GECC ACCEPTABLE USE OF COMPANY INFORMATION SOURCES POLICY

Transcription

Subject:
Original Issue Date:
May 1, 2009
Acceptable Use of Company
Information Sources Policy (V 2.0)
Revision Dates:
October 10, 2011; January 31, 2012
Effective Date:
U.S. - November 17, 2011
RoW – by March 15, 2012
Policy No.: IT-5
GENERAL ELECTRIC CAPITAL CORPORATION (GECC)
Acceptable Use of Company Information Sources Policy
(Short Name: AUP)
Issued by: GECC Information Technology and Legal
Issue Date: November 17, 2011
Effective Date: U.S. – November 17, 2011
Rest of World –by March 15, 2012
Approved on: October 14, 2011
By: GECC Chief Information Officer and General Counsel
Policy Owners: GECC Chief Information Officer and Chief Privacy Leader
Policy Contact: GECC Chief Privacy Leader
GE Internal
Page 1 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
Contents
1.
Scope .............................................................................................................................................. 4
1.1 Applicability ............................................................................................................................................................................... 4
1.2 Effective date ............................................................................................................................................................................ 4
2. Definitions ...................................................................................................................................... 5
3. Company Information Resources Ownership ............................................................................... 6
4. Protection and Acceptable Use of Company Data ....................................................................... 7
4.1 Access to Company Data ................................................................................................................................................... 7
4.2 Control .......................................................................................................................................................................................... 7
4.3 Confidentiality of Company Data................................................................................................................................... 7
4.4 Sharing of Company Data with Third Parties .......................................................................................................... 7
4.5 Data Transmissions ............................................................................................................................................................... 8
4.6 Document Retention ............................................................................................................................................................. 8
4.7 Data Classification ................................................................................................................................................................. 8
4.8 Data Privacy .............................................................................................................................................................................. 8
4.9 Use of Personal Devices for Company Data ............................................................................................................ 9
4.10 Inappropriate Access Prohibited .................................................................................................................................... 9
4.11 Return of Company Data ................................................................................................................................................... 9
4.12 Disposal of Company Data ................................................................................................................................................ 9
4.13 Other Requirements Governing Company Data .................................................................................................... 9
5. Protection and Acceptable Use of Company Equipment ........................................................... 10
5.1 Use of Company Equipment ...........................................................................................................................................10
5.2 Control ........................................................................................................................................................................................10
5.3 Company Software on Company Equipment ........................................................................................................10
5.4 Reasonable Non-business Use .....................................................................................................................................10
5.5 Identity Management and Passwords ......................................................................................................................11
5.6 Protection of Company Equipment and Company Data .................................................................................11
5.7 Backup of Company Data ................................................................................................................................................11
5.8 Inappropriate Use Prohibited .........................................................................................................................................11
5.9 Return of Company Equipment ....................................................................................................................................11
5.10 Compliance with Other Rules .........................................................................................................................................11
6. Acceptable Use of Online Services .............................................................................................. 12
6.1 Use of Online Services ........................................................................................................................................................12
6.2 Use of Third Party Online Services for Company Business .............................................................................12
6.3 Reasonable Non-business Use .....................................................................................................................................12
6.4 Protecting the Company’s Online Services .............................................................................................................12
6.5 Company Email......................................................................................................................................................................12
6.6 Identity Management and Passwords - Protecting Security of Online Services.................................13
6.7 Inappropriate Use Prohibited .........................................................................................................................................13
6.8 Public Comment on Behalf of Company or GE is Restricted .........................................................................14
6.9 Social Media ............................................................................................................................................................................14
6.10 Use of New Technologies and Services ....................................................................................................................14
