LAB³ Acceptable Use

Purpose

It goes without saying, technology is one of the most valuable resources in our business. The appropriate use of this technology is not only essential to the day-to-day running of our business, but to our client’s. Keeping our technology safe, secure, and operational is also critical to build trust and instil confidence with our existing and potential clients.

The inappropriate use of our technology could expose LAB³ to risks including virus and malicious software attacks, theft and unauthorised disclosure of information, disruption of systems and services or litigation.

The purpose of this policy is to provide you with clear guidance on the appropriate, safe, and legal way in which you can make use of our IT systems and IT equipment to ensure:

• They are secure

• Our network is operating at optimal efficiency levels

• Users are protected from access to or distribution of inappropriate information, material, or data.

LAB³‘s Information Security policies have been broken down into categories to make it easier for you to find relevant information quickly and easily within Confluence.

Scope Definitions

Acceptable Use

When using LAB³ Systems and LAB³ Equipment, the following principles apply:

• Only use LAB³ Systems and LAB³ Equipment in a manner which is lawful, ethical, and efficient.

• Always respect the rights and property of others, including privacy, confidentiality, and intellectual property.

• Never do anything that will compromise the integrity and security of LAB³ Systems and LAB³ Equipment.

• All LAB³ Systems and LAB³ Equipment and any software, applications developed or purchased on them including any LAB³ or LAB³ client information remains the property of LAB³ and must not be used, copied, distributed or borrowed without LAB³’s authorisation.

Unacceptable Use

The following activities are, in general, prohibited. They are by no means exhaustive but attempt to provide a framework for activities which fall into the category of unacceptable use. When using LAB³’s Systems and LAB³ Equipment you must not use them:

• For private business, advertising or performing work for personal gain or profit

• For political activities, such as promoting a political party / movement, or a candidate for political office, or campaigning for or against government decisions

• To knowingly misrepresent LAB³

• To transmit Confidential Information outside LAB³ unless the information has been encrypted and transmission has been authorised by your LAB³ line manager

• To create, view, download, host or transmit Material of a pornographic or sexual nature or which may generally be considered offensive or obscene and could cause offence to others on the grounds of race, creed, gender, sexual orientation, disability, age or political beliefs

• To retrieve, create, host or transmit Material which is defamatory

• For any activity that would compromise the privacy of others

• For any activity that would intentionally cause disruption, corruption or destruction to systems or networks belonging to LAB³ or others

• For any activity that would intentionally compromise the security of LAB³ Systems and LAB³ Equipment, including the confidentiality and integrity of information and availability of resources (i.e., by deliberately or carelessly causing computer virus and malicious software infection)

• For the installation and use of software or hardware tools which could be used to probe or break LAB³ Systems, LAB³ Equipment or security controls

• To gain access to LAB³ Systems or information belonging to the LAB³ or others which you are not authorised to access

• For creating or transmitting “junk” or “spam” emails. This includes but is not limited to unsolicited commercial emails, jokes, chain-letters or advertisements

• For any activity that would cause harm to LAB³ or constitute a criminal offence, give rise to a civil liability, or otherwise violate any law.

Access and Passwords

On completing the LAB³ User Registration Form and with the appropriate approvals, you will be granted access to LAB³ Systems required to carry out the duties of your role. Access may be denied or revoked if there is no legitimate business requirement, if there is a suspected risk to the security or integrity of the environment, or if this policy is not adhered to.

System level and user level passwords must comply with our System Hardening Policy and must be kept confidential to avoid unauthorised access. You must never use another person’s login or password to access LAB³ Systems or LAB³ Equipment. You will be required to change your password at regular intervals, or when prompted to do so by the system.

Access to LAB³ Systems and LAB³ Equipment is also contingent on you ensuring:

• You complete the relevant Cyber Security Awareness training on an annual basis.

• All mobile and computing devices that connect to LAB³’s network comply with our Enterprise Mobility Policy.

• All computing devices are secured with a password-protected screensaver with the automatic activation feature set to 10 minutes or less.

• That you lock the screen or log off when the device is unattended.

• That all LAB³ Systems and LAB³ Equipment are not accessed (including internet access) by persons who are not authorised.

• Applications needed in addition to the standard offering, are approved by your Director via a Service Now request.

