The purpose of an IT policy is to establish clear parameters for how councillors, staff, and other authorised users use council-provided technology or equipment in the course of their duties. A well-defined policy helps to:
As an IT provider, the council has the right to monitor the use of its IT equipment and systems, provided there is a legitimate reason for doing so and councillors, employees, and other authorised users are informed that such monitoring may take place. Any monitoring must be proportionate and comply with relevant data protection and privacy laws. Other persons may be included if they access or use council systems, for example if they have a council email address.
This policy applies to all councillors, staff, and other authorised users, regardless of their working location or pattern, including those who are home-based, office-based, or work on a flexible or part-time basis. It sets out the expectations for the appropriate use of IT equipment and systems provided by the council.
1.1.1 Council computer equipment is provided for council purposes only.
1.1.2 All councillors, staff, and other authorised users must lock their computers when leaving their desks to prevent unauthorised access. This applies to all council and personal devices used for work. Failure to comply may lead to disciplinary action.
1.1.3 All computer and electronic equipment supplied should be treated with care at all times. Damage sustained will have a financial impact on the council.
1.1.4 Equipment should be kept clean and protected from food and drink spills.
1.1.5 Equipment should not be dismantled or reassembled without advice.
1.1.6 Councillors, staff, and other authorised users must not purchase computer or mobile equipment, including software, unless authorised.
1.1.7 Personal storage devices such as USB sticks, CDs, DVDs, and other media must not be used on council computers without prior approval.
2.1.1 Portable equipment includes laptops, netbooks, tablets, mobile phones, and smartphones with internet or email access.
2.1.2 Council backup procedures for portable equipment must be followed at all times.
2.1.3 Portable devices must be stored securely when not in use.
2.1.4 All portable devices must be protected with encryption and pin codes. Where possible, automatic wipe functions should be enabled after repeated failed login attempts. Security settings must not be removed.
2.1.5 Loss or damage of portable equipment must be reported to the council. Where negligence applies, the individual may be liable for the first £100 of loss or damage.
2.1.6 Photographs or videos must not be taken on council premises without written permission unless required for work.
2.1.7 Non-public meetings or conversations must not be recorded without permission.
2.1.8 Webcams may only be used for council conference calls.
2.2.2 The council permits personal devices to be used for council business at its discretion, provided devices are kept up to date and secure.
2.2.3 The same security precautions apply to personal devices as council equipment. Emails must be sent using council email accounts.
2.2.4 All devices must be used ethically and appropriately. Accessing illegal or inappropriate material may result in disciplinary action.
2.2.5 Devices may be temporarily taken by the council during legal proceedings to retrieve relevant data.
2.2.6 Users should keep personal and council data separate wherever possible.
2.2.7 Councillors, staff, and authorised users must:
2.2.8 Council data must not be saved to personal cloud storage services.
2.2.9 Sensitive and personal information must never be saved on personal devices.
2.2.10 Removable media must be securely wiped after use.
2.2.11 Cached attachments must be deleted immediately after use.
2.2.12 All work stored on personal equipment must be backed up securely.
2.2.13 Before disposal of devices or upon leaving the council, users must allow Whamos Ltd to remove all council data and access details.
The council will provide appropriate eye tests for display screen equipment users.
Workstation concerns or hazards must be reported immediately.
All user accounts must use strong passwords following National Cyber Security Centre guidance using three random words.
Multi-Factor Authentication should be enabled wherever possible.
Account security practices include:
The council will monitor electronic communications and internet usage in line with legislation.
Monitoring will be proportionate and subject to impact assessments.
Information may be shared internally or with professional advisers.
Data will be retained only as long as necessary.
Systems will be scanned regularly for unauthorised programs and viruses.
Email facilities are for council business only.
Users should avoid unnecessary long email chains and use appropriate communication methods.
Email access may be withdrawn if misused.
Copyright laws apply to online content and software. Unauthorised copying is prohibited and may result in legal and disciplinary action.
Users must check copyright conditions before copying material.
Domain names and trademarks relating to the council must not be registered without authorisation.
Personal data must be handled in accordance with data protection policy.
Internet information may not always be accurate and should be treated with caution.
Social media includes blogs, networking sites, messaging platforms, and multimedia services.
Personal use during working hours is not permitted.
Social media may be used for council purposes where relevant.
Inappropriate content that damages the council’s reputation may result in disciplinary action.
All users must follow strict conduct rules including:
Misuse of IT systems and equipment will be taken seriously and may result in disciplinary action or dismissal.