7. Monitoring of Users ..................................................................................................................... 15
8. Reporting of Violations and Incidents ......................................................................................... 16
9. Suppliers, Contractors and other Third Parties .......................................................................... 17
10. Questions about this Policy ......................................................................................................... 17
11. Document Change History .......................................................................................................... 17
GE Internal
Page 2 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
Appendix A – Social Media Guideline
Appendix B – Links to Other Policies Mentioned in this Policy
GE Internal
Page 3 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
1. Scope
1.1 Applicability
This Policy applies to GE Capital (the ―Company‖) employees globally, and all others who
have been authorized to use Company Information Resources or have access to Company
Data, including, but not limited to, contractors, temporary or contingent workers, agency
workers, employees of suppliers and vendors or employees of joint ventures (collectively
referred to as "Users"), all subject to the extent of their access. This applies to the use of
Company Information Resources in the workplace, at home, or at any other location.
This Policy is issued pursuant to General Electric Company’s (―GE‖) The Spirit & The Letter
Privacy and Protection of GE Information policies, and is a substitute to the GE Acceptable
Use of GE Information Resources (AUGIR). This Policy applies in addition to other applicable
policies of the Company and GE, but where such other policies conflict with this one, this
Policy shall prevail for the subject matter covered herein. Use of Company Information
Resources constitutes acceptance of this Policy and its requirements. The Company
reserves the right to change this Policy at any time.
This Policy sets a baseline of rules for all of the Company’s Users. However individual
business units of the Company may impose additional requirements where necessitated by
local law or regulation, or to comply with local business unit policies or requirements.
Where a business unit would like to impose requirements that do not meet the
requirements under this Policy, it shall contact the Policy Owners to seek an exception in
accordance with the process for policy exceptions.
Non-compliance with this Policy can result in disciplinary action, up to and including
termination of employment or assignment, in accordance with local law. Users who have
knowledge of a violation of this Policy and fail to report it to appropriate management will
be considered non-compliant with this Policy, in accordance with the requirements set
forth in Section 8 below, subject to local law and any legal restrictions on such reporting.
1.2 Effective date
This Policy has been issued on November 17, 2011. It is effective from the date of issue in
the U.S. and by March 15, 2012 in the rest of the world – business units shall communicate
the Policy to its employees once approved locally for rollout. Delays beyond March 15,
2012 shall require the filing of an exception request.
GE Internal
Page 4 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
2. Definitions
Company Information Resources – includes Company Data, Company Equipment,
Software and Online Services as well as Personal Devices, as defined below.
Company Data – any electronic information that is owned, used or stored by the Company
or GE, or that is otherwise collected and/or processed by a User in the ordinary course of
business. This includes information about, relating to, or from the Company’s or GE’s
customers and suppliers or potential customers and suppliers, which resides on or is
accessed from Company Equipment or Online Services, or from Personal Devices, as
defined below. Company Data does not include private data stored on a Personal Device.
Company Equipment – this consists of the following components:
a. Hardware – desktops, servers, peripherals and any other device that connects to the
Company network/infrastructure such as printers, copiers, video conferencing systems,
CCTV, and wireless network equipment, that is purchased, provided, paid for or
otherwise approved by the Company or GE for business use by Users, or otherwise
used in connection with Company Data.
b. Portable Devices – any type of electronic device that is meant to be carried rather than
kept stationary, such as laptops, Blackberries, iPhones and other cell phones, iPads and
other tablet computers, and Removable Data Storage Media, that is purchased,
provided or approved by the Company or GE for business use by a User, or any other
such device that is used in connection with Company Data.
c. Telecommunications Equipment – Company telephone services (including voicemail),
facsimile machines and related telecommunications hardware purchased, provided or
approved by the Company or GE for business use by Users, or otherwise used in
connection with Company Data.
d. Removable Data Storage Media – Disks, Tapes, DVDs, CDs, USB Thumb Drives,
external hard drives and other data storage devices purchased, provided or approved
by the Company or GE for business use by Users, or otherwise used in connection with
Company Data.
Online Services – the Internet, intranets of GE or the Company, email, and other online
data services or collaboration tools such as SupportCentral, WebEx, GE Folders and GE
Libraries, and instant messaging solutions that are provided, purchased or approved by the
Company or GE for business use by Users, or otherwise used in connection with Company
Data.
GE Internal
Page 5 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
Personal Device – any type of Hardware, Portable Device, Telecommunications Equipment,
Removable Data Storage Media or Online Service that is purchased or supplied by a User without reimbursement by the Company - and is used for business purposes (even if also
used for personal purposes) or is used in connection with Company Data (even if it also
stores private data). Any Personal Device that is not used for business purposes AND is not
used in conjunction with Company Data is out of scope of this Policy and is an Exempt
Personal Device.
Social Media – Internet-based tools and services that allow subscribers to network and
communicate with each other as well as share data, photos, files, and other User
generated content, or to provide updates about themselves, as well as other sites that
allow users to read and share their views, or virtual worlds, to name some of the more
common social media segments. Some popular social media services include, but are not
limited to, Facebook, LinkedIn, Twitter, and YouTube as well as blogs, vlogs, and content
sharing sites.
Software – any application installed by the Company on Company Equipment, including
but not limited to the Coreload Operating System and other software installed by the
Company on a User’s PC, networked applications such as Oracle GL, or any other
application, including online applications such as SalesForce.com or Intralinks, that is
licensed and provided by the Company or GE, or otherwise approved by the Company or
GE for business use by Users, or in connection with Company Data.
3. Company Information Resources Ownership
The Company and/or GE is the owner of all Company Information Resources other than
