The purpose of an IT policy is to establish clear parameters for how councillors, staff, and other authorised users use council-provided technology or equipment in the course of their duties.
A well-defined policy helps to:
The council has the right to monitor the use of its IT equipment and systems, provided there is a legitimate reason for doing so and councillors, employees and other authorised users are informed that such monitoring may take place.
Any monitoring must be proportionate and comply with relevant data protection and privacy laws.
Other persons may be included if they access or use council systems, for example if they have a council email address.
This policy applies to all councillors, staff, and other authorised users regardless of their working location or pattern, including home-based, office-based or flexible working arrangements.
It sets out expectations for appropriate use of IT equipment and systems provided by the council.
1.1.1 Council computer equipment is provided for council purposes only.
1.1.2 Councillors, staff and authorised users must lock their computers when leaving their desks to prevent unauthorised access. Failure to comply may lead to disciplinary action.
1.1.3 All computer and electronic equipment supplied should be treated with care at all times.
1.1.4 Equipment should be kept clean and protected from food and drink spills.
1.1.5 Equipment should not be dismantled or reassembled without advice.
1.1.6 Councillors, staff, and authorised users must not purchase computer or mobile equipment or software without authorisation.
1.1.7 Personal storage devices such as USB sticks, CDs, DVDs or other data storage devices must not be used without prior approval.
Portable equipment includes laptops, tablets, smartphones and other devices with email or internet capability.
Backup procedures specific to portable equipment must be followed.
Portable devices must be stored securely when not in use.
Devices holding council data must be encrypted and protected with security codes and automatic wipe functionality where available.
Loss or damage must be reported. Where negligence is involved, the individual may be liable for the first £100 of loss or damage.
Photography or video recording on council premises is prohibited without written permission.
Non-public meetings or conversations must not be recorded without consent.
Webcams must only be used for council purposes.
Personal devices used for council work must follow the same security precautions as council devices.
Council email accounts must be used for council communications.
The council may temporarily take possession of devices to retrieve relevant data during legal proceedings.
Personal and council data should be kept separate.
Users must:
Personal data must not be saved to personal cloud storage services.
Sensitive council information must not be stored on personal devices.
Removable media must be securely wiped after use.
Work data must be securely stored and backed up.
Devices must be cleared of council data before disposal or when leaving the council.
The council will provide appropriate eye tests and ensure display screen equipment safety compliance.
Hazards or equipment faults must be reported immediately.
All user accounts must be protected by strong passwords using the National Cyber Security Centre recommended three random words approach.
Multi-Factor Authentication should be enabled wherever possible.
Additional security requirements include:
The council may monitor electronic communications and internet usage to ensure compliance with this policy.
Monitoring will be proportionate and compliant with legal requirements.
Monitoring information may be shared internally or with authorised external advisers.
Monitoring data will be retained only as long as necessary.
All computers will be scanned for viruses and unauthorised software.
Email is intended for council business communication only.
Email should be used appropriately and securely.
Email access may be withdrawn if misuse occurs.
Copyright laws apply to internet materials including documents and software.
Unauthorised copying is prohibited and may result in disciplinary action.
Domain registration or linking related to the council must not occur without authorisation.
Personal data must be handled in accordance with data protection legislation.
Internet information may not always be accurate and should be verified where appropriate.
Social media use must be professional and responsible.
Personal use during working hours is not permitted.
Users must:
The council may monitor external social media postings.
Users must not misuse social media or misrepresent the council.
Misuse of IT systems and equipment may result in disciplinary action or dismissal.