Information Technology Policy

INFORMATION TECHNOLOGY POLICY

A. IT Usage Policy

  • A1. Acceptable Usage Policy
  • A2. Official Email Policy

B. IT Security Policy

  • B1. Physical Security Policy
  • B2. Password Policy
  • B3. Anti-Virus Policy
  • B4. Server Security Policy

C. Assets Administration and Management Policy

  • C1. Remote Access Policy
  • C2. IT Operation Policy
  • C3. IT Inventory Policy

D. In House Software Development Policy
E. Third Party Engagement Policy
F. Disaster Management Policy & Business Continuity Plan
G. System Audit Policy

Introduction:

Information Technology has brought momentous transformation in any industry. Moreover information and information technology systems are essential assets of financial institution as well as for customers and stakeholders. A comprehensive IT Policy is essential for proper and lawful development, management, maintenance, security and uses of IT assets.

Pandinadu Finance Company Private Limited (PFC) has prepared this IT Policy to use as a minimum requirement and as appropriate to the level of its IT operation.

A. IT Usage

A1. Acceptable Usage

All computers must be appropriately used and protected to reduce PFC’s risks from viruses, Trojan and worm attacks, denial of service attacks, disruption of operations and services, and litigation.

Implementation

General Use and Ownership

  1. Users should be aware that the data they create on the corporate systems remains the property of PFC.
  2. At no time during business hours should employees be playing computer games, doing non-business correspondence or using the internet for downloading images or for online messaging.
  3. Authorized individuals within PFC may monitor equipment, systems and network traffic at any time.
  4. PFC reserves the right to audit networks and systems on a periodic basis.

Security and Propriety Information

  1. All users shall follow a formal authorization process before making any propriety information, publicly available.
  2. System level passwords and user level password should be changed once in six months.
  3. Employees must use extreme caution when opening e-mail attachments of unknown senders.

System and Network Activities

The following activities are strictly prohibited with no exception:

  1. Unauthorized copying of copyrighted material.
  2. Introduction of malicious programs into the network or server.
  3. Revealing your account password to others or allowing use of your account by others.
  4. Providing information about, or list of, PFC employees to parties outside PFC.

A2. Official Email

Email must be used carefully to avoid viruses and to avoid releasing confidential material. Email is inherently lacking in security and authenticity. The design of the mail system requires copies of your email to be stored in intermediate servers which can be easily scanned for confidential information. As well, simply changing the header information can make email appear to be from someone other than the originator.

Implementation:

  1. A formal authorization process is to be followed for allocation of official email ids.
  2. No email attachments having .vbs/ .exe/ .api extensions or any other file of executable nature shall be exchanged or downloaded by employees.
  3. No employee shall exchange propriety data over email except within the Office network.
  4. Employees shall not indulge in any communication of information pertaining to religion, politics or other personal opinions, which are not job-related.
  5. No one shall exchange any obscene messages or any information that can be deemed to be pornographic.
  6. No use of personal email account shall be allowed using the organization computing resources.
  7. Unless approved by authorised person, email will not be automatically forwarded to an external destination.

B. IT Security

B1. Physical Security

Modern world is fully dependent on information systems, technology and networking. Therefore in addition to electronic and data access control the Servers and other area containing sensitive information need physical and environmental control. The purpose of this policy is to establish standard policy to prevent unauthorized physical access, damage and interference to servers and information system.

Physical Security Guideline

Server Access

  1. Server should be under the control and supervision of responsible person of the Branch.
  2. Access Authorization list must be maintained and reviewed on regular basis.

Environmental

  1. Power backup must be in place to continue the operations in case of power failure.
  2. Proper attention must be given on overloading electrical outlets with too many devices.

Fire protection

  1. Channel alongside the wall to be prepared to allow all the cabling to be in neat and in safe position.
  2. Proper earthing of electricity to be ensured.

Physical security for Desktop and Laptop computers:

  1. Desktop and laptop computer should be connected to UPS to prevent damage of data and hardware.
  2. Password protected screen saver should be used to protect desktop and laptop from unauthorized access.

B2. Password

Passwords are an important and primary aspect of computer security. They are the front line of protection for user accounts.