It is a mandatory requirement that all LAB³ Systems, LAB³ Equipment (excluding BYO devices) and Material be returned to LAB³ no later than the last day of your employment with LAB³. Employees will have all access to LAB³ Systems revoked and any BYO devices deregistered from the Company Portal no later than their last day of employment with LAB³.

Privileged Access

Privileged access (if granted) enables you to take actions that may affect LAB³’s Systems or the accounts, files, data or processes of other users. Privileged access is typically granted to system administrators, network administrators, or other users whose job requires special privileges over LAB³’s Systems.

If you are granted privileged access, you must:

• Respect the rights of system users and respect the integrity of LAB³’s Systems

• Not browse another user’s files, directories or email unless authorised to do so by the Chief Information Security Officer, Chief Executive Officer or the Chief Operating Officer.

• Not use privileged access accounts to create temporary files or directories for your personal use.

• Not make changes related to your own accounts.

Data Classification

The classification of data helps us determine what baseline security controls are appropriate for safeguarding that data. LAB³ applies the following data classification principals:

• Data generated within LAB³ about LAB³ Systems which is for internal LAB³ consumption is classified as LAB3 SENSITIVE, unless declassified by a member of the LAB³ Senior Leadership Team.

• Data generated by LAB³ users for clients will have the classification assigned to it by the client’s system owner.

• Data generated within LAB³ about client systems which is for internal LAB³ consumption is classified as COMMERCIAL-IN-CONFIDENCE and requires a need-to-know for any form of dissemination.

At no point are you permitted to process Federal Government rated classified material (UNCLAFFIFIED-DLM, OFFICIAL, PROTECTED, SECRET, TOP-SECRET, CABINET-IN-CONFIDENCE etc) on any LAB³ System or LAB³ Equipment.

Monitoring

Firstly, whenever you use LAB³ Systems and LAB³ Equipment you should not consider that use private. We routinely monitor, log, and record all use of our IT resources for the purposes of helping to trace and resolve technical faults and investigating actual and suspected security breaches and or inappropriate use.

Refer to our Workplace Surveillance Policy for additional detail.

Personal Use

LAB³ Systems and LAB³ Equipment are to be used primarily for LAB³ business-related purposes. You can make use of these resources for occasional personal use provided it:

• Is not excessive

• Does not interfere with your performance or the performance of others

• Does not incur unwarranted expense or liability for LAB³

• Does not have a negative impact on LAB³ in any way

• Does not involve commercial activities, such as running any sort of private business, advertising or performing work for personal gain or profit

• Is lawful and complies with this policy and all other relevant LAB³ policies.

You are not permitted to use client systems and/or equipment (including a network connection) for personal use.

Blogging and Social Media

Blogging, whether using LAB³ Equipment, LAB³ Systems or personal computer systems, is also subject to the terms and restrictions set out in this policy. Blogging is acceptable, if it is done in a professional and responsible manner, does not otherwise violate LAB³’s policy and is not detrimental to LAB³’s best interests.

When engaged in blogging, always be aware of and not reveal any Confidential Information or any other material covered by the confidentiality requirements outlined in your Employment Agreement or Independent Contract Agreement.

When engaged in blogging or on social media, attributing personal statements, opinions or beliefs to LAB³ or expressing your beliefs and/or opinions whilst expressly or implicitly representing yourself as an employee or representative of LAB³ is not permitted without the permission of the Chief Operating Officer.

Confidentiality and Privacy

In the course of your work at LAB³, you may have access to privileged or sensitive information. Such information irrespective of the format (e.g., paper, electronic or otherwise) is strictly confidential and must always be safeguarded.

Refer to our Privacy Policy to further understand how we handle and protect personal and sensitive information.

Software and Electronic Media

Only software which has the correct and proper licence may be installed and used on any LAB³ Equipment.

Mobile and smart device application software (e.g., apps) must only be downloaded and installed on LAB³ Equipment where there is a valid business reason, and the software adds value to your work. We reserve the right to remove software at any time and for any reason.

Digital Preservation

LAB³ personnel should ensure that digital information of continuing value remains accessible and usable via one of the following LAB³ owned and approved applications:

• Confluence

• GitHub

• Kimble

• PeopleStreme

• ServiceNow

• SharePoint

• Teams

LAB³ personnel should also ensure that any non-digital material is reformatted into digital content and that the digital content is accessible regardless of the challenges of media failure and technological change.

