Remote Access Policy
1.0 Purpose
Remote access to ourthe corporateorganization's network is essentialcrucial tofor maintainoperational ourefficiency Team’sand productivity,productivity. butHowever, inconnections many cases this remote access originatesoriginating from networksexternal thatnetworks, which may already be compromised or are at a significantlyhave lower security posturestandards thanor ourpotential corporatecompromises, network.introduce inherent Whilerisks. these remote networks are beyond the control of Precision Computer's policy, we must mitigate these external risks the best of our ability.
The purpose of this policy is to defineestablish the rules and requirements for connectingall remote connections to <Companythe Name>'organization's network from any host.network. These rules and requirementsmeasures are designed to minimize the potential exposure toand <Companymitigate Name>risks, from damages which may result from unauthorized use of <Company Name> resources. Damages includeincluding the loss or compromise of sensitive or company confidential data, intellectual property, damage to public image, damage to critical <Companysystems, Name>reputational internal systems,harm, and finespotential legal or other financial liabilities incurred as a result of those losses.liabilities.
2.0 Scope
This policy applies to all <Company Name> employees, contractors, vendorsvendors, and agents withof athe <Companyorganization Name>-("Authorized Users") utilizing any computer or device (whether organization-owned or personally-owned computer or workstation usedowned) to connect to the <Companyorganization's Name>network network.from a remote location. This policyincludes, appliesbut tois remotenot accesslimited connectionsto, usedaccessing toemail, dointranet workresources, or performing any work-related tasks on behalf of <Companythe Name>,organization. including reading or sending email and viewing intranet web resources. This policy coversencompasses anyall methods and alltechnologies used for remote access.
3.0 Policy Statements
The following statements define the specific rules, responsibilities, and technical implementationsrequirements ofgoverning remote access used to connectthe toorganization's <Company Name> networks.network:
3.1 General Principles and Responsibilities
It* is**Security theEquivalence:** responsibilityAuthorized ofUsers <Company Name> employees, contractors, vendors and agents with remote access privileges to <Company Name>'s corporate network tomust ensure that their remote access connection security is givenmaintained at a level equivalent to that expected within the sameorganization's considerationphysical aspremises.
* **Authorized Use Only:** Access privileges are granted solely for conducting organizational business. Performance of illegal activities or pursuing outside business interests via the user'organization's on-site connection to <Company Name>.
General access to the Internet for recreational use through the <Company Name> network is strictly limitedprohibited. toRecreational <Companyuse Name>of employees,the contractors,internet vendorsthrough the remote connection should be minimal and agentsmust (hereaftercomply referred to as “Authorized Users”). When accessingwith the <Companyorganization's Name>Acceptable networkUse fromPolicy.
* a**User personal computer,Accountability:** Authorized Users are responsible for safeguarding their access credentials (logins, passwords, tokens) and preventing unauthorized use of their connection or access to any <Company Name> computerorganizational resources or data by non-Authorized Users. Performance of illegal activities through the <Company Name> network by any userUsers (Authorizedincluding orfamily otherwise)members). is prohibited. The Authorized User bearsis responsibilityaccountable for andall consequencesactivities ofconducted misusethrough oftheir access credentials.
* **Acceptable Use:** All remote access activities must adhere to the Authorized User’organization's access. For further information and definitions, see the Acceptable Use Policy.
Authorized3.2 UsersTechnical will not use <Company Name> networks to access the Internet for outside business interests.Requirements
For* additional**Secure information regarding <Company Name>'s remote access connection options, including how to obtain a remote access login, free anti-virus software, troubleshooting, etc., go to theConnections:** Remote Access Services website (company url).
Requirements
Secure remote access must be strictlyestablished controlledusing withorganization-approved secure methods, typically involving encryption (i.e.,technologies like Virtual Private Networks (VPNs)). andConnections must be authenticated using strong pass-phrases.credentials, Foradhering further information seeto the Acceptable Encryption Policy and theorganization's Password Policy.
*
AuthorizedSecurity:** UsersAll shalldevices protect(organization-owned theiror loginpersonal) used for remote access must have organization-approved, up-to-date endpoint security software installed and password,active, evenincluding fromanti-virus/anti-malware family members.
While using a <Company Name>-owned computer to remotely connect to <Company Name>'s corporate network,protection. Authorized Users shallshould ensureutilize theorganization-provided remoteresources hostor isdesignated notinternal portals to obtain required security software.
* **Network Isolation:** When connected to anythe otherorganization's network at the same time, with the exception of personal networks that are under their complete control or under the complete control of an Authorized User or Third Party.
Use of external resources to conduct <Company Name> business must be approved in advance by Precision Computer and the appropriate business unit manager.
All hosts that are connected to <Company Name> internal networks via remote access technologiesusing an organization-owned computer, Authorized Users must useensure the mostdevice up-to-dateis anti-virusnot softwaresimultaneously (place urlconnected to corporateother softwareuntrusted siteor here),public thisnetworks. includesConnections personalto computers.personally Thirdcontrolled, partysecured connectionshome mustnetworks complymay withbe requirementspermissible asif statedconfigured inaccording theto Thirdorganizational Partyguidelines. Agreement.Split-tunneling
Personalrequire equipmentexplicit approval based on security assessments.
* **Configuration Standards:** All devices used tofor connectremote toaccess, <Companyincluding Name>'spersonally-owned networksequipment, must meet the requirementsminimum ofsecurity <Companyconfiguration Name>-ownedstandards equipmentdefined forby remotethe accessorganization (as stateddetailed in the relevant Hardware and Software Configuration Standards fordocument).
* Remote**Third-Party AccessAccess:** Connections by third parties must comply with the requirements outlined in specific Third-Party Agreements and this policy.
3.3 Use of External Resources
The use of external resources (e.g., non-organizational systems or cloud services) to <Companyconduct Name>organizational Networks.business
a
remoteComplianceconnection Measurement
Theprior approval from both the relevant business unit manager and the designated IT authority (e.g., Precision Computer Teamteam, Internal IT Security).
4.0 Compliance
4.1 Compliance Measurement
The designated IT authority (e.g., Precision Computer team, Internal IT Security) will verify compliance towith this policy through various methods,methods. includingThese may include, but are not limited to, periodic walk-thrus, videonetwork monitoring, businesslog toolreviews, reports,audits (internal and externalexternal), audits,security scans, and inspection,inspection andof connected devices. Findings will providebe feedbackreported to the policy owner and appropriaterelevant business unit manager. management.
4.2 Exceptions
Any exception to thethis policy mustrequires formal, documented justification and advance approval from both the designated IT authority responsible for remote access services and potentially other relevant stakeholders (e.g., IT Security). Approved exceptions will be approvedreviewed by Remote Access Services and the Precision Computer Team in advance. periodically.
An4.3 employeeEnforcement
Failure to havecomply violatedwith this policy by Authorized Users may beresult subject toin disciplinary action, up to and including termination of employment.employment or contract. Access privileges may be revoked immediately pending investigation of violations.
* Acceptable Encryption Policy
*
Acceptable Use Policy
*
Password Policy
*
Third Party Agreement
/ Policy
* Hardware and Software Configuration Standards for Remote Access to <Company Name> Networks