  1. The allocation and selection of passwords shall be strictly in conformance of this policy.
  2. All system-level passwords and user-level passwords must be changed at least once in six months. However the recommended change interval is once in three months.
  3. Passwords must not be inserted into email messages or other forms of electronic communication.
  4. Management shall conduct a formal review of all user access rights.

General Password Construction Guidelines

Passwords are used for various purposes at PFC. Everyone should be aware of how to select strong passwords. Strong passwords have the following characteristics:

  1. Contain both upper & lower case and alpha-numeric characters.
  2. Password should contain minimum 6 characters.
  3. Password should not be based on personal information, names of family, repeated same characters, etc., which can be easily identifiable by others.
  4. Password should never be written down or stored on-line. Try to create passwords that can be easily remembered.

Password Protection Standards

Do not share PFC’s Passwords with anyone, including PFC personnel. All passwords are to be treated as sensitive, confidential PFC’s information.

Here is a list of “don’ts”:

  1. Don’t reveal a password over the phone to ANYONE.
  2. Don’t reveal a password in an email message.
  3. Don’t reveal a password even to the boss.
  4. Don’t talk about a password in front of others.
  5. Don’t hint at the format of a password (e.g., “my nick name”)
  6. Don’t reveal a password on questionnaires or security forms.
  7. Don’t share a password with family members.
  8. Don’t reveal a password to co-workers while on vacation.

Do not write down passwords and store them anywhere in your office. Do not store passwords in a file on any computer system without encryption.

B3. Anti-Virus

All computer users must avoid viruses and if a virus is detected prompt action to contain the impact must be followed.

Implementation

  1. Always run the antivirus software procured by PFC.
  2. Delete spam, chain and other junk email without forwarding.
  3. Always scan the external storage devices from an unknown source, for viruses before using it.
  4. Up-date of antivirus software should be done only from the designated source.
  5. When a virus is found, cleaning of the virus should be done.

B4. Server Security

To establish standards for the base configuration of internal server equipment that is owned and/or operated by PFC.

Implementation

  1. Operating system configuration should be in accordance with approved info security guidelines.
  2. Services and applications that are not to be used must be disabled.
  3. The most recent security patches must be installed on the system.
  4. Always use standard security principles of least required access to perform a function.
  5. Servers should be physically located in a controlled environment.

C. IT Assets Administration and Management

C1. Remote Access

To define standards for connecting to PFC’s network from any host, to minimize the potential exposure to PFC from damages, which may result from unauthorized use of PFC’s resources.

Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical internal systems etc.

Implementation

  1. Secure remote access must be strictly controlled. Control can be enforced via one-time password authentication.
  2. At no time should any PFC employee provide their login or email password to anyone, not even family members.
  3. PFC employees and contractors with remote access privileges must ensure that their PFC-owned or personal computer or workstation, which is remotely connected to PFC’s corporate network, is not connected to any other network at the same time, with the exception of personal networks that are under the complete control of the user.
  4. Personal equipment that is used to connect to PFC’s networks must meet the requirements of PFC for remote access.

C2. IT Operation

IT Operation policy will cover the dynamics of technology operational management including change management, asset management, operating environment procedures and request management. The objective is to achieve the highest levels to technology service quality by minimum operational risk.

  1. Change management
    1. All change implemented in the production environment will be governed by a formal documented process including forms with necessary change details.
    2. Audit logs of changes will be maintained available for ready references.
  2. Asset management
    1. An inventory will be kept with all significant details for hardware and software and reviewed at least once a year.
    2. All data on equipment and associated storage media must be destroyed or overwritten before sale, disposal or reissue.
  3. Operating procedures
    1. Operation procedures will exist for all functions.
    2. Changes to operating procedures will be authorized by management and documented.

C3. IT Inventory

An IT Inventory policy is essential for tracking and managing information relating PFC’s hardware, software, peripherals and all Network equipments. The inventory system is maintained within a database that ties an asset to its owner and defines the location where the asset resides.

Implementation

The objective of inventory management is to manage the physical and logical properties of Information System resources and their relationship, while ensuring that service level commitments are achieved, this process will:

  1. Ensure efficient and timely identification of vital corporate assets
  2. Description
  3. Purchase or acquisition date
  4. Vendor identification
  5. Deployment date
  6. Purchase value & book value
  7. Warranty
  8. Track record/history

D. In-House Software Development

In addition to third party software, PFC may need to develop in-house software for obvious reasons. Software development and maintenance can range from minor amendments to databases or output format to complex and substantial project for major systems development.