Exempt Personal Devices. Subject to local laws and regulations, Users shall have no
expectation of privacy in their use of Company Information Resources, including Personal
Devices, and may be subject to monitoring, as described in this Policy.
GE Internal
Page 6 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
4. Protection and Acceptable Use of Company Data
4.1 Access to Company Data
Access to Company Data is provided to Users for legitimate business purposes only and in
accordance with applicable policies, guidelines and instructions of the Company. Company
Data is intended for business use only. Users may only seek access to Company Data that
is necessary to perform their current job responsibilities and requests for access to
Company Data to which they do not ordinarily have access shall follow any existing
processes and controls of the Company, in accordance with local laws and regulations.
4.2 Control
It is each User’s responsibility to properly manage, maintain, and guard the security of the
Company Data to which he/she has access or control as specified in the GE Capital
Information Security Policy and any other applicable policy or guidance issued by the
Company or GE, or any separate agreement signed between the User and the Company.
4.3 Confidentiality of Company Data
Users should be aware that Company Data and/or the processes used to transmit, store or
access Company Data, may be proprietary, confidential, or business-sensitive to the
Company, its clients, customers, partners, suppliers or others. Company Data may be
subject to contractual limitations on its use, or may be the subject of intellectual property
rights such as patents or copyrights.
Therefore, Users need to safeguard all Company Data that they possess or have access to
from unauthorized or accidental disclosure, use, modification, copying, publication,
damage, loss or destruction, consistent with policies and procedures of the Company, as
well as local legal requirements. This includes exercising care in handling of Portable
Devices, and in discussing business matters over cellular phones, cordless phones,
speakerphones, or in public areas so as not to compromise GE Confidential or GE Restricted
data. Users should also be aware that emails and voicemails may easily be copied or
forwarded to others and therefore Users should not send any email or voicemail that they
wouldn’t feel comfortable seeing reproduced in public. As a reminder, all Company Data,
whether in paper or electronic format (this may include email and Webex chats) may be
subject to discovery in litigation, subject to local laws and regulations.
When sending GE Confidential or GE Restricted data outside of the Company, Users shall
follow the Data Transmissions rules in Section 4.5 below.
4.4 Sharing of Company Data with Third Parties
Users are not allowed to release Company Data to third parties without a business
justification and without the proper controls as specified below. Users should be cautious
when transmitting, sending or forwarding email messages and attachments, documents
and files, voice mail messages, instant messaging texts (i.e., chat or SMS) or other
GE Internal
Page 7 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
information to other Users (even if they are co-workers), as they may not have a valid need
to know the contents of such data. Users shall not forward GE Confidential or GE Restricted
data outside the Company without permission from the original sender or author of the
data, or their manager, unless they are acting in the ordinary course of business as part of
their Company role. When sending such information, Users shall follow the Data
Transmissions rules in Section 4.5 below.
Engagements with suppliers, contractors, and other third parties shall be handled
consistent with the GE Capital Sourcing Policy and GE Capital Material Activities
Outsourcing Policy to ensure the IT and Information Security teams are properly consulted
on necessary precautions before transferring Company Data to a third party and adequate
contractual provisions are in place
4.5 Data Transmissions
In light of the inherent risk that data sent over the Internet (including email) may be
intercepted or altered during transmission or in storage, and the risk that unauthorized
third parties may seek to use the data for financial gain, it is crucial that all data
transmissions be done securely. When sending GE Confidential or GE Restricted data
outside the Company, Users need to employ the most current security technology
recommended by the Company and available to them, such as password protection,
encryption, digital certificates and digital signatures, all as specified in the GE Capital
Information Security Policy.
4.6 Document Retention
All Company Data is subject to the Company’s Records Management policy, procedures,
retention schedules and the GE Capital data classification requirements in Section 4.7
below. Users shall be familiar with the rules that apply to them and adhere to those rules
from the reception or creation and storage of Company Data, through final disposition.
4.7 Data Classification
All Company Data should be defined, stored and handled in accordance with Appendix A of
the GE Capital Information Security Policy, which outlines the appropriate treatment for
various types of information (such as GE Restricted, GE Confidential, GE Confidential with
Sensitive PII, etc).
4.8 Data Privacy
Use of Company Information Resources and handling of Company Data is subject to the
Company’s and/or specific business unit data privacy policies and guidelines, and local
legal requirements. Users should be familiar with and follow any such rules that apply to
Company Data they handle in the ordinary course of business. In particular, Users should
follow the Spirit & Letter Privacy Policy and the Employment Data Protection Standards.
GE Internal
Page 8 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
4.9 Use of Personal Devices for Company Data
Personal Devices may not be used for any business purpose or to store Company Data
without approval of the User’s manager and in accordance with policies and rules of the
Company for the use of Personal Devices. If approval is given, all such devices become
subject to this Policy as applicable. Users may also be required to sign an agreement
imposing supplemental requirements and terms of use as a condition to the use of
Personal Devices. By way of example, if you use a home PC or laptop to access Remote
Office, if you get approval to use a personal iPad or other tablet computer in the office, or if
you get approval to purchase a thumb drive to port Company Data from work to your
home PC or laptop, such devices all become subject to the relevant portions of this Policy
and may be subject to search, monitoring or document disclosure and production
obligations, subject to local law. Users may also be required to install certain software on
their Personal Device and to deploy other controls such as use of a password on the device.
Failure to comply with all such requirements violates this Policy. Users may not use or
install Software on any Personal Device if advised by the Company that such Software is on
the list of unapproved Software. This section does not apply to Exempt Personal Devices.
4.10 Inappropriate Access Prohibited
Users are prohibited from accessing the data of another User or accessing Company Data
to which they have not been granted access, unless such access is: (1) with the other
