FarmersCorner.org Use Policy

Policy

Acceptable Use

• Personnel and Users (Buyers or Sellers) are responsible for complying with FarmersCorner.org policies when using FarmersCorner.org information resources and/or on FarmersCorner.org time. If requirements or responsibilities are unclear, please seek assistance from the Information Security Committee.
• Personnel and Users (Buyers or Sellers) must promptly report harmful events or policy violations involving FarmersCorner.org assets or information to their manager or a member of the Incident Handling Team. Events include, but are not limited to, the following:
  • Technology incident: any potentially harmful event that may cause a failure, interruption, or loss in availability to FarmersCorner.org Information Resources.
  • Data incident: any potential loss, theft, or compromise of FarmersCorner.org information.
  • Unauthorized access incident: any potential unauthorized access to a FarmersCorner.org Information Resource.
  • Facility security incident: any damage or potentially unauthorized access to a FarmersCorner.org owned, leased, or managed facility.
  • Policy violation: any potential violation to this or other FarmersCorner.org policies, standards, or procedures.
• Personnel and Users (Buyers or Sellers) should not purposely engage in activities that may
  • harass, threaten, impersonate, or abuse others;
  • degrade the performance of FarmersCorner.org Information Resources;
  • deprive authorized FarmersCorner.org Personnel and Users (Buyers or Sellers) access to a FarmersCorner.org Information Resource;
  • obtain additional resources beyond those allocated;
  • or circumvent FarmersCorner.org computer security measures.
• Personnel and Users (Buyers or Sellers) should not download, install, or run security programs or utilities that reveal or exploit weakness in the security of a system. For example, FarmersCorner.org Personnel and Users (Buyers or Sellers) should not run password cracking programs, packet sniffers, port scanners, or any other non-approved programs on any FarmersCorner.org Information Resource.
• All inventions, intellectual property, and proprietary information, including reports, drawings, blueprints, software codes, computer programs, data, writings, and technical information, developed on FarmersCorner.org time and/or using FarmersCorner.org Information Resources are the property of FarmersCorner.org.
• Use of encryption should be managed in a manner that allows designated FarmersCorner.org Personnel and Users (Buyers or Sellers) to promptly access all data.
• FarmersCorner.org Information Resources are provided to facilitate company business and should not be used for personal financial gain.
• Personnel and Users (Buyers or Sellers) are expected to cooperate with incident investigations, including any federal or state investigations.
• Personnel and Users (Buyers or Sellers) are expected to respect and comply with all legal protections provided by patents, copyrights, trademarks, and intellectual property rights for any software and/or materials viewed, used, or obtained using FarmersCorner.org Information Resources.
• Personnel and Users (Buyers or Sellers) should not intentionally access, create, store or transmit material which FarmersCorner.org may deem to be offensive, indecent, or obscene.

Access Management

• Access to information is based on a “need to know“.
• Personnel and Users (Buyers or Sellers) are permitted to use only those network and host addresses issued to them by FarmersCorner.org IT and should not attempt to access any data or programs contained on FarmersCorner.org systems for which they do not have authorization or explicit consent.
• All remote access connections made to internal FarmersCorner.org networks and/or environments must be made through approved, and FarmersCorner.org-provided, virtual private networks (VPNs).
• Personnel and Users (Buyers or Sellers) should not divulge any access information to anyone not specifically authorized to receive such information, including IT support Personnel and Users (Buyers or Sellers).
• Personnel and Users (Buyers or Sellers) must not share their (personal authentication information, including:
  • Account passwords,
  • Personal Identification Numbers (PINs),
  • Security Tokens (i.e. Smartcard),
  • Multi-factor authentication information
  • Access cards and/or keys,
  • Digital certificates,
  • Similar information or devices used for identification and authentication purposes.
• Access cards and/or keys that are no longer required must be returned to physical security Personnel and Users (Buyers or Sellers).
• Lost or stolen access cards, security tokens, and/or keys must be reported to physical security Personnel and Users (Buyers or Sellers) as soon as possible.
• A service charge may be assessed for access cards, security tokens, and/or keys that are lost, stolen, or are not returned.

