Every employee is responsible for protecting company data, client information, systems, devices, and credentials. Security is a shared responsibility and must be followed even when work is urgent.

Passwords and Accounts

• Use strong, unique passwords for company accounts.
• Do not reuse personal passwords for company accounts.
• Do not share passwords, OTPs, recovery codes, API keys, SSH keys, or session links with anyone unless an approved secure process is used.
• Use two-factor authentication where available or required.
• Access must be removed or changed when an employee changes role, leaves a project, or separates from the company.

Devices

• Company devices must be used for authorized work and kept physically secure.
• Devices should use screen lock, updated operating systems, antivirus/security tools where applicable, and approved software only.
• Employees should not install cracked, pirated, unsafe, or unnecessary software on company devices.
• Lost, stolen, damaged, or compromised devices must be reported immediately to HR/IT/management.

Company Data

• Company files, client records, employee records, financial data, source code, credentials, contracts, and internal plans must stay inside approved company systems.
• Do not copy company data to personal email, personal cloud drives, USBs, personal laptops, or unapproved messaging channels.
• Only access data needed for assigned work. Do not browse, download, or share data without a work reason.
• Confidential information remains confidential after employment ends.

Incident Reporting

• Report suspicious emails, unusual login alerts, malware, accidental sharing, missing files, or unauthorized access immediately.
• Early reporting is encouraged. The goal is to protect people, clients, and systems quickly.
• Employees should not hide incidents or try to fix security incidents alone if company systems or client data may be affected.