User's or owner of the Company Data’s express consent; or (2) required as part of the User's
job responsibilities and the User has gone through the appropriate approval process to
gain such access, as further described in Section 7 below.
4.11 Return of Company Data
Company Data shall be returned to the Company immediately upon termination of
employment or status as an authorized User, as further detailed in Section 5.9 below.
4.12 Disposal of Company Data
Company Data should be disposed of in accordance with the Company’s Records Retention
rules, any data disposal guidance issued by the Company, any applicable business unit
policies and rules, and local laws and regulations. When in doubt, apply the most secure
manner of disposal taking into account the highest potential data classification for the
Company Data being disposed.
4.13 Other Requirements Governing Company Data
Users should become familiar with and ensure they are complying with all applicable laws,
regulations and GE policies that apply to the Company Data they are handling, as well as
any contractual obligations that may apply.
GE Internal
Page 9 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
5. Protection and Acceptable Use of Company Equipment
5.1 Use of Company Equipment
Company Equipment is provided to Users for legitimate business purposes only and in
accordance with applicable policies, guidelines and instructions of the Company. Users
outside of IT may not modify Company Equipment configurations without proper approval
from the IT team.
5.2 Control
It is each User’s responsibility to properly manage, maintain, and safeguard all Company
Equipment to which he/she has access or control.
5.3 Company Software on Company Equipment
Company Equipment may come with standard pre-installed Software. Users may not
disable or uninstall such Software. The Company may also routinely install additional
Software on Company Equipment and any attempt to permanently prevent such Software
installations is prohibited. Only Software that was reviewed and approved by the Company
may be loaded onto Company Equipment. The Company reserves the right to monitor
Company Equipment and remove unapproved software including, but not limited to,
freeware, open source software, peer-to-peer file sharing programs, remote control
software, voice chat, hacking tools, anonymizers, instant messaging tools or any Software
determined or suspected of being malware.
5.4 Reasonable Non-business Use
Reasonable or occasional non-business use of Company Equipment is permitted provided
it does not conflict with business objectives, policies and guidelines of the Company and
provided it is not an abuse of the Company’s time or resources.
User Personal Files: Users may keep a reasonable amount of personal files and data on
Company Equipment (in particular a laptop or desktop or server space allocated for data
backup). All such files shall be clearly marked as personal. Users may not store large
repositories of photographs or audiovisual materials such as music (mp3 files) or movies.
The Company reserves the right to periodically sweep Company Equipment for improper
storage of personal files and delete any files deemed to exceed this Policy with no notice to
Users, and the use of Company Equipment for storing personal files constitutes consent to
such action by the Company. Users are encouraged to minimize any such storage and to
have another backup for their personal files. It is also each User’s responsibility to ensure
that their personal files stored on Company Equipment do not contain any illegal,
inappropriate or offensive materials. Any such material found on Company Equipment
may result in disciplinary action even if contained in a folder marked ―personal‖, all subject
to local laws and regulations.
GE Internal
Page 10 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
5.5 Identity Management and Passwords
Accounts, IDs, and passwords are issued to individuals and are personal to that User and
may not be shared with anyone. Passwords must be kept strictly confidential. Password
selection requirements are specified in the GE Capital Information Security Policy. Users
shall be responsible for all actions taken in their accounts, under their ID or with their
passwords unless they have promptly reported the loss, theft or compromise of their
account and/or password to the Company.
5.6 Protection of Company Equipment and Company Data
Users shall protect Company Equipment and Company Data residing on it by following the
GE Capital Information Security Policy as well as any other guidelines or rules of the
Company, their business unit, or applicable local laws and regulations. Users may not
tamper with or remove any security protections or settings on Company Equipment
without the approval of the IT team.
5.7 Backup of Company Data
Users are responsible for ensuring that all Company Data on Company Equipment in their
possession and control is properly backed-up by approved methods and to approved
storage locations. If in doubt as to the proper backup methods, contact your Help Desk.
5.8 Inappropriate Use Prohibited
Users shall not use Company Equipment to perform an act that is illegal, abusive, or
otherwise inconsistent with or in violation of this Policy, GE’s Spirit and Letter Policy or any
other policy of the Company or GE (e.g., conducting outside business ventures - even if
declared on a conflicts of interest statement, or excessive personal use of Company
Equipment).
5.9 Return of Company Equipment
At the end of life, or end of use by a User (e.g., upon resignation, termination of employment
or assignment or any end of status as an authorized User), all Company Equipment needs
to be returned to the Company. Where the Company Equipment needs to be sent offsite
for disposal, storage or other use, the appropriate procedures need to be followed to
ensure Company Data is kept secure while in transit and where applicable, the Company
Data should be destroyed in accordance with guidelines issued by the Information Security
Team and the EHS team.
Managers are responsible for ensuring that all Company Equipment is returned to the
Company prior to a User’s departure from the Company.
5.10
Compliance with Other Rules
Users shall adhere to all other applicable asset management and physical security rules,
guidelines and procedures communicated to them with respect to Company Equipment.
GE Internal
Page 11 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
6. Acceptable Use of Online Services
6.1 Use of Online Services
Online Services are provided to approved Users for legitimate business purposes only and
in accordance with applicable policies, guidelines and instructions of the Company. Not all
Users will have access to all Online Services and the Company reserves the right to limit or
revoke such access. Users may not circumvent access controls imposed by the Company
whether done via Company Equipment or via Company Software (e.g., proxy and security
settings in Web browsers).
6.2 Use of Third Party Online Services for Company Business
Users may not use Online Services offered by third parties (e.g. online email or calendar
services offered by companies like Google, Yahoo, or Facebook) to conduct Company
business unless such tools are offered to Users by the Company or are expressly approved
by the Company for business use.
6.3 Reasonable Non-business Use
Reasonable or occasional non-business use of Online Services is permitted provided it does
not conflict with business objectives, policies and guidelines of the Company, and provided
