Workstation Policy

Purpose and Scope

This policy defines best practices to reduce the risk of data loss/exposure through workstations. This policy applies to all employees and contractors. Workstation is defined as the collection of all company-owned and personal devices containing company data.

Policy

1. Workstation devices must meet the following criteria:
   1. Operating system must be no more than one generation older than current
   2. Device must be encrypted at rest
   3. Device must be locked when not in use or when employee leaves the workstation
   4. Workstations must be used for authorized business purposes only
   5. Loss or destruction of devices should be reported immediately
   6. Laptops and desktop devices should run the latest version of antivirus software that has been approved by IT
2. Desktop & laptop devices
   1. Employees will be issued a desktop, laptop, or both by the company, based on their job duties. Contractors will provide their own laptops.
   2. Desktops and laptops must operate on macOS, Linux or Windows.
3. Mobile devices
   1. Mobile devices must be operated as defined in the Removable Media Policy, Cloud Storage, and Bring Your Own Device Policy.
   2. Mobile devices must operate on iOS or Android.
4. Removable media
   1. Removable media must be operated as defined in the Removable Media Policy, Cloud Storage, and Bring Your Own Device Policy.
   2. Removable media is permitted on approved devices as long as it does not conflict with other policies.