We are getting ready to tackle the whole subject of people bringing tablets, etc. from home to work. We are a midsize company with 6 locations.
I'm curious what others have implemented in terms of AUP (acceptable use policies) and management software. I realize this question doesn't have a clear cut answer for every situation.
What are the main points I should take into consideration when developing this policy? (e.g. in regards to restrictions, policing, acceptable circumstances)
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
The company's legitimate concerns include:
Connecting outside devices (and their potential malware) to the corporate network
Having company files on non-company machines (that can be lost/stolen/compromised)
This does not add up to "no outside devices", but it does mean you might place some restrictions on them. I work for a large company that does not permit outside machines on the network or company files on non-company machines; that doesn't mean I can't have my smartphone with me. I could bring in a tablet or an e-book reader if I wanted to read while eating lunch, same as if I brought a paper book instead.
The company could instead place requirements on personal devices, specifying acceptable antivirus software and the like. Our IT department is challenged to keep up with the latest threats as it is and, legitimately, doesn't want the burden of also worrying about other platforms. ("Did you say Linux?", I hear them ask. :-) ) In a smaller company that might be different, but it's safest to say "bring your own network".
Notice that I didn't list as a concern "employees will goof off instead of working". They don't need their own hardware to do that; that's an orthogonal concern.
I've seen companies do everything from "no absolutely not, never, please get a permission slip for even bringing them in the building" to "sure, and we'll even pay sys admins to help you connect".
So it's all your call and something you want to figure out based on your business and your desire to facilitate this for work/life balance or employee satisfaction reasons. As usual, it's cost/schedule/quality.
Things to consider would include:
Security - may even be worth throwing the same question to IT Security Stack Exchange - your risks include - malware on user software, user devices containing files that run counter to company policy (like porn), user devices consuming resources that should be saved for company use, transfer of files from company assets to home use assets where they are less protected when the device leaves the network, use of video or picture capability on the user's machine exposing company prioprietary information.
Determining reasonable use - how you balance employee computer use during the workday - both the time it takes from regular work in the employee's time, and the network resource usage - for example, it's not OK to hose the T1 with YouTube videos on your home machine...
Any liability of the company in terms of protecting the employee's machine - if the employee's machine gets damaged because it was on the employer's networ, is the employer liable for repairing the damage?
The answer to this question largely depends on the nature of the business. It depends on how sensitive the information is that employees are exposed to, the maturity level of the employees, and whether or not the work involves collaboration with others or quiet focus. The answer depends on your organizations' risk tolerance and productivity goals.
Sensitive Personal Information:
If you work for a company that deals with a lot of very sensitive data, then bringing in any device that could be used to compromise the security and privacy of the data may fall strictly within the bounds of being completely restricted.
Cutting Edge Technologies:
Or, take Apple for instance, whose employees regularly work on cutting edge technologies. An organization such as this may also have a need to restrict the usage of personal devices on company property or even make employees sign NDA's so that they are legally liable for damages if sensitive information is leaked through the actions of that person.
However, if you're working somewhere where the sensitivity of data is not as important, then the question of "information leaks" may be a non-issue. Instead, employers may only need to focus on whether or not the devices are disruptive to the workplace.
For instance, if employees regularly play games on their phone or if their tablet rings everytime they get a call through their Skype mobile app, this could have an effect on productivity, especially if there are workers who need a quiet work environment to be effective. An employer may need to set guidelines restricting the use of the devices or how they're configured so they're least disruptive.
However, in other cases, such as in a sales role, having access to such a device could make it easier for a worker to update a social network or contact a client in another country using Wifi calling or instant messaging. In these cases, employers may want to encourage the use of such devices.
I've worked in places that would restrict such devices and require key-card access to the building, due to the sensitive nature of client data. Conversely, I've also worked in places where intellectual property was a non-issue and where management was very hands-off. Some employers have even provided such devices for both our work use as well as personal use.
In short, your policy depends on how much risk such devices have on your business or your clients' businesses, and what type of impact it will have on your employees productivity, whether that impact be positive or negative.
I dont know much about AUP but i can give you some pointers.
If you are allowing tablets and laptops from home to the office then
1) Make sure your Network Policy is tight, no loopholes.
2) Firewalls are in place and Access points.
3) Seperate the Network Connectivity and only offer wifi for the tablets and laptops if they want to connect to the internet, make sure no one can access your main Network.
4) Antivirus protection
5) Block certain websites.
6) If someone wants to connect their laptop to the main Network make sure they connect to the same VLAN as their desktop computer and implement some procedures for that like, Only the IT manager Grants that right.
7) Restrict Bandwidth.
8) you can install some monitoring software but that may be unnecessary if you are planning to keep things a bit relaxed.
most important Policy is Network.
The rest is arbitrary in my opinion but the experts probably have 100 pages worth of policies.
Keep it simple, As long as no one abuses the time spent on Tablets and Laptops browsing the net and playing Angry Birds you should be ok with the above.
As for Policy's for Theft, Breakage, taking Pictures in the Office, making videos, those are common sense things and you should have something in place already since almost everyone now days owns a smartphone.
