“Clients” refers to the Agency’s clients, former & prospective clients. “Encrypted” refers to the use of a program to put computer data into a coded format that cannot be read by unauthorized users. “Passwords” refers to a string of characters that, when possible, is at least 8 characters long and contains at least three of the following: upper case letter, lower case letter, a number, a special character ( %, &, #, etc.). “Private Information” refers to non-public personal, proprietary and confidential information, of Clients, the Agency and/or Agency employees. “Systems” refers to all agency computers, networks, copiers, scanners, FAX machines, voice mail/phone systems, and other storage devices (e.g. back-up tapes, USB and other portable drives, CDs, etc.) where Agency Private Information might be found (whether maintained on Agency equipment/servers or on equipment/servers managed by third parties or employees, wherever located). SCOPE & OBJECTIVE This Plan for Agency is intended to create effective administrative, technical, electronic and physical protections to safeguard the personal information of the Agency’s Clients and employees, the Agency’s proprietary and confidential information, the physical security of our premises, and the integrity of our electronic systems so that they are best positioned to function smoothly without interruption. This Plan sets forth the Agency’s procedures for electronic and physical methods of accessing, collecting, storing, using, transmitting, destroying, and protecting Private Information of Clients, the Agency and/or Agency employees and also the use of the Agency’s Systems by Agency employees and any authorized third parties, as deemed appropriate and/or required by applicable laws and regulations. In formulating and implementing this Plan, we have: (1) identified reasonably foreseeable internal and external risks to Agency’s security, confidentiality and/or integrity of electronic, paper or other records containing Private Information;
this Plan shall subject the employee to disciplinary action by Agency, up to and including termination. [Note: This plan is directed toward “employees” throughout. If the Agency uses independent contractors as well as employees, the Agency will need to broaden the plan to cover this group, such as by substituting “Agency Users” for “employees” wherever the term appears and defining “Agency Users” to include all categories of the Agency’s workers.] OWNERSHIP OF AGENCY INFORMATION The Agency regards all information contained, sent or received on the Agency’s Systems and/or Agency equipment (e.g., Agency computers and mobile electronic devices, email, text and instant messaging systems, social networks and message boards, whether maintained on Agency equipment/servers or on equipment/servers managed by others) as well as information contained in, sent or received by Agency employees about the Agency or relating to its business on equipment, as the property of the Agency, and the Agency reserves the right to access, review, use and disclose any such information at any time, with or without notice to employee, in Agency’s sole discretion. Employees have no right to or expectation of privacy with respect to any such information (except for the Private Information relating specifically to them), and shall acquire no ownership or control rights over such information. [Note: Any monitoring of conversations and communications using Agency’s equipment (e.g., phones, computers, mobile devices, etc.) or involving Agency business must be conducted in accordance with applicable laws/regulations, and should be expressly described in writing to Agency’s employees, such as in a policy manual. The lack of an expectation of privacy in the work place also can be covered in other Agency policies, such as a policy covering use of electronic communications and equipment. This would also cover other things like the Agency policy on restricting downloading on Agency equipment of third party software not provided by Agency, limiting use of Agency equipment for personal communications, etc.] INFORMATION SECURITY COORDINATOR The Agency has designated [VP of Information Technology (or other title designated for this responsibility)] as the “Information Security Coordinator” to oversee implementation of this Plan. The Information Security Coordinator will be responsible for: 1. Initial implementation of this Plan; 2. Training existing and new employees;