it is not an abuse of the Company’s time or resources. Users may not use Online Services
to run a personal business, even if such a personal business is declared in a conflicts of
interest statement.
6.4 Protecting the Company’s Online Services
The Company will employ appropriate controls, through a combination of processes and
technologies, to protect its Information Resources from misuse, data theft and other harm
to the Company, its Users and Company Data. Elements of this protection may include, for
example, restricting User access to the Internet or certain sites or categories of sites, or
placing controls on the transfer of Company Data, as well as deploying certain monitoring
and logging capabilities. Users may not circumvent these controls.
6.5 Company Email
The Company email is an asset of the Company and as such it may only be used to
conduct Company business (subject to Section 6.3 above). Users may not use the
Company email address (i.e., FirstName.LastName@ge.com) to subscribe to external
services (e.g., Facebook, LinkedIn, Twitter) unless such use is allowed under the GE Capital
Social Media Guideline in Appendix A of this Policy. Users also may not use the Company
email to promote their own personal services or business activities to co-workers (offering
any products or services) other than incidental uses. For example, offering tickets to a
show or a game to a select group of employees is allowed; having a side business of selling
tickets to shows or games and regularly emailing employees with offers is not allowed.
GE Internal
Page 12 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
6.6 Identity Management and Passwords - Protecting Security of Online Services
See Section 5.5 above.
6.7 Inappropriate Use Prohibited
Users may not use Online Services to access, send, forward, download, import, create or
display material that is inappropriate, offensive or otherwise in violation of any applicable
law or regulation, or of any policies, procedures, guidelines or instructions of the Company
– including but not limited to those uses described below.
Examples of Inappropriate Use: The following are examples of unauthorized and/or
inappropriate uses of Online Services which, subject to local law, can subject a User to
discipline, up to and including termination of employment or work assignment:
- Using an Online Service to access data of another User or of a third party outside of the
Company or GE, unless done in compliance with Section 7 below.
- Streaming movies, music, radio, and other multimedia content from the Internet
(excluding content transmitted or broadcasted by the Company or GE) unless done for
approved business uses or when connected to a non-GE network. Content played
directly from the hard drive of a laptop or computer is not covered by this rule.
- Sending out communications to multiple clients, customers or suppliers and listing
them in the ―to‖ or ―cc‖ lines rather than ―bcc,‖ thereby exposing their email and
relationship with the Company, unless done with their consent or other appropriate
authorization.
- Accessing, downloading, printing, creating, displaying, transmitting, sending,
forwarding or otherwise conveying unprofessional, inappropriate, offensive,
intimidating or harassing material or communications internally or externally, including
materials that are inconsistent with the Fair Employment Practices Policy contained in
the Spirit and Letter Policy (e.g., information that may be considered pornographic,
offensive or defamatory or may constitute harassment or create a hostile working
environment on the grounds of age, sex, race, disability or other protected class).
- Copying or downloading Software in a manner that is inconsistent with or in violation of
any applicable law or regulation, or any relevant licensing agreement or contract.
Users are referred to the GE Software Use Guidelines.
- Downloading or uploading any copyrightable material or anything else that is deemed
proprietary or subject to a license fee without paying the license fee, including music,
images, videos or subscription material. Any such conduct may expose both the User
and the Company to civil and criminal liability. Possession of copyright-infringing
materials on Company Information Resources is also prohibited.
- Sending "chain letters‖, solicitations, spam or other mass mailings (whether done by
text, voice, fax or email) without a legitimate and approved business purpose.
- Sending, forwarding, downloading, uploading or disclosing any nonpublic information
about GE, the Company, or the Company’s customers or suppliers, or personal data of
employees, or any other information that is marked as GE Confidential or GE Restricted
or is otherwise of a sensitive nature, unless done with proper justification.
GE Internal
Page 13 of 24
Subject:
May 1, 2009
-
Revision Dates:
Effective Date:
Policy No.: IT-5
Excessive personal use that impacts Company Information Resources or a User’s ability
to perform their job.
Use that – if made public – could expose the Company to reputational harm.
Using Online Services to perform any act that is inconsistent with or in violation of this
Policy, GE’s Spirit and Letter Policy or any other policy of the Company or GE.
6.8 Public Comment on Behalf of Company or GE is Restricted
Users should remember that use of Online Services or Company Equipment may identify
them as employees and/or representatives of GE or the Company and as such their
comments on Online Services may appear to represent the positions and views of the
Company or GE. Users shall therefore ensure that all communications using Online
Services are professional and business-related. When Online Services are used for
reasonable personal use, Users need to clearly indicate that the opinions expressed are
their own and not necessarily those of GE and/or the Company.
6.9 Social Media
Users may have access to some Social Media at work. Any such access is subject to the
Company’s discretion and access may be restricted or revoked at any time based on a
User’s role or conduct. The use of Social Media by Users for their own personal benefit is
subject to Sections 6.7 and 6.8 above as well as the GE Capital Social Media Guideline in
Appendix A to this Policy. Users shall be familiar with the relevant rules for use of Social
Media and follow them. Users should be aware that many of the Social Media rules apply
to them even if they are not using Company Equipment and are using the Social Media
from their home or the road. Failure to comply with the Social Media rules may result in
disciplinary action, up to and including termination, subject to local laws and regulations.
The use of Social Media by Users acting on behalf of the Company is subject to their
business unit rules and any guidelines of the Company that may exist.
6.10 Use of New Technologies and Services
The Internet offers a wealth of new online technologies and services that Users may believe
will enhance their ability to perform their job or otherwise deem to be useful. However, the
use of untested and unapproved technology or services poses a serious risk to Company
Data and Company Equipment as the use of such technology or service may create legal
liability or expose Company Data and Company Equipment to security vulnerabilities.
Users who wish to explore use of a new technology or service for business purposes should
contact their IT team to ask for a review and approval before downloading, installing or
using a new technology or service.
GE Internal
Page 14 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
