DWP Acceptable Use Policy

Introduction

The Acceptable Use Policy (AUP) aims to protect all users of DWP equipment and

data and minimise risk by providing clarity on the behaviours expected and required

by DWP employees, Agents, Service Providers, Contractors and Consultants. It sets

a framework on how to conduct DWPs business to meet legal, contractual and

regulatory requirements and defines how individuals must behave in order to comply

with this policy.

Read the full policy, or jump to a specific section using the links below:

2. User IDs and passwords

3. Managing and protecting information

4. Non-Corporate Communications Channels

5. Personal use of DWP IT

6. Email/fax/voice communication

7. Websites and Social Media

8. Devices, systems and networks

9. Physical Security

10. Compliance

All DWP equipment and information (all information systems, hardware, software

and channels of communication, including voice- telephony, social media, video,

email, instant messaging, internet and intranet). User’s personal information which is

processed by DWP equipment is also subject to this policy.

Who this policy applies to

All DWP employees, agents, contractors, consultants, suppliers and business

partners (referred to in this document as ‘users’) with access to DWP’s information

and information systems and assets.

Acceptable use principles

Users must:

1.3 Use information, systems and equipment in line with DWP

security and Information Management policies

1.4 Immediately report any breach of this Acceptable Use Policy to their line

manager and to the Security Incident Response Team and comply with official

procedures when a breach of the policy is suspected or reported.

1.5 Never undertake illegal activity, or any activity that would be harmful to DWP’s

reputation or jeopardise staff and/or citizen data, on DWP technology.

1.6 Understand that both business and personal use of DWP systems will

be monitored as appropriate.

1.7 Understand that they can use whistleblowing and raising a concern if it is

Users must:

2.1 Protect usernames, staff numbers, smart cards, dongles and passwords

appropriately.

2.2 Create secure passwords following How to create a Password or PIN.

2.3 When using a password manager, ensure that their master password is stored

securely in line with Keeping your Passwords and PINs secure. Passwords must

not be stored in shared folders or written down.

2.4 Not log on to any DWP systems using another user’s credentials.

2.5 Remove their network access smart card or dongle and/or lock the screen when

3.1 Understand that they and DWP have a legal responsibility to protect personal

and sensitive information and must not misuse their official position to further private

interests or those of others. The Civil Service Code Standards of Behaviour:

Integrity refers.

3.2 Ensure that all information is created, used, shared and disposed of in line with

business need and in compliance with the Information Management

Policy, Information Asset Inventory Guidance and Retention of Specific

Information Guidance.

3.3 Not attempt to access anyone’s personal data unless there is a legitimate

business need that is appropriate to their job role. Users must not, under any

3.5 Not provide information in response to any type of request whose identity they

cannot verify.

3.6 Ensure they are not overheard or overlooked in public areas when conducting

DWP business.

3.7 Apply the DWP Security Classification Policy appropriately to document

headers and email subject lines in relation to the Official-Sensitive handling caveat

3.8 Not attempt to access, amend, damage, delete or disseminate another person’s

files, emails, communications or data without the appropriate authority.

3.9 Not attempt to compromise or gain unauthorised access to DWP IT, telephony or

content, or prevent legitimate access to it.

4.3 Official Sensitive or other ‘significant information’ must only be communicated

through NCCCs in exceptional circumstances and only with an approved Security

Policy Exception. Significant information is information that materially impacts the

direction of a piece of work or that gives evidence of a material change to a

situation. Where such exceptions are granted, records of official business carried out

via an NCCC must be transferred onto corporate systems (e.g., SharePoint) as soon

as is practicably possible.

4.4 Logistical or other non-significant information can be accessed through NCCCs

with due regard to an individual’s security responsibilities.

Guidance on the use of NCCCs can be found here: Non-Corporate

5.2 Understand that DWP allows personal use of its IT resources in an employee’s

own time when not on official duty or ‘flexed on’ as per the Flexible Working Hours

Policy.

5.3 Ensure that any personal information stored is appropriate i.e., legal, applicable

and compliant with this policy and GDPR legal requirements.

5.4 Understand that the ability to store personal information on DWP owned devices

and systems is a privilege and DWP has a right to require the data is removed

should this data interfere with business activity or use.

5.5 Ensure personal activities do not damage the reputation of DWP, its employees

and citizens including accessing, storing, transmitting or distributing links to material

• Is offensive, indecent or obscene including abusive images, language and

literature.

is for personal gain from any type of transaction or on behalf of external

of DWP.

• Use malicious, harassing, abusive or threatening communication.

• Incite hate, bullying and harassment.

• Visit pornographic sites or undertake any form of gaming, lottery or betting.

• Use behaviour that is discriminatory in any sense (e.g., on the grounds of sex,

sexual orientation, gender, race, age, religious beliefs or disability).

• Use any type of applications and/or devices to circumvent management or

security controls or damage, destroy, or deny availability of service.

• Download software onto DWP devices with the exception of DWP supplied

tablet devices and smart phones where permitted from an official source and

6.5 Not try to assume the identity of another user or create or send material

designed to mislead people about who originated or authorised it (e.g., through

misuse of scanned signatures).

6.6 Be vigilant to scam targeting communications especially phishing emails and

their use. The installation and use of the TikTok application is restricted on all DWP

devices and access must not be attempted.

when it becomes available as this ensures the device has the latest security updates

charging.

or a hotel. However, DWP devices must not be connected to the internet via Captive

Portals, for security reasons. DWP devices are set up so they do not connect to

Captive Portals.

8.9 DWP permits wirelessly connecting a DWP Device to a DWP, or personal,

Users must:

9.1 Comply with the DWP Physical Security Policy & Physical Security

Standards

9.2 Be responsible for keeping all portable devices assigned to them safe and

secure and immediately report any loss or damage of their equipment to their line

manager and log a security incident using the Security Incident Referral

Webform. If the device is a work phone/smart phone you must also complete

a Lost/Stolen Device Report (link is external) form via DWP place and contact IT

Support urgently on 0800 464 3549 to ask for the phone to be suspended.

• Never leave a portable device visible in parked vehicles.

• Never leave equipment unattended in a public place e.g., on public transport

9.4 Return all DWP assets when leaving DWP. Failure to return equipment could

lead to steps being taken to recover the cost, which could include legal action

through the civil courts. Line Managers must complete all appropriate exit

procedures with leavers. See the DWP Leaver Checklist for more information.

10.1 If for any reason users are unable to comply with this policy or require use of

technology which is outside its scope, this should be discussed with their line

manager in the first instance and then the Security Advice Centre who can provide

10.2 Seek exceptions to security policies by applying for an Exception.

responsibilities and consequences as defined in this policy and continue to meet its

requirements for the duration of their employment with DWP. They are also

responsible for monitoring employees’ ability to perform assigned security

responsibilities. This does not remove responsibility from employees, who must

ensure that they too understand their responsibilities as outlined in this policy and

continue to meet the requirements. It is a line manager’s responsibility to take

appropriate action if individuals fail to comply with this policy.

10.5 DWP actively monitors employee and contractor personal use of IT and

equipment to ensure everyone is complying with this policy (AUP) and the DWP

Social Media Policy. Monitoring complies with and respects the privacy rights of all

of failing to comply with the personal use limitations of DWP IT and equipment are

serious and attract disciplinary penalties up to and including dismissal.

10.6 DWP’s Security and Data Protection Team will regularly assess for compliance