORG’S NAME]’s internal systems, and fines or other financial liabilities incurred as a result of those losses.

1. Scope

This policy applies to all [ORG’S NAME]’s employees, contractors, interns, vendors and agents with a [ORG’S NAME]-owned or personally-owned computer or workstation used to connect to the [ORG’S NAME]’s network. This policy applies to remote access connections used to do work on behalf of [ORG’S NAME], including reading or sending email and viewing intranet web resources. This policy covers any and all technical implementations of remote access used to connect to [ORG’S NAME]’s networks.

1. *Policy *

General access to the Internet for recreational use through the [ORG’S NAME]’s network is strictly limited to [ORG’S NAME]’s employees, contractors, vendors, interns and agents (hereafter referred to as “Authorized Users”). When accessing the [ORG’S NAME]’s network from a personal computer, Authorized Users are responsible for preventing access to any [ORG’S NAME]’s computer resources or data by non-Authorized Users. Performance of illegal activities through the [ORG’S NAME]’s network by any user (Authorized or otherwise) is prohibited. The Authorized User bears responsibility for and consequences of misuse of the Authorized User’s access.

Authorized Users will not use [ORG’S NAME]’s networks to access the Internet for outside business interests.

For additional information regarding [ORG’S NAME]'s remote access connection options, including how to obtain a remote access login, free anti-virus software, troubleshooting, etc., contact our IT support team.

1. **Requirements **

   1. Secure remote access must be strictly controlled with encryption (i.e., Virtual Private Networks (VPNs)) and strong pass-phrases.

   2. Authorized Users shall protect their login and password, even from family members.

   3. While using a [ORG’S NAME]-owned computer to remotely connect to [ORG’S NAME]'s network, Authorized Users shall ensure the remote host is not connected to any other network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party.

   4. Use of external resources to conduct [ORG’S NAME]'s business must be approved in advance by the appropriate business unit manager.

   5. All hosts that are connected to [ORG’S NAME]’s internal networks via remote access technologies must use the most up-to-date anti-virus software and firewall software this includes personal computers. Third party connections must comply with requirements as stated in the Third Party Agreement.

   6. Personal equipment used to connect to [ORG’S NAME]'s networks must meet the requirements of [ORG’S NAME]’s information security polices for Remote Access to [ORG’S NAME]'s Networks.

I have read [ORG’S NAME]’s Remote Access Policy and agree to abide by it as consideration for my continued employment by [ORG’S NAME]. I understand that violation of any above policies may result in my termination.

_____________________ User Signature

_____________________ Date