A.5.10 Acceptable Use of Information and Other Associated Assets
1. Objective and Policy Framework
anDREa identifies, documents, and implements strict guidelines for the acceptable use and proper handling of all corporate information assets, technical infrastructure, and associated cloud resources. This unified framework satisfies ISO/IEC 27001 Annex A.5.10 and ensures the protection of sensitive research and health data from unauthorized exposure, data leaks, or operational misuse.
Rather than relying on a single document, anDREa distributes its acceptable use mandates across specialized, topic-specific policy domains to ensure precise technical and operational control:
- Behavioral and Endpoint Acceptable Use: Rules governing how employees and contractors interact with corporate assets, handle remote environments, use personal devices, and interface with system boundaries are explicitly defined in A.06.07 - Remote working.
- Procedural Asset Handling: The explicit rules, marking obligations, encryption baselines, and storage restrictions dictating how data must be processed based on its sensitivity are detailed across A.05.12 - Classification of information & A.05.13 - Labelling of information.
2. Core Constraints on Acceptable Use
All personnel must adhere to the following baseline rules when interacting with anDREa assets or operating within the myDRE ecosystem:
- Business Intent Alignment: Assets and systems must be used primarily for authorized company business, research operations, and approved administrative tasks.
- Prohibition of Unauthorized Tools: Personnel may not process corporate or customer data using unvetted third-party software, unauthorized cloud storage endpoints, or unsanctioned artificial intelligence tooling outside the boundaries established in the AI/Large Language Model (LLM) Use Policy.
- Access Control Integrity: Sharing corporate credentials, bypassing Multi-Factor Authentication (MFA) controls, or utilizing non-repudiation administrative profiles without authorization is strictly prohibited.