Implementation

  1. Controlling Software Code
    1. Managing Operational Program Libraries
    2. Managing Operational Source Libraries
    3. Controlling Software Code during Software Development
    4. Controlling Program Listings
    5. Controlling Program Source Libraries
    6. Making Emergency Amendments
    7. Establishing ownership for system enhancement
    8. Justifying New System Development of Enhancement
    9. Controlling Old Versions of Programs
  2. Separating System Development and Operation
    Production computing environments shall be either logically or physically separate from development and test environments. Developer access to production environments shall be prohibited or limited to troubleshooting and all activity recorded and monitored.
  3. Testing and Training
    The goals and objectives of software testing are: Finding defects which may might have created by the programmer while developing the software. Gaining confidence in and providing information about the level of quality. To prevent defects. To make sure that the end result meets the business and user requirements.
    In simple terms, training that involves using a company’s own expertise and resources is highly specific and geared toward employees learning the ropes of your business.

E. Third Party Engagement

E1. External company data network connections to PFC can create potential security exposures if not administered and managed correctly and consistently. All requests for third party connections must be made using the appropriate method based on the support organization. All third party connection requests must be duly approved by the higher level.

Services provided:

In general, services provided over third party network connections should be limited only to those services needed, and only to those devices (hosts, routers, etc.) needed. Blanket access will not be provided for anyone.

Protection of company private information and resources

PFC network support group is responsible for the installation and configuration of a specific third party connection must ensure that all possible measures have been taken to protect the integrity and privacy of PFC’s confidential information. At no time should PFC rely on access/authorization control mechanisms at the third party’s site to protect or prohibit access to PFC’s confidential information.

Audit and Review of third party network and connections

All aspects of third party network connections – up to, but not including Company’s firewall, will be monitored by the appropriate PFC network support group. Wherever possible, automated tools will be used to accomplish the auditing tasks.

E2. Third Party Agreement

To maintain the security of the organizational information processing facilities and information assets accessed or processed by third party. All arrangements involving third-party access to organizational information processing facilities shall be based on this formal contract only.

CLOUD SERVICE / CLOUD COMPUTING.

Company shall go for cloud service with any vendor. At the time of engaging the service the following terms in a cloud service agreement may be included.

  • rights to use the service;
  • payment obligations;
  • acceptable use policies;
  • service levels: maintenance, availability and support;
  • service upgrades;
  • rights of termination;
  • customer access to data, including upon termination;
  • data theft and
  • down time.

F. Disaster Management

(Disaster Recovery and Business Continuity Plan)

Financial Institutions were among the earliest adopters of information technology in the business world. They embraced the benefits of computers almost from the birth of the high-tech industry. Disaster recovery (DR) is the process of restoring the entire institution’s ability to function following a disaster.

Disaster recovery plan

A disaster recovery planning project cannot be completed in a week or even in a month. It is a long term project and once completed, the plan must be maintained and kept current. Basically disaster recovery plan includes three core steps:-

  • Phase 1: Plan initiation & Damage Assessment: When a disaster disrupts scheduled IT Operations, a team of people will be responsible for determining the extent of the disaster and the severity of the disaster.
  • Phase 2: Recovery Process: Based upon the severity of destruction, the damage assessment team will formulate a task schedule to restore its operations.
  • Phase 3: Resuming Normal Operation: This phase enables PFC to get back to its normal operational procedures by restoring the Data Center (DC). This may require an undefined time frame depending upon the impact of the disaster.

Further, DR drill should be conducted once in a year and the details of the same should be recorded.

G. System Audit

Members of PFC’s information security Department must conduct security audit on any system at PFC to maximize effectiveness of systems audits and minimize interference to business processes.

Implementation

When requested and for the purpose of performing an audit, any access needed will be provided to PFC’s information security department personnel. This audit may include:

  1. User level and/or system level access to any computing or communications device
  2. Access to information (electronic, hardcopy, etc.) that may be produced, transmitted or stored on PFC’s equipment or premises.
  3. Access to work areas.
  4. Access to interactively monitor and log traffic on PFC’s networks.
  5. Access to audit tools shall be protected to prevent any possible misuse or compromise.