PURPOSE

As more and more users work from remote locations, the need for secure access to networks, systems and data continues to grow. This policy from TechRepublic Premium provides guidelines to help IT ensure that VPNs are properly deployed and outlines acceptable use policies for end users on company-issued and personal devices.

From the policy:

ACCEPTABLE USAGE
Hardware, software, network services and support provided by the organization for VPN or remote usage are for the exclusive purpose of performing or fulfilling job responsibilities. Use of these resources is contingent on your agreement to comply with this policy and directions for and/or restrictions of use of these resources as determined by IT personnel.

Access should be based on two-factor authentication, with passwords rotated every 60 days.

The IT department must only provide the level of access needed for employees to do their jobs. This should entail establishing a basic level of access which applies to standard user accounts to enable them to access resources such as email, IM systems, collaboration software or file storage. Extended access to specific systems should be granted via group membership/policies where possible to simplify the configuration involved.