7. Monitoring of Users
The Company reserves the right, subject to local laws and regulations, to review, audit,
monitor, intercept, access and disclose all uses of its Information Resources, and in
particular, email, voicemail, Instant Messaging Services (e.g. Webex), Internet use and all
files or information stored on Company Equipment, without prior notification to the User(s)
concerned, provided that such monitoring is done for legitimate business reasons,
including:
1. To protect the security of the Company/GE, its customers, suppliers and employees;
2. To protect and maintain proper operation and use of the assets of the
Company/GE;
3. To investigate unauthorized access to or use of Information Resources;
4. For an urgent, legitimate business need (e.g. employee unavailable and timing
critical, or to access Company Data after an employee has left the Company); or
5. To investigate a reasonable suspicion of violation of law or policy of the
Company/GE by a User or ex-User;
6. To respond to a subpoena or government investigation or otherwise comply with
applicable laws or regulations; or
7. To monitor quality and to assure compliance with regulatory requirements and
customer obligations.
A failure to monitor in a particular situation shall not be deemed a waiver of the right to
monitor in other similar situations.
The Company reserves the right to carry out other forms of monitoring of use of or access
to its Information Resources, such as the use of data loss prevention tools (e.g., Digital
Guardian), closed-circuit television, video monitoring, building access and security systems,
email scanning, web content filtering, network content monitoring, etc., all subject to
applicable legal requirements and restrictions on such monitoring.
If the Company discovers any User misconduct (including any violation of this or any other
policy or guideline of the Company) or criminal activity involving Company Information
Resources, the files or information related to such conduct may be used to document the
conduct and, subject to local laws and regulations, may be disclosed to appropriate
authorities - civil and criminal, both inside and outside the Company. The User may be
subject to disciplinary action up to and including termination of employment or work
assignment, subject to local laws and regulations, as well as any applicable civil/criminal
penalties. The Company also reserves the right, subject to local law, to consent to a valid
law enforcement request to search Company Equipment for evidence of a crime stored on
the equipment.
GE Internal
Page 15 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
The Company does not use any monitoring devices or other means to attempt to discover
the identity of anyone using an Ombuds hotline or any other Ombuds/complaint reporting
tool advertised as allowing anonymous reporting, and will not do so unless required by law
or court order.
The Company also does not intend to monitor, review or disclose communications between
employees and their personal attorneys, however, the Company disclaims any and all
liability for any inadvertent access to or disclosure of such communications.
All requests for a User’s personal data in connection with an investigation, litigation or
other situation requiring access to such data without the consent of a User shall be
handled in accordance with the Company’s Procedure for Review and Approval of Requests
for Indirect Access and Collection of Certain Types of Employees’ and Contractors’ Records,
which is issued under this Policy.
8. Reporting of Violations and Incidents
Inappropriate Use: Users shall immediately notify their IT helpdesk or the Local Security
Leader of any unusual behavior pertaining to Company Information Resources, subject to
local law and any legal restrictions on such reporting.
To the extent a User encounters any offensive or harassing materials on Online Services
used by another User, he or she should contact his or her manager, Human Resources,
Compliance or Ombudsperson, again subject to local law and any legal restrictions on such
reporting. Users should also consider whether it is appropriate to notify the sender not to
send such material in the future (however, as a reminder, Users should never reply to spam
messages).
Failure to report inappropriate use of Company Information Resources may, subject to local
law, result in disciplinary action up to and including termination of employment or work
assignment. As a reminder, retaliation against employees who report policy violations is in
itself a violation of GE’s Spirit & Letter policy and will subject the violator to disciplinary
action, up to and including termination.
Theft, Misappropriation or Other Incidents: The theft, loss or accidental destruction of any
Company Information Resources must be promptly reported in accordance with the
Company’s procedures for reporting such incidents. Users shall be familiar with the proper
channel for reporting such matters.
GE Internal
Page 16 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
9. Suppliers, Contractors and other Third Parties
This Policy applies to use of Company Data, Company Equipment and Online Services by
suppliers, contractors and other third parties, subject to any particular contractual
arrangement in place with such third parties and any other external legal obligation that
may exist under the local law of the third party.
Company Users who work with suppliers, contractors and other third parties must comply
with Section 4.4 above.
10. Questions about this Policy
For questions about this Policy, please contact your local, regional or global Information
Security Leader, Privacy Leader, Human Resources Manager, or Compliance Officer.
11. Document Change History
Versions and Review
Version
Comments
Dates
V 1.1
Amended sections 1.2 and 4.9
January 31, 2012
GE Internal
Page 17 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
APPENDIX A
GE Capital – Social Media Guideline
This Guideline of GE Capital (―GE Capital‖ or ―Company‖) for access to and use of Social Media is
meant to supplement and clarify The GE Capital Acceptable Use Policy (―AUP‖) and in particular
Section 6 – Acceptable Use of Online Services. The Guideline applies to all GE Capital
employees who access the Internet – whether from work, while traveling, or from home,
including if the access is from a Personal Device or an Exempt Personal Device, as well as to all
other Users who use Company Equipment to access the Internet.
INTRODUCTION
Social Media sites allow members to network and communicate with each other as well as
share data, photos and other user generated content, or to provide updates about themselves,
play games or interact with other members, to name some of the more common social media
uses. Social media sites come in many flavors including social networking sites (such as
Facebook, LinkedIn, Twitter, Google+ and Yammer), peer-to-peer networks, content posting
sites (such as YouTube, Wikipedia and other wikis, and sites like Scribd and SlideShare), as well
as various online communities (such as virtual worlds like SecondLife).
The use of Social Media can be a great way for Company workers to connect and interact
customers or potential customers, colleagues and potential employees, and friends and family
around the globe or down the street. However, you should remember that whatever you do or
say online reflects not only on your reputation, but can reflect on the Company as well. It is
therefore very important that you pay attention to situations where your personal life and your
