IT POLICY
Date: 2026-10-25Version: 1.0Effective from: 2026-10-25Company / OrganisationNyttio Demo LtdScopeAll employees
1. Purpose
Defines the framework for secure, efficient and responsible use of the organisation's IT resources.
2. General principles
- IT resources may only be used for business-related purposes.
- Users are responsible for protecting credentials and equipment.
- The organisation's IT resources must not be used for illegal or inappropriate activities.
- Follow applicable laws, regulations and internal guidelines.
3. Use of IT
- Only use software and services approved by the organisation.
- Do not install software without approval from the IT owner.
- Respect copyright and licence agreements.
- Use email and the internet professionally and responsibly.
4. Information security
• Protect all confidential information from unauthorised access and disclosure.
• Report suspected security incidents to the IT owner immediately.
• Lock your computer whenever you leave your workstation.
• Back up important information according to established procedures.
• Use multi-factor authentication and approved storage locations where required.
5. Accounts, access and equipment
• Accounts are personal and must not be shared.
• Access must be limited to what duties require and reviewed regularly.
• Organisation equipment must be protected against theft, damage and unauthorised use.
• Lost equipment or suspected account compromise must be reported immediately.
6. Email, internet and remote work
• Be alert to phishing, malicious links and unexpected attachments.
• Sensitive information may only be shared through approved secure channels.
• Remote work must use approved connections and the same security requirements as on site.
7. Incidents and support
Security incidents, faults, suspected malware and loss of information must be reported without delay under the organisation's incident procedure. Do not investigate or conceal an incident yourself.
8. Roles and responsibilities
• Management is responsible for approving and communicating the policy and providing sufficient resources.
• The IT owner manages technical safeguards, access, incident procedures and user support.
• Managers are responsible for ensuring staff know the policy and that changed access needs are reported.
• Each user is responsible for following the policy and consulting their manager or IT owner when unsure.
9. Exceptions and compliance
Exceptions to the policy must be time-limited, risk-assessed, documented and approved by an authorised manager and the IT owner. Violations may lead to restricted access, internal investigation or other measures under organisational procedures and applicable rules.
10. Approval and review
The policy must be communicated to its audience and reviewed at least annually and after major changes in technology, risk, operations or regulation. Each new version must record its date, version number, approver and a short description of changes.
