Acceptable Use Policy
Table of Contents
1. Purpose
2. Scope
3. Exceptions
4. Policy
4.1 User Responsibilities
4.2 Corporate Devices
4.3 Corporate Network
4.4 Corporate Software
4.5 Corporate Email
4.6 Corporate Data
4.7 Corporate Storage
4.8 Password
4.9 Remote Work
4.10 Bring Your Own Device (BYOD)
4.11 Security Awareness Training
4.12 Reporting Violations
4.13 IT Support / Helpdesk
5. Appendix: Glossary
6. Document Control
1. Purpose
This Acceptable Use Policy (“Policy”) governs the responsible utilization of Corporate Assets in Yoma Strategic Holdings Ltd., First Myanmar Investment Public Company Limited, Serge Pun & Associates (Myanmar) Limited, and their subsidiaries, related corporations and affiliates (collectively, “Yoma Group” or “Group”). Corporate Assets are defined as any asset that holds value for an organization, including, but not limited to, corporate devices, corporate networks, corporate software, corporate email, corporate data and corporate storage, and related information technology resources. This Policy outlines the permissible usage of the Corporate Assets and defines restricted actions that users must refrain from taking to mitigate risks to the organization.
2. Scope
This Policy applies to all employees, users and members of boards of directors within the Group, and third-party entities who receive and utilize Corporate Assets (“Users”). This includes all members of the workforce, both on-site and remote, as well as third-party vendors, contractors, service providers, and consultants. Users are responsible for reading and comprehending this Policy and conducting their activities in accordance with its terms. Users who encounter any ambiguities in the Policy statements within this document are encouraged to contact the Group Technology for clarification.
3. Exceptions
Exceptions to this Policy are likely to be granted. Exception requests may arise for various reasons, but Users will generally need to utilize Corporate Assets in a manner that deviates from Policy. For instance, it is common to require the connection of a personal device to the Corporate Network or the placement of Corporate Data in the possession of a third-party contractor. All exception requests must be submitted in writing and must contain the following information:
- The reason for the request,
- The potential risk to the organization if the written policy is not followed,
- Specific mitigations that will not be implemented,
- Technical and other difficulties encountered, and
- The date of review.
All exceptions must be submitted to IT Support for review and approval by a manager who is authorized to approve exceptions.
4. Policy
4.1 User Responsibilities
- Users are solely authorized to utilize approved technology and services.
- All Corporate Assets are loaned to Users to facilitate essential job functions.
- Upon separation from the corporate or employment contract termination, Users are obligated to return or securely destroy in an approved manner all supplied Corporate Assets and associated data.
- Users are responsible for securing the physical environment surrounding their workstations and locking their computers when leaving their desks.
- It is the responsibility of all Yoma Group’s employees to ensure that work-related data is securely stored and appropriately labeled as per the organization’s data classification and protection guidelines.
- Users must ensure that confidential, and sensitive data subject to the organization’s information security policies are not readily accessible or visible on their desks or within their workspace.
- Users are entrusted with the responsibility of safeguarding information, systems and related assets under their custody or care from loss, damage or harm.
- Users are required to promptly report the loss or damage of any equipment.
- Users-assigned accounts are granted access only to the assets, operating systems, applications, files and data to which they have been specifically authorized. Unauthorized access to data does not grant permission to perform any actions on it.
- Users are expected to maintain confidentiality regarding information and information systems gained during employment and this obligation extends beyond the termination of employment.
- Users are expected to adhere to protect any equipment belonging to the Yoma Group.
- Users are also advised to lock their devices in their desks when they’re not using them and remain responsible for any organization’s equipment whenever taken out of the offices.
- Software should only be used as authorized by the organization and Users must keep the software up to date by following the IT guidelines provided.
4.2 Corporate Devices
Corporate Devices refer to any hardware or equipment provided, owned or approved by the organization for conducting business activities. These Corporate Devices are intended to enhance productivity, ensure secure access to corporate resources and support operational needs.
4.2.1 Personal Use
Limited personal use of Corporate Devices is permitted, provided it meets the following conditions:
- Incidental and Non-Disruptive: Personal use must not interfere with work responsibilities or performance.
- Legal and Ethical: Activities must comply with all local laws, Group’s policies and ethical standards.
4.2.2 Corporate Use
Corporate Devices are provided exclusively for business-related purposes, including:
- Performing job functions and accessing corporate resources.
- Storing, processing, and transmitting Corporate Data securely.
- Communicating with internal teams and external stakeholders through approved channels.
4.2.3 Prohibitions
- Only approved and authorized devices may be connected to Corporate Networks. This includes portable end-user devices, removable devices (e.g., USB sticks) and personally owned devices.
- Users must not install software, hardware or modify system configuration settings on any Corporate Devices, unless explicitly permitted by the User’s role and responsibility.
- Users must not engage in any activity with the intent to disrupt Corporate Assets or Corporate Networks.
- Users are strictly prohibited from bypassing authentication mechanisms or compromising the security of any user account or information system asset.
- Users must not leverage Corporate Assets for personal economic gain.
- Minimal Data Usage: Avoid excessive use of Corporate Devices for personal activities that may strain device performance or data limits (e.g., streaming or downloading large files).
- Non-Commercial: Corporate Devices must not be used for personal business or entrepreneurial activities.
