The Access Policy will provide guidelines for external connections, for data communications, for connecting devices to a network, and for adding new software to systems. As part of the policy, the responsibility and accountability for its implementation must be established. This statement is to be read and signed by each user. Accountability Individual users are responsible for ensuring that others do not use their system privileges. In particular, users must take great care in protecting their usernames and passwords from eavesdropping or careless misplacement.
Passwords are never to be loaned.
Individual users will be held responsible for any security violations associated with their usernames. Operations staff is responsible for reviewing the audit logs and identifying potential security violations. Each user permitted to access a controlled system is to be made aware of the access policy for that system. Management will provide this information to the employee when first granting access and make the employee aware of the auditing capability in place to verify compliance. All controlled systems must maintain audit logs to track usage information to a level appropriate for that system.