Laptop Encryption Policy

Date Issued for Approvals: XXMAY2011 Prepared by: Rajaram Pejaver, Security Architect, Information Technology Approved by: Kurt palmer, Director, Information Technology Approved by: Tom Devine, Executive VP, Development & Chief Development Officer
Titles indicated are reflective of area of responsibility at time of approval. Electronic signatures for all approvers are maintained on file. Purpose

a. The purpose of this policy is to define acceptable configurations of whole disk encryption on company owned laptop computers that may contain sensitive data. b. Laptops of senior staff often contain sensitive and privileged information. Release of this information to unauthorized persons will place the company at undue risk. Loss or theft of laptops will most probably lead to the compromise of the unprotected data that it contains. c. Encrypting the hard disk is a convenient and satisfactory method of mitigating this risk. d. This policy shall be enforced and periodically maintained by <Policy authority.>
Scope

a. This policy applies to all staff members that have access to sensitive or business critical information. This information includes the companys financial information and forecasts, plans regarding the companys strategy, proposals for new products, etc. b. The policy also applies to sensitive information obtained under non-disclosure agreements with other companies. c. Who may be exempt? d. Definitions?
Policy

a. All laptops that may at some time carry sensitive information must be equipped with an approved full-disk encryption product. b. Only approved encryption products and configurations may be used. It is a violation of this policy for users to install any other products or tools for this purpose. c. Only laptop models that are supported by the approved products may be used. d. It is a violation of policy for anyone to attempt to bypass, to penetrate, to alter the configuration of, or to otherwise affect the operation of any encrypted laptop hard drive(s).
Related Policies & Standards

a. Remote Access Policy Sensitive company data must not be downloaded or stored on unprotected devices, like home computers, public kiosks, etc. 1 Laptop Encryption Policy Version 1, XXMAR2011

b. Data Protection Policy Employee responsibilities c. Laptop Encryption Standard Product, configuration, alternatives d. Laptop Security Configuration Standard AutoStart, USB, Virus/Malware protection, host firewall,
Enforcement All employees are subject to this policy and any violations of this policy will be subject to correction. RECORD RETENTION All documents (electronic or hard copy) produced in accordance with this SOP, shall be retained in accordance with the ERT Record Retention Policy.

2 Laptop Encryption Policy Version 1, XXMAR2011