Authentication/Passwords

• All Personnel and Users (Buyers or Sellers) are required to maintain the confidentiality of personal authentication information.
• Any group/shared authentication information must be maintained solely among the authorized members of the group.
• All passwords, including initial and/or temporary passwords, must be constructed, and implemented according to the following FarmersCorner.org rules:
  • Must meet all requirements including minimum length, complexity, and reuse history.
  • Must not be easily tied back to the account owner by using things like username, social security number, nickname, relative’s names, birth date, etc.
  • Must not be the same passwords used for non-business purposes.
• Unique passwords should be used for each system, whenever possible.
• User account passwords must not be divulged to anyone. FarmersCorner.org support Personnel and Users (Buyers or Sellers) and/or contractors should never ask for user account passwords.
• If the security of a password is in doubt, the password should be changed immediately.
• Personnel and Users (Buyers or Sellers) should not circumvent password entry with application remembering, embedded scripts or hard coded passwords in client software.
• Security tokens (i.e. Smartcard) must be returned on demand or upon termination of the relationship with FarmersCorner.org, if issued.

Clear Desk/Clear Screen

• Personnel and Users (Buyers or Sellers) should log off from applications or network services when they are no longer needed.
• Personnel and Users (Buyers or Sellers) should log off or lock their workstations and laptops when their workspace is unattended.
• Confidential or internal information should be removed or placed in a locked drawer or file cabinet when the workstation is unattended and at the end of the workday if physical access to the workspace cannot be secured by other means.
• Personal items, such as phones, wallets, and keys, should be removed or placed in a locked drawer or file cabinet when the workstation is unattended.
• File cabinets containing confidential information should be locked when not in use or when unattended.
• Physical and/or electronic keys used to access confidential information should not be left on an unattended desk or in an unattended workspace if the workspace itself is not physically secured.
• Laptops should be either locked with a locking cable or locked away in a drawer or cabinet when the work area is unattended or at the end of the workday if the laptop is not encrypted.
• Passwords must not be posted on or under a computer or in any other physically accessible location.
• Copies of documents containing confidential information should be immediately removed from printers and fax machines.

Data Security

• Personnel and Users (Buyers or Sellers) should use approved encrypted communication methods whenever sending confidential information over public computer networks (Internet).
• Confidential information transmitted via USPS or other mail service must be secured in compliance with the Information Classification and Management Policy.
• Only authorized cloud computing applications may be used for sharing, storing, and transferring confidential or internal information.
• Information must be appropriately shared, handled, transferred, saved, and destroyed, based on the information sensitivity.
• Personnel and Users (Buyers or Sellers) should not have confidential conversations in public places or over insecure communication channels, open offices, and meeting places.
• Confidential information must be transported either by an FarmersCorner.org employee or a courier approved by IT Management.
• All electronic media containing confidential information must be securely disposed. Please contact IT for guidance or assistance.

Email and Electronic Communication

• Auto-forwarding electronic messages outside the FarmersCorner.org internal systems is prohibited.
• Electronic communications should not misrepresent the originator or FarmersCorner.org.
• Personnel and Users (Buyers or Sellers) are responsible for the accounts assigned to them and for the actions taken with their accounts.
• Accounts must not be shared without prior authorization from FarmersCorner.org IT, with the exception of calendars and related calendaring functions.
• Employees should not use personal email accounts to send or receive FarmersCorner.org confidential information.
• Any personal use of FarmersCorner.org provided email should not:
  • Involve solicitation.
  • Be associated with any political entity, excluding the FarmersCorner.org sponsored PAC.
  • Have the potential to harm the reputation of FarmersCorner.org.
  • Forward chain emails.
  • Contain or promote anti-social or unethical behavior.
  • Violate local, state, federal, or international laws or regulations.
  • Result in unauthorized disclosure of FarmersCorner.org confidential information.
  • Or otherwise violate any other FarmersCorner.org policies.
• Personnel and Users (Buyers or Sellers) should only send confidential information using approved secure electronic messaging solutions.
• Personnel and Users (Buyers or Sellers) should use caution when responding to, clicking on links within, or opening attachments included in electronic communications.
• Personnel and Users (Buyers or Sellers) should use discretion in disclosing confidential or internal information in Out of Office or other automated responses, such as employment data, internal telephone numbers, location information or other sensitive data.

Hardware and Software

• All hardware must be formally approved by IT Management before being connected to FarmersCorner.org networks.
• Software installed on FarmersCorner.org equipment must be approved by IT Management and installed by FarmersCorner.org IT Personnel and Users (Buyers or Sellers).
• All FarmersCorner.org assets taken off-site should be physically secured at all times.
• Personnel and Users (Buyers or Sellers) traveling to a High-Risk location, as defined by FBI and Office of Foreign Asset control, must contact IT for approval to travel with corporate assets.
• Employees should not allow family members or other non-employees to access FarmersCorner.org Information Resources.

