up vote 3 down vote favorite
2
share [g+] share [fb]

I would like to create an IT policy for my organisation. I am responsible for ~50 XP PCs all joined to Windows 2k8 Domain. I am looking for guidelines that are easy to understand for the unsavvy employees.

Thanks in advance

link|improve this question
78% accept rate
1  
We could do with more information, what areas do you want your policy to cover? Email, Applicaiton installation, laptop use at home etc.. – Sam♦ May 27 '09 at 8:47
email usage is pretty much covered in the company's 'Employee Handbook'. Everything else isn't. – SZayat May 27 '09 at 9:30
feedback

4 Answers

up vote 2 down vote accepted

I think the main point you should get across is what the companies network can and cannot be used for, that way you have something to reference should someone do something wrong.

I'd try to avoid keeping it too much of a manual, you'd end up wasting your time as many people wouldn't read it fully anyhow and you'll still end up with daily questions. Certainly try and get the main points across on the first few pages.

Points to consider including are:

  • Backups - How can the users get their data backed up, how often does this occur and how much space are they allowed to utilise?
  • File storage - What can the file server be used for and how much space are they allowed to take up? e.g. 20GB worth of mp3's and family photos wouldn't be very convenient although not always fully disallowed - so long as it stays within a reasonable quota and isn't backed up.
  • External media - Are external USB pen drives/CD's/External drives allowed to be plugged into computers?
  • Faults - What should people do if they identify a fault with the hardware/software that you provide? Do you have a ticket tracking system?
link|improve this answer
1  
Also that internet access should also be considered in the policy. You can not let them browse websites all the time. – s_ruchit May 27 '09 at 10:26
feedback
up vote 3 down vote

One of the better resources for computer policy documents can be found at the SANS policy project. They have sample policies for just about everything.

link|improve this answer
1  
I don't recall if SANS talks about it or not but a crucial step to making your policy is talking to managers/company leaders and making sure they agree to all policy and have one of them assigned to review and approve of new revisions. Having management back the policy allows it to carry weight over employees. If the management doesn't care about it no one will bother following. – sparks May 27 '09 at 13:32
1  
Oh yes. One thing you can do that will save you a lot of pain later is to get at least three people to examine (and preferably have a part in the development of) the proposed policy: One from each Management, IT, and end-users. They will all have different things to bring to the table, that the others won't see. – Gavin McTaggart May 27 '09 at 20:13
feedback
up vote 1 down vote

Be sure to include something like "People that feel their needs exceed the quotas will be considered on a case by case basis" so people don't panic :-)

link|improve this answer
feedback
up vote 1 down vote

also:

  • Power off / restart / screen locking guidelines: some users will do nothing other than (possibly) locking their workstation without a guideline, making group policy updates spotty and consuming unnecessary power over weekends/holidays.
  • Appropriate use of company hardware. No, it is not ok for your child to browse webpages on your company laptop. Can they install their own apps?
  • Appropriate use of the company's Internet connection.
  • Non-company hardware: is it okay for users to attach their own equipment to the network? How about wirelessly? I.e. is your network hardened enough for users to bring in their virus-laden, malware-smeared home laptop?
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.