Acceptable Usage Policy  

‍

This Acceptable Usage Policy covers the security and use of The Somatic School’s information and IT equipment. It also includes the use of email, internet, voice and mobile IT equipment. This policy applies to all individuals who represent The Somatic School, including employees, contractors, and authorised agents (such as consultants, partners, or volunteers with system access) (hereafter referred to as ‘individuals’).

This policy applies to all information, in whatever form, relating to The Somatic School’s business activities worldwide.

Platform Access Control – Individual’s Responsibility

Access to The Somatic School’s IT platforms is controlled by the use of User IDs, passwords and/or tokens. All User IDs and passwords are to be uniquely assigned to named individuals. Individuals are accountable for all actions on The Somatic School’s IT systems and platforms.

Individuals must not:

• Allow anyone else to use their user ID/token and password on any The Somatic School IT platform.
• Leave their user accounts logged in at an unattended and unlocked computer.
• Use someone else’s user ID and password to access The Somatic School’s IT systems, unless directed to do so by The Somatic School.
• Leave their password unprotected (for example writing it down).
• Perform any unauthorised changes to The Somatic School’s IT platforms or information.
• Attempt to access data that they are not authorised to use or access.
• Exceed the limits of their authorisation or specific business need to interrogate the system or data.
• Give or transfer The Somatic School data to any person or organisation.
  outside The Somatic School without the authority of The Somatic School..

Access Control (Password Policy)

Access to the IT platforms at The Somatic School is restricted by password authentication. Passwords will be issued by The Somatic School for certain systems, but end users will be responsible for creating their own passwords in some instances.

The School primarily employs the use of LastPass as the method for the storage and transfer of passwords. Employees are required to use LastPass for all relevant applications. 

Employees are required to abide by the School’s password policy. Here are the requirements for the usage of passwords:

• Ensure all personal computer or phone equipment which is used to access The Somatic School IT systems and platforms are password protected.
• Use LastPass to create encrypted passwords that are a minimum 16 characters long and include uppercase, lowercase, numbers and ‘randomised symbols’.
• Do not create common passwords, or passwords based on a sequential pattern, or keyboard layout pattern. For example, passwords such as ‘123456789’, ‘qwertyuio’, or ‘password1’.
• You should avoid using easily discoverable information in passwords; for example, the name of your spouse or pet, the name of the street you live on, anything that references the items around your workspace.
• If you have access to multiple systems, do not use the same password to access them all; use different passwords for each system. 
• Do not use the same passwords on The Somatic School platforms that you have applied to your own personal systems.
• End users are expected to safeguard details of their passwords or other IT credentials via LastPass; you shall be accountable for activities undertaken using your IT credentials.
• When disposing of old IT or phone equipment, ensure it is appropriately wiped.

All sharing of passwords should happen via LastPass or in urgent circumstances by Huddle (on Slack) or by telephone call. Sharing of passwords should never take place by text or email. 

Email Conditions of Use

Use of The Somatic School email is intended for business use. Personal use is permitted where such use does not affect the individual’s business performance, is not detrimental to The Somatic School in any way, not in breach of any term and condition of employment and does not place the individual or The Somatic School in breach of statutory or other legal obligations.

All individuals are accountable for their actions on the IT platforms and email systems.

Security

It is a requirement for individuals to:

• Have appropriate, up-to-date antivirus software installed on their own computers to detect and remove any virus automatically that are used to access The Somatic School’s platforms. For Apple users, inbuilt antivirus software is sufficient.
• Ensure updates on relevant software and firmware (including security updates) are set to take place automatically.
• Use secure web browsing software when using the internet to access The Somatic School’s platforms.
• Ensure personal internet routers and mobile phones used to access The Somatic School’s platforms have suitable passwords attached to them.

Telephony (Voice) Equipment Conditions of Use

Use of The Somatic School voice equipment via platforms such as Zoom Phone or Skype is intended for business use. Individuals should not use The Somatic School’s voice facilities for sending or receiving private communications on personal matters.

Actions upon Termination of Contract

All The Somatic School IT platforms must be exited and removed upon termination of an individual’s contract.

All The Somatic School data or intellectual property developed or gained during the period of employment remains the property of The Somatic School and must not be retained beyond termination or reused for any other purpose.

Breaches

All breaches of information security policies will be investigated. Where investigations reveal misconduct, disciplinary action may follow in line with The Somatic School’s disciplinary procedures.

‍