There are security related rules and restrictions we have, applicable on all employees. We trust you, but it's better to have some rules than none at all, just in case you inadvertently step across what we consider the line. It is at least important to state explicitly what we consider as "the line".

Most of these restrictions are common-sense things, as you will see. However, not everyone sees common sense the same way, therefore in critical matters like information security and confidentiality, a written statement helps. As we wrote the list of points, we realised that the list had become fairly long, and this depth of material is best maintained as a carefully and clearly written note. It's more than mere common sense.

In order to understand these policy decisions, we must distinguish between "production systems", where people do their normal office work and store their personal and official data, and "lab systems", where people perform experiments with hardware and system software. Security restrictions apply to the "production systems". Lab systems can be formatted by an engineer at will, and loaded with (legal) software of his choice. Lab systems and production systems are kept in physically separate networks, connected by a carefully controlled firewall. This is necessary to maintain two very dissimilar systems with different sets of security demands in the same office.

The list of points about IS security are:

• Protect your username and password: You will not share your password with anyone. You will keep a password which is not easily guessable. Yes, it will be considered your fault if someone uses your "abc123" password and misuses the systems.

If you find that you or any other non-designated colleague have such privileges directly or because of some indirect access path, you must immediately report this by email to security-holes@merceworld.com. Note: Production systems includes all diskless computers and desktops too, not just servers. Production systems also include all external servers administered by our company on the Internet (e.g. pub1).

The second level includes sites which are not upsetting, embarrassing, or harassing to colleagues, but which are inappropriate for business use. Cricket commentary sites and film gossip sites are in this category. You should not access such sites, though the penalty for violating this rule will usually be less severe than for accessing the Level 1 prohibited sites.

The necessity restriction may be waived by you at your discretion for official visitors who have come to our office for a long visit (e.g. for a day-long meeting) and they want to check their email using a Webmail interface. But the supervision restriction will never be waived.

All restrictions applicable to you will automatically be applicable to any visitor under your supervision. Common sense, we thought.

Monitoring may include tracking which Websites you visit, monitoring the contents of emails you send and receive, and the contents of files created, downloaded or stored by you on any office computer. Such monitoring may be done as part of automated monitoring processes using computerised tools, or as part of special manual and detailed examinations if there is adequate grounds to suspect any unprofessional or unethical conduct.

Demo copies of products we develop are also under the control of the company; the decision to give or not give a demo copy to an external entity needs to be governed by complex strategic factors in many cases. You do not have the freedom to distribute demo copies to your friends unless explicitly authorised to do so, and authorisation must be separately sought for each such recipient.

Any material hosted on our company's public Website and linked directly or indirectly from the main pages of the Website is considered public; you may distribute such material to all and sundry. This means that when we start hosting demo copies of our products on our public Website and linking to them from the main pages, you can freely forward copies of such software to anyone you like.

All confidential information must be kept confined only to those colleagues who need to know it and who have legitimate official access to it. Not all members of the company have legitimate access to all official information within the company. No confidential information must be shared with any outsider without written permission.

Non-disclosure of confidential information includes non-disclosure of the existence of such information. If we are working on a tender document, not only are the contents of the document to be kept confidential, the very existence of that document is also to be kept confidential.

Official information includes all information that you learn about the company's clients, as part of your work. Such information is by default strictly confidential till you are told otherwise. Even the network architecture of a client and the type of OS they run on their mail servers, for instance, is confidential information.

We do not want you to forward your company email to such public email services. They are not known for their security, and the hacker underground trades lists of millions of such accounts and passwords among themselves, to be used for identity theft. Remember that identity theft for an employee of our company could result in direct monetary loss to him, because the intruder may be able to break into your Citibank Suvidha account with some dexterity and effort.

If you feel that there is some important official reason why you deserve this right, then please let us know and we will grant permission on a case-by-case basis. Till then, this is off-limits. If you are already forwarding your email to such an account as on date, switch it off now.

Personal laptops in office

Laptops owned by employees and never brought into the office or connected over any network (e.g. the Internet) to the production networks are truly personal. They are not in the purview of the company's IS security policy.

Once they are brought into the office, they must follow the guidelines of the company's policies. In that sense, they no longer remain purely "personal". (This is like the case for clothes you wear to official meetings. If you wear certain clothes only when you are off-duty, the company has no opinions on what you choose to wear or not wear. However, the company will have clear opinions about what constitutes acceptable dressing for official meetings, even though the clothes belong to you.)

Restrictions about personal laptops connected to the company's production networks are meant to ensure that your security practices on your laptop do not weaken the IS security of the company. All restrictions which are applicable to your use of the company's computers are applicable for personal laptops brought to office. In addition, some extra responsibilities also apply, because the laptop is now in your personal care and responsibility.

These include, but are not limited to, the following:

• Ask for permission first: You will ask for permission, in writing, before connecting your personal laptop to the office production network the first time. When asking for permission, you will state whether you have read and understood the IS security policy of the company, and whether you take responsibility for ensuring that your laptop will comply with them.

One of the most security-critical pieces of information on laptops are private keys for secure access to remote servers, including client servers. Loss of such keys can mean total loss of access security to those servers. You will ALWAYS ensure that all private keys you keep on your laptop are protected by non-guessable passphrases. In these respects, losing a live laptop is far more critical than losing a briefcase full of confidential documents.

One factor which has not been explained above is the oft-repeated reference to "us". We have asked you to take permission from "us". You have seen statements like "We will not accept this." Who is this "We"? In the case of the company's current structure, it is the management. This comprises Shuvam, Kishan, and Shraddha. If in doubt, or if you need to discuss something which is bothering you and does not fit into any standard operating procedure, just approach one of us and talk. We'll sort things out one way or other.

This document constitutes the IS security policy of our company. Your continued status as employee of this company implies that you accept all the clauses here and agree to abide by them.

This document, like all other policies of the company, is subject to discussion and debate. Please post feedback and comments and let's thrash out any grey areas or contentious issues.