GE life become co-mingled, and that you always follow this Guideline – even if you’re engaging
in Social Media activities at home on your personal computer – as the rules below will help
keep both you and the Company safe. In short, before posting information on or interacting
with Social Media sites, it’s important that you understand the risk, reward and reach involved,
and the expected behaviors.
Recognize that there are various ways in which your online activity can establish a connection
to the Company or your workplace, and as a result may impact the Company:
(i)
(ii)
(iii)
If you identify your affiliation with the Company (either directly or indirectly),
anything you do or say – even if unrelated to the Company - may be perceived as
an official position of the Company;
If you discuss matters related to the Company, even if you don’t identify yourself as
affiliated with the Company, if your connection to the Company is revealed, you
may be perceived as a knowledgeable insider; also hiding your Company
connection may be illegal in some cases;
Anything you do or say, even if totally unrelated to the Company and where you
haven’t identified yourself as a Company employee, may be viewed and/or
disseminated in the workplace.
GE Internal
Page 18 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
Due to various legal, policy or jurisdictional concerns, not all Company employees will have
access to Social Media sites from work. The Company routinely reassesses what sites to allow
and what sites to block and some decisions depend on your country, business, and even your
role. Regardless, this Guideline applies even when accessing Social Media sites while traveling
or from home. Bottom line – you have two brands to protect in your Social Media activity– the
Company brand and your own.
GENERAL GUIDANCE
o
ONLINE RULES ARE NOT DIFFERENT: The rules for acceptable behavior on Social
Media sites don’t change just because you’re online; only the speed with which
information can be shared—intentionally or accidentally—does, and as a result, the
impact of mistakes or improper behavior can be greatly magnified. Anything that
would be prohibited in the ―real world‖ doesn’t become permissible just because
you’re online. For example, posting comments that are offensive, discriminatory or
threatening; similarly offering recommendations or endorsements of ex-employees,
suppliers and others who interact professionally with the Company may not be
acceptable on Social Media sites where you appear in your Company capacity, as
that may be considered a prohibited endorsement; last, communications with the
media on Social Media sites must also follow the real world procedures governing
such contact – refer all such inquiries to the media and communications team at
your business. These are just three examples of situations that may arise in the
online space that are no different than the ―real world.‖
o
FOLLOW EXISTING POLICIES: Any use of Social Media sites that violates any
Company policy, including the Acceptable Use Policy, and The Spirit & Letter, even
when done with personal resources, on the road or from home, is prohibited.
o
POSTING ANY GE CONFIDENTIAL, RESTRICTED OR OTHER PROPRIETARY
INFORMATION, CONTENT OR FILES, OR ANY MATERIAL-NONPUBLIC
INFORMATION ON SOCIAL MEDIA SITES IS PROHIBITED. Similarly, don’t post any
non-public or proprietary information about any Company competitor.
o
DON’T MISUSE COMPANY RESOURCES: You may not create, host or maintain a
Social Media sites using Company resources unless you’re authorized to act for the
Company. You may however access and post to Social Media sites from work
(subject to this Guideline).
o
AVOID SOCIAL MEDIA SITE ACTIVITY THAT INTERFERES WITH YOUR WORK
COMMITMENTS: Don’t allow workplace access to Social Media sites to become a
distraction to you or your co-workers. This includes excessive personal use or any
personal-business use of Social Media sites. Remember that such access, where
granted, is a privilege, and it may be revoked or restricted.
GE Internal
Page 19 of 24
Subject:
May 1, 2009
o
Revision Dates:
Effective Date:
Policy No.: IT-5
WHEN IN DOUBT – ASK BEFORE YOU ACT: You’re responsible for your actions.
Whatever you do or say on Social Media sites may be viewed by work colleagues,
customers, regulators or the media. Think before you act or post. If you’re not sure
if certain conduct online is appropriate or legal, consult your business Compliance,
Legal, Information Security, Privacy or Communications Leader, HR manager or
direct manager.
KEEPING YOURSELF AND THE COMPANY SEPARATE, EXCEPT WHERE APPROVED
o
DON’T SPEAK FOR THE COMPANY UNLESS IT’S YOUR JOB: Each business has
guidelines for speaking on the Company’s behalf and responding to media
inquiries. Unless it’s your job to speak on behalf of the Company, you may not
create an appearance that you’re doing so. When in doubt, consult your
Communications Leader for further guidance.
o
DON’T MAKE PREDICTIVE OR FORWARD LOOKING STATEMENTS: You should not
say anything that may reveal the Company’s business strategy or future
performance. Don’t discuss financial performance or litigation/legal proceedings or
Company business-related rumors. GE is a publicly traded company with
designated professionals who are authorized to comment on such matters. Your
comments, especially if perceived to come from a ―knowledgeable insider‖ could
create exposure.
o
DON’T USE THE GE EMAIL: Using your GE email account to join or interact with any
Social Media sites isn’t permitted unless: (i) you have a formal role in using the site
as a Company communicator or spokesperson; (ii) you’re using the site on behalf of
the Company with your manager’s approval; or (iii) this is expressly required by a
site which has a professional use (e.g., Yammer). All other activities that are
conducted in your personal capacity require that you use a personal email.
Adhering to this rule will reduce the appearance of personal activities being
sponsored by or pertaining to the Company and also reduces the likelihood of
phishing attempts against Company workers.
o
MAKE SURE THAT IT’S ALWAYS CLEAR THAT YOUR VIEWS ARE PERSONAL: Unless
it’s your job to represent the Company, avoid using GE indicators (like a GE email or
your title) when posting comments on Social Media sites. You may, however, use
your Company relationship and title in your profile when using a professional Social
Media site such as LinkedIn. Where possible, speak in the first person (―I‖). If you
find a need to identify yourself in any way as affiliated with the Company, or are
known as such (for example on LinkedIn, or by joining a Company Facebook group),
exercise care before discussing anything related to the Company; if you find that
you must say something concerning the Company use a prominent disclaimer
GE Internal
Page 20 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
indicating that your comments represent your personal views and don’t represent
the Company’s views.
o
AVOID MISUSE OF GE’S BRAND: Don’t use any GE logos or trademarks to create
the impression that your communication is attributable to or approved by the
Company unless specifically authorized to do so. This includes use of the GE email
(see above), use of the GE Monogram in connection with any online group you form
(e.g., on LinkedIn or Facebook), or use of a GE brand in your online name or handle.
o
USE OF SOCIAL MEDIA AS A BUSINESS TOOL: Social Media sites can be effective
outreach and marketing tools when used thoughtfully. If you have a business need