Devices and Equipment

All devices and equipment provided by LAB³ remain the property of LAB³. Except for the laptop and mobile phone device (if applicable) assigned to you, you must not remove or borrow our devices or equipment without the authorisation of your line manager.

You must ensure that LAB³ Systems and LAB³ Equipment are always protected and adhere to all our security protocols.

If requested to by us or a client, you must return any LAB³ Equipment in your possession to the appropriate person.

You must take due care when using LAB³ Equipment and take all reasonable steps to ensure that no damage is caused. Immediately report all damaged, lost, or stolen LAB³ Equipment to your line manager.

Always operate a clear screen policy and log off or ‘lock’ your computer when you leave it unattended for any period.

Although LAB³ devices will be ‘locked’ when unattended, if users do not have line of sight vision to their devices, the devices must be locked in a cabinet or carried by the user on their person, especially and at the end of the each working day.

Always operate a clear desk policy and clear your desks of all Confidential Information (irrespective of the format) at the end of each working day or when leaving your workplace for a major part of the day.

When leaving the office all LAB³ Equipment must be physically secured (e.g., locked in a drawer or secured to a desk or some other stationary object using an appropriate locking mechanism) in such a way as to minimise the risk of theft. LAB³ Equipment must not be left unattended when working off-site.

In public places, you need to take precautions to ensure the information on any LAB³ Equipment cannot be viewed by others.

LAB³ Network

Access to our network domains and network resources is controlled and managed by the Managed Services team.

You must not, without the prior authorisation from the Chief Information Security Officer, connect any IT devices and equipment, laptop, smart device, mobile phone device or removable storage device which belongs to you and is not owned or managed by LAB³ to a LAB³ network unless it is in accordance with our Enterprise Mobility Policy.

Information Storage and Transfer

Any data and information stored on LAB³ Systems and LAB³ Equipment must not to be distributed or downloaded onto portable devices without the consent of your line manager or Director. Users are strictly prohibited from hosting/storing Confidential Information on any personal device or public cloud (i.e., not owned or leased by LAB³).

Personal music, videos and photos are not to be stored on any LAB³ System or LAB³ Equipment.

Where it is necessary to transfer Confidential Information to third parties, only the minimum amount of information should be transferred as is necessary for a given task to be carried out. Where possible all transfer(s) of this information should take place electronically via secure channels (e.g., secure FTP, TLS, VPN etc) or encrypted email.

In circumstances where electronic transfer is not possible, Confidential Information may be transferred manually using a removable storage device provided the removable storage device or the information is encrypted, as verified by the LAB³ Service Desk or Managed Services Team.

BYO Devices

To access LAB³’s data using a BYO device, you must first register your device with the “Company Portal” – the application which authorises your mobile device to access LAB³ data by using certificates.

To maintain high standards of information security, all devices registered with the Company Portal will be monitored by the LAB³ Security Operations Centre and will immediately be deregistered if they become non-compliant.

The Company Portal does not provide access to your personal data on registered devices – it will only control the access to LAB³ applications and their data.

Working from Home (WFH)

If you work from home or another remote location you must take all reasonable measures to ensure that all LAB³ Systems and LAB³ Equipment are kept secure and are protected against unauthorised access, damage, loss, theft, or computer viruses.

You must also ensure that all:

• Work carried out by you on behalf of LAB³ is processed on a LAB³ compliant device

• LAB³ data is stored on LAB³ owned and approved applications and not on any other device or application which is your personal property or the personal property of another household member

• Computer or laptop devices used by you to work from home have LAB³ approved encryption software installed and approved anti-virus software installed which is kept up to date

• Confidential Information which is accessed by you or stored on LAB³ Equipment is always kept secure and confidential

• LAB³ Equipment and information is not accessed by members of your family, other household members or visitors

• LAB³ Equipment and information (irrespective of the format) is securely locked away when not in use.

Exceptions

Any exception to this policy must be approved by LAB³’s Chief Information Security Officer in advance.

Non-Compliance

The adherence of this policy is critical to the work we do and the trust our clients place in us. If you violate this policy, you may be subject to disciplinary action, up to and including the termination of your employment.

Changes to this Policy

This policy will be reviewed and updated annually or more frequently, if necessary, to ensure any changes to LAB³’s business practices, legislative and regulatory standards or other matters which could affect this policy are properly reflected in this policy.