Scenario:1

During an internal case investigation in an enterprise-size company, a computer was taken as part of the evidence. The computer was found with a flash drive connected to one of the USB ports. The flash drive is believed to contains image files and other information relevant to the case. The investigation concerns corporate espionage, possible theft of intellectual property and misuse of company resources. At this point, management has not yet decided if the police should be called or not. Preliminary investigation results indicate that the employee assigned to the computer likely had the chance to delete some image files. Other files were renamed so that they do not look like image files. It is also suspected that steganography may have been used with some of the files to conceal important information. The passphrase used for this purpose is hidden in the device slack space.

Required: Develop (write) an Acceptable Use of Computers, Technology and Data Policy that outlines the acceptable use of computer equipment at the company. The policy should cover (in addition to acceptable use) areas like "no expectations of privacy", audits of computers and the corporation's right to monitor and search computers. The policy should also cover data usage and ownership. The Acceptable Use Policy must contain appropriate headings including, but not necessarily limited to:

Introduction to Acceptable Use Policy

Purpose of the Policy

Scope of the Policy

Policy Statements

Policy Compliance

Definitions for Technical and Legal Terms in the Policy

References to other procedures/standards/guidelines, as needed

Deliverable 1: A corporate Acceptable Use of Computers, Technology and Data Policy for computer systems (fixed and portable), internet, removable hard drives, USB media, webcams, meeting software (i.e. ZOOM), and data of all types.

NOTE:-We are looking for acceptable use policies that are Canadian, operational, business-oriented (not military), easy to use and read, NOT legalistic, but suitable for IT works and other staff and users of computer systems in a Canadian business environment.