to create a presence on Social Media sites for which you identify your Company
affiliation (e.g., a Facebook page or a LinkedIn group) you must contact your
Communications Leader, and in some cases, business legal counsel, to get their
advice; always follow any business specific rules or procedures that apply.
o
USE OF SOCIAL MEDIA SITES FOR COVERT MARKETING OR PUBLIC RELATIONS: If
it’s not your job to engage in marketing or public relations on behalf of the
Company then don’t. Even if it’s your job, don’t engage in such activities that do not
identify the Company or you as a Company worker. If you discuss a Company
product or service, or one offered by a competitor, you must clearly disclose your
relationship with the Company.
PARTICIPATE INTELLIGENTLY AND SECURELY
o
BEHAVE SECURELY: Be cautious about clicking on links embedded in Social Media
sites or downloading applications. Sites like Facebook and Twitter have sometimes
unwittingly displayed links to malicious applications that can damage computers
and/or steal information. Beware of imposters pretending to be someone else, and
individuals who post comments using only pseudonyms. Don’t accept friend
requests from strangers and don’t befriend anyone whom you don’t know. Avoid
anything that sounds too good to be true – it probably is. Remember that Social
Media sites have become a prime target for cybercriminals; don’t become a victim.
o
KNOW WHO OWNS THE SITE: Before participating in any Social Media site, make
sure you understand if this is a Company or GE owned site or external; what the
access and security controls are, and what content is appropriate for
posting/sharing. Some Social Media sites may have a dedicated GE area, or what
appears to be a GE sponsored area (e.g., Yammer), but that area may not be a safe
place to post Company content. When your main goal is to share data internally,
always use resources that are approved for business use (e.g., GE Connect).
o
RESPECT YOUR AND OTHERS’ PRIVACY: Avoid sharing your personal information
or that of others beyond what’s absolutely necessary; in general, identifying
GE Internal
Page 21 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
information posted online should be extremely limited.
Remember that
cybercriminals search for personal information online, and may use it for identity
theft and other types of fraud.
o
CONNECTING WITH CO-WORKERS: Before inviting or accepting an invitation from
a co-worker to connect with you on a Social Media site, ask yourself if that online
connection is appropriate. Employees may not feel comfortable with a ―friend
request‖ from a manager and managers may feel uncomfortable with requests
from members of their teams. While you may have meaningful friendships that
lead to such connections, exercise good judgment in initiating or accepting them.
When in doubt consult HR, Legal, or Compliance.
o
CONNECTING WITH CUSTOMERS AND SUPPLIERS: Before inviting or accepting an
invitation from a Company Customer or Supplier to connect with you on a Social
Media site, ask yourself if that online connection is appropriate. While you may
have meaningful friendships that lead to such connections, exercise good
judgment in initiating or accepting them. When in doubt consult Compliance, Legal,
Sourcing, or your direct manager.
o
SPECIAL RULES FOR HIRING: GE has special guidelines on the use of Social Media
sites for screening/hiring employment candidates. Consult those guidelines before
acting, and when in doubt, always consult HR and Labor & Employment counsel in
your jurisdiction.
GUIDANCE FOR SMART COMMUNICATIONS
o
EXERCISE GOOD JUDGMENT AND USE COMMON SENSE when posting, blogging,
chatting or communicating on Social Media sites or through any electronic means
like email: don’t say anything that you wouldn’t say in writing and don’t post or
upload anything you might not want the world to see. Don’t assume that your post
will remain private amongst your friends or not find its way into the workplace.
There’s no online ―recall‖ button – removing content isn’t always easy and even if
you succeed, Internet search engines never forget anything and your deleted post
may live on in search engines. And remember, you may have personal liability for
comments that are defamatory, libelous, obscene or violate a law.
o
BE RESPECTFUL of GE, its officers, employees, shareholders, customers, suppliers,
partners and competitors. Posts that malign individuals or other businesses, or
which expose Company proprietary information can create legal exposure for the
Company, and for those who post such comments. Uploading compromising
photographs of co-workers is inappropriate. Be respectful of others when you reply
to their posts or comments. Avoid divisive issues such as religion, politics or
social/political advocacy your comments might be perceived to be an official
Company position or opinion. Do not disparage Company products or services.
GE Internal
Page 22 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
Remember that what you post can migrate into the workplace and/or come to the
attention of customers and other Company partners. To be clear, this rule doesn’t
seek to prohibit any honest and accurate comments you may have about the
Company or GE – you’re free to express your views (even if negative). Nothing
herein precludes any discussion covered by the NLRA or equivalent foreign laws
covering concerted activity or revoke any rights granted to you by local law.
o
BE ACCURATE AND TRANSPARENT: If you make a mistake, promptly correct it.
Avoid posting comments that include rumors, or misleading information. Stay
timely and keep posted information up to date. Indicate changes when altering a
previous post or comment. Remember that the Internet has a long memory, and
that even deleted postings may be searchable. Never post intentionally inaccurate
information about the Company or its officers, employees, shareholders, customers,
suppliers, partners or competitors.
GE Internal
Page 23 of 24
Subject:
May 1, 2009
Revision Dates:
Effective Date:
Policy No.: IT-5
APPENDIX B
LINKS TO OTHER POLICIES MENTIONED IN THIS POLICY
The GECC Information Security Policy and other Information Security guidelines and
information can be found on the GECC Information Security Portal:
http://supportcentral.ge.com/products/sup_products.asp?prod_id=120895
The GECC Sourcing Policy, Records Retention Policy and other GECC policies can be found
on the GECC Policy Portal:
http://corp.home.ge.com/portal/site/gecfinsidecompliance/menuitem.bff63188bc18a07fc5
e793104ecda730
GE’s EDPS and other information on data privacy policies rules and information can be
found on the GECC Privacy Portal:
http://supportcentral.ge.com/products/sup_products.asp?prod_id=26719
All Spirit & Letter policies can be found on the GE Compliance Portal:
http://integrity.ge.com/
The GE Software Use Policy/Guide can be found here:
http://data.supportcentral.ge.com/upload/37462/doc_1612873.pdf
Other helpful links:
GE’s Global Security Website is here: http://security.ge.com
GE Internal
Page 24 of 24

GECC ACCEPTABLE USE OF COMPANY INFORMATION SOURCES POLICY

Transcription

Similar documents

Newsletter 7 1984 - Tools and Trades History Society

Form 990 for GLADWYNE MONTESSORI SCHOOL (23

Privacy Act Data Cover Sheet DOCUMENTS ENCLOSED ARE SUBJECT

OMCC Executive: OMCC Coordinators:

CycleFIT - District of West Vancouver

fsource.org

FOIPPA Toolkit

Restraining Order Against Sam Lufti

Presentation

PIPEDA 101 PowerPoint (Done by Communications)

PIPEDA 101 PowerPoint (Done by Communications)