Internet

• The Internet must not be used to communicate FarmersCorner.org confidential or internal information, unless the confidentiality and integrity of the information is ensured and the identity of the recipient(s) is established.
• Use of the Internet with FarmersCorner.org networking or computing resources must only be used for business-related activities. Unapproved activities include, but are not limited to:
  • Recreational games,
  • Streaming media,
  • Personal social media,
  • Accessing or distributing pornographic or sexually oriented materials,
  • Attempting or making unauthorized entry to any network or computer accessible from the Internet.
  • Or otherwise violate any other FarmersCorner.org policies.
• Access to the Internet from outside the FarmersCorner.org network using a FarmersCorner.org owned computer must adhere to all of the same policies that apply to use from within FarmersCorner.org facilities.

Mobile Devices and Bring Your Own Device (BYOD) for personne

• FarmersCorner.org does not allow personally owned mobile devices to connect to the FarmersCorner.org corporate internal network.

OR

• The use of a personally owned mobile device to connect to the FarmersCorner.org network is a privilege granted to employees only upon formal approval of IT Management.
• All personally owned laptops and/or workstations must have approved virus and spyware detection/protection software along with personal firewall protection active.
• Mobile devices that access FarmersCorner.org email must have a PIN or other authentication mechanism enabled.
• Confidential information should only be stored on devices that are encrypted in compliance with the FarmersCorner.org Encryption Standard.
• FarmersCorner.org confidential information should not be stored on any personally owned mobile device.
• Theft or loss of any mobile device that has been used to create, store, or access confidential or internal information must be reported to the FarmersCorner.org Security Team immediately.
• All mobile devices must maintain up-to-date versions of all software and applications.
• All Personnel and Users (Buyers or Sellers) are expected to use mobile devices in an ethical manner.
• Jail-broken or rooted devices should not be used to connect to FarmersCorner.org Information Resources.
• FarmersCorner.org IT Management may choose to execute “remote wipe” capabilities for mobile devices without warning (see Mobile Device Email Acknowledgement).
• In the event that there is a suspected incident or breach associated with a mobile device, it may be necessary to remove the device from the Personnel and Users (Buyers or Sellers)’s possession as part of a formal investigation.
• All mobile device usage in relation to FarmersCorner.org Information Resources may be monitored, at the discretion of FarmersCorner.org IT Management.
• FarmersCorner.org IT support for personally owned mobile devices is limited to assistance in complying with this policy. FarmersCorner.org IT support may not assist in troubleshooting device usability issues.
• Use of personally owned devices must be in compliance with all other FarmersCorner.org
• FarmersCorner.org reserves the right to revoke personally owned mobile device use privileges in the event that Personnel and Users (Buyers or Sellers) do not abide by the requirements set forth in this policy.
• Texting or emailing while driving is not permitted while on company time or using FarmersCorner.org Only hands-free talking while driving is permitted, while on company time or when using FarmersCorner.org resources.

Physical Security

• Photographic, video, audio, or other recording equipment, such as cameras and cameras in mobile devices, is not allowed in secure areas.
• Personnel and Users (Buyers or Sellers) must display photo ID access card at all times while in the building.
• Personnel and Users (Buyers or Sellers) must badge in and out of access-controlled areas. Piggy-backing, tailgating, door propping and any other activity to circumvent door access controls are prohibited.
• Visitors accessing card-controlled areas of facilities must be accompanied by authorized Personnel and Users (Buyers or Sellers) at all times.
• Eating or drinking are not allowed in data centers. Caution must be used when eating or drinking near workstations or information processing facilities.

Privacy

• Information created, sent, received, or stored on FarmersCorner.org Information Resources are not private and may be accessed by FarmersCorner.org IT employees at any time, under the direction of FarmersCorner.org executive management and/or Human Resources, without knowledge of the user or resource owner.
• FarmersCorner.org may log, review, and otherwise utilize any information stored on or passing through its Information Resource
• Systems Administrators, FarmersCorner.org IT, and other authorized FarmersCorner.org Personnel and Users (Buyers or Sellers) may have privileges that extend beyond those granted to standard business Personnel and Users (Buyers or Sellers). Personnel and Users (Buyers or Sellers) with extended privileges should not access files and/or other information that is not specifically required to carry out an employment-related task.

