Unfold for Table of Contents

General rules

Secure working principles. This document lays out the guidelines for secure working, which includes asset management, remote work protocols, and data handling. All employees must adhere to these guidelines to maintain the company’s data integrity and security.
Shared responsibility. All employees are expected to adhere to the principles outlined in this document. As such, the responsibility for implementing these guidelines is collective, and specific roles or individual responsibilities are not assigned. Compliance with these principles is required across the entire organization.

Definitions

Acceptable use. Permissible use of company assets as outlined in the guidelines.
Asset. Any company-owned physical or digital item.
Remote working. Working outside of the company's official premises.
Clear desk and clear screen policy. Requirements for maintaining a clutter-free and secure workspace.

1. Acceptable use policy

Acceptable use of company assets. The use of company equipment, in particular mobile devices and laptops, is governed by rules on acceptable use principles that must be observed at all times.

<aside> <img src="/icons/info-alternate_blue.svg" alt="/icons/info-alternate_blue.svg" width="40px" /> Acceptable use principles:

Asset recording. Mobile devices must be registered in the Asset Register with their Serial Number (S/N) using the form provided in the record.
Device locking. Devices must always be locked when unattended, and shall never be left unattended in a public space.
Secure connectivity. Mobile devices and other assets must never be connected to public networks, and must only use secure Wi-Fi networks. Instead, employees are expected to use their mobile hotspots if no secure network is available.
Web surfing. No website containing illegal information or website known to contain viruses or phishing material may be accessed. This includes website with an information upload function (unless permitted for valid business reasons). Be referred to 6. Secure web surfing.
Application use. Only applications from approved suppliers may be used. These are recorded [Here].
Software updates. All software and OS must be up-to-date.
Data storage. Information should not be stored locally on mobile devices or other assets, unless it’s essential for the work process.
Credential management. Each system should use unique credentials and passwords that cannot be easily hacked. Be referred to All passwords must follow the following requirements:.
Use of images. Employees are not allowed to use images directly from Google or other search engines for business purposes without verifying the copyright status. This includes websites offering images without clear information on copyright permission or licensing status. Images should only be used if they are purchased through legitimate suppliers or obtained from platforms explicitly allowing free use of their materials under an appropriate license (such as Creative Commons). All image use must comply with applicable copyright laws and internal policies to protect intellectual property. It is allowed to use AI generated images (e.g Midjourney & Dall-E).
Office space. Employees are responsible for securing the office when they leave. The last person in the office must ensure all locks at all offices are secured. </aside>

2. Remote working policy

2.1. Public space

Risks for working in public spaces regarding data breaches could be:

Unsecured networks. Connecting to open or public Wi-Fi networks can expose data to interception.
Visual hacking. Unauthorized individuals might observe sensitive information on screens.
Physical theft. Devices or documents could be stolen, leading to unauthorized data access.
Unintentional disclosure. Conversations about sensitive topics can be overheard.
Malware infections. Downloading files or apps from unsecured networks can introduce malware. </aside>
Public security practices. In public places, make sure you are extra aware of your surroundings. Use appropriate measures (like privacy filters, physical security and connecting to hotspots) to prevent data breaches. Never use a unsecured network, see description in acceptable use principles above.
Public conversation guidelines. Keep in mind that sound reaches further than you think, so don't discuss sensitive information and never use the name of client in a conversation. Make sure you do not plan meetings while travelling in the train or other public transport.
- Confidential discussions. Confidential or sensitive information should only be discussed in secure environments. All employees must ensure that conversations cannot be overheard by unauthorized persons. Suitable locations include private meeting rooms or secure communication channels that are protected by encryption.
- Awareness and vigilance. All employees must be aware of their surroundings when discussing sensitive information, especially when outside the company's secure premises, such as in public places, at home or at conferences.
- Use of secure communication channels. For remote discussions involving sensitive information, use company-approved, secure communication channels such as encrypted video calls or voice communication platforms.
Keep your belongings with you. It is important that you never leave your device or bag unattended in a public area so physical security is a must!

2.2. Working from home

Home network security. Make sure you have a secure network connection in your home, with a sufficient level of security.