Removable Media

• The use of removable media for storage of FarmersCorner.org information must be supported by a reasonable business case.
• All removable media use must be approved by FarmersCorner.org IT prior to use.
• Personally, owned removable media use is not permitted for storage of FarmersCorner.org
• Personnel and Users (Buyers or Sellers) are not permitted to connect removable media from an unknown origin without prior approval from the FarmersCorner.org
• Confidential and internal FarmersCorner.org information should not be stored on removable media without the use of encryption.
• All removable media must be stored in a safe and secure environment.
• The loss or theft of a removable media device that may have contained any FarmersCorner.org information must be reported to the FarmersCorner.org

Security Training and Awareness

• All new Personnel and Users (Buyers or Sellers) must complete an approved security awareness training class prior to, or at least within 30 days of, being granted access to any FarmersCorner.org Information Resources.
• All Personnel and Users (Buyers or Sellers) must be provided with and acknowledge they have received and agree to adhere to the FarmersCorner.org Information Security Policies before they are granted to access to FarmersCorner.org Information Resources.
• All Personnel and Users (Buyers or Sellers) must complete the annual security awareness training.

Social Media

• Communications made with respect to social media should be made in compliance with all applicable FarmersCorner.org
• Personnel and Users (Buyers or Sellers) are personally responsible for the content they publish online.
• Creating any public social media account intended to represent FarmersCorner.org, including accounts that could reasonably be assumed to be an official FarmersCorner.org account, requires the permission of the FarmersCorner.org Communications Departments.
• When discussing FarmersCorner.org or FarmersCorner.org -related matters, you should:
  • Identify yourself by name,
  • Identify yourself as an FarmersCorner.org representative, and
  • Make it clear that you are speaking for yourself and not on behalf of FarmersCorner.org, unless you have been explicitly approved to do so.
• Personnel and Users (Buyers or Sellers) should not misrepresent their role at FarmersCorner.org.
• When publishing FarmersCorner.org-relevant content online in a personal capacity, a disclaimer should accompany the content. An example disclaimer could be; “The opinions and content are my own and do not necessarily represent FarmersCorner.org’s position or opinion.”
• Content posted online should not violate any applicable laws (i.e. copyright, fair use, financial disclosure, or privacy laws).
• The use of discrimination (including age, sex, race, color, creed, religion, ethnicity, sexual orientation, gender, gender expression, national origin, citizenship, disability, or marital status or any other legally recognized protected basis under federal, state, or local laws, regulations, or ordinances) in published content that is affiliated with FarmersCorner.org will not be tolerated.
• Confidential information, internal communications and non-public financial or operational information may not be published online in any form.
• Personal information belonging to customers may not be published online.
• Personnel and Users (Buyers or Sellers) approved to post, review, or approve content on FarmersCorner.org social media sites must follow the FarmersCorner.org Social Media Management Procedures.

VoiceMail

• Personnel and Users (Buyers or Sellers) should use discretion in disclosing confidential or internal information in voicemail greetings, such as employment data, internal telephone numbers, location information or other sensitive data.
• Personnel and Users (Buyers or Sellers) should not access another user’s voicemail account unless it has been explicitly authorized.
• Personnel and Users (Buyers or Sellers) must not disclose confidential information in voicemail messages.

Incidental Use

• As a convenience to FarmersCorner.org Personnel and Users (Buyers or Sellers), incidental use of Information Resources is permitted. The following restrictions apply:
  • Incidental personal use of electronic communications, Internet access, fax machines, printers, copiers, and so on, is restricted to FarmersCorner.org approved Personnel and Users (Buyers or Sellers); it does not extend to family members or other acquaintances.
  • Incidental use should not result in direct costs to FarmersCorner.org.
  • Incidental use should not interfere with the normal performance of an employee’s work duties.
  • No files or documents may be sent or received that may cause legal action against, or embarrassment to, FarmersCorner.org or its customers.
• Storage of personal email messages, voice messages, files and documents within FarmersCorner.org Information Resources must be nominal
• All information located on FarmersCorner.org Information Resources are owned by FarmersCorner.org may be subject to open records requests and may be accessed in accordance with this policy.

References

• ISO 27002: 6, 7, 8, 9, 11, 12, 13, 16, 18
• NIST CSF: PR.AC, PR.AT, PR.DS, DE.CM, DE.DP, RS.CO
• Asset Management Policy
• Encryption Management Policy
• Encryption Standard
• Identity and Access Management Policy
• Incident Management Policy
• Information Classification and Management Policy
• Mobile Device Acknowledgement
• Personnel and Users (Buyers or Sellers) Security and Awareness Policy
• Physical Security Policy
• Social Media Management Procedure

Waivers

Waivers from certain policy provisions may be sought following the FarmersCorner.org Waiver Process.

Enforcement

Personnel and Users (Buyers or Sellers) found to have violated this policy may be subject to disciplinary action, up to and including termination of employment, and related civil or criminal penalties.

Any vendor, consultant, or contractor found to have violated this policy may be subject to sanctions up to and including removal of access rights, termination of contract(s), and related civil or criminal penalties.