- Appropriate Content: Avoid accessing, sharing or storing inappropriate, offensive or illegal content on Corporate Devices.
4.3 Corporate Network
A Corporate Network is the collection of interconnected systems, devices, and infrastructure owned, managed, or authorized by the organization to enable communication, data sharing and business operations. It serves as the backbone for accessing corporate resources and ensuring seamless collaboration within the organization.
4.3.1 Personal Use
Limited personal use of the corporate network is allowed if it:
- Does not interfere with work responsibilities or network performance.
- Does not compromise the security or integrity of the network.
Personal use is subject to monitoring and users should have no expectation of privacy when using the corporate network.
4.3.2 Corporate Use
The corporate network is to be used exclusively for business purposes, including:
- Accessing corporate systems, applications and resources necessary for job functions.
- Communicating and collaborating with colleagues and external partners through approved platforms.
- Securely transmitting, processing and storing corporate data.
4.3.3 Prohibitions
- Users must not use the network to download or upload obscene, offensive or illegal material.
- Users must not use the network to send confidential information to unauthorized recipients.
- Users must not use the network to invade another person’s privacy and sensitive information.
- Users must not perform any form of network monitoring, port scanning or security scanning unless this activity is a part of the individual’s normal job and is formally authorized.
4.4 Corporate Software
Corporate Software refers to any application, platform or tool provided, licensed or approved by the organization for business operations. Corporate Software is intended to enhance operational efficiency, ensure compliance and maintain the security of Corporate Data.
4.4.1 Personal Use
Personal use of Corporate Software is generally not permitted except when explicitly authorized by management or IT.
Under no circumstances should Corporate Software be used for:
- Personal projects, entertainment or social media unless work-related.
- Storing or processing personal files or data.
4.4.2 Corporate Use
Corporate Software must be used solely for official business purposes, including:
- Performing job-specific tasks and achieving organizational objectives.
- Accessing and processing corporate data securely and efficiently.
- Collaborating and communicating with team members and external stakeholders.
4.4.3 Prohibitions
The following actions are strictly prohibited:
- Using Corporate Software for illegal or unethical activities.
- Sharing Corporate Software licenses, credentials or data with unauthorized individuals or entities.
- Modifying, duplicating or distributing Corporate Software without explicit authorization.
- Installing or using unlicensed, pirated or unauthorized software on corporate devices.
- Using Corporate Software for personal gain or non-work-related activities is prohibited.
- Employees are prohibited from installing Corporate Software on personal devices without prior approval.
4.5 Corporate Email
Corporate Email serves as a fundamental communication tool within the workplace, facilitating swift exchanges between colleagues, suppliers, partners and customers. As such, Yoma Group may be legally held accountable for the content contained in Corporate Emails. Consequently, email communication with external parties must consistently adhere to strict professional standards.
4.5.1 Personal Use
Personal use of Corporate Email is expressly prohibited unless authorized by management for exceptional circumstances.
4.5.2 Corporate Use
Yoma Group may be legally liable for the content of emails it sends. Therefore, all email communications must adhere to the organization’s corporate identity and standards. Email content should be treated as business correspondence, as recipients may retain and forward it. When representing another individual or department in an email, ensure express authorization is obtained and clearly indicate this in the message or header.
4.5.3 Prohibitions
Yoma Group retains the right to monitor and audit Corporate Email systems, and the websites employees visit on Corporate Devices. Employees are strictly prohibited from using their Corporate Email for the following purposes:
- Registering on illegal, unsafe, disreputable, unauthorized or suspect websites and services.
- Transmitting emails containing false, misleading or defamatory information regarding Yoma Group or its products, customers, staff, competitors or other entities.
- Subscribing to competitors’ services without explicit authorization.
- Sending emails that are obscene, discriminatory, abusive, offensive, or inappropriate in any manner (e.g., pornographic, illegal, may constitute harassment), including the circulation of messages, jokes or advertisements that are of an offensive nature.
- Sending unsolicited email messages, including the transmission of “junk mail” or other advertising or marketing material to individuals who have not consented to such communication (email spam).
- Soliciting email addresses for any purpose other than the sender’s account, with the intention of harassing or collecting responses (email solicitation).
- Accessing, sharing or utilizing an email account belonging to another individual without explicit authorization from the account owner.
- Altering email header information.
- Engaging in the creation or dissemination of “chain letters”, “Ponzi” or other “pyramid” schemes of any nature.
- Automatically forwarding emails intended for Corporate Email addresses to personal accounts, non-Corporate Email accounts belonging to public or external email providers, or any email account of a partner company.
- Knowingly sending or forwarding email with computer viruses, malware or malicious code.
- Misrepresenting the organization’s position or implying unauthorized authority to speak on behalf of the Group.
- Sending, forwarding or receiving sensitive, confidential or proprietary Corporate Data through non-Corporate Email accounts.
4.6 Corporate Data
Corporate Data includes all information created, acquired or maintained as part of the organization’s operations and is the sole property of Yoma Group. All Corporate Data must be protected through legal, technical and organizational means. Users must handle this data with due care, using it only for authorized purposes and in compliance with applicable laws, regulations and the Group’s internal policies.
4.6.1 Data Classification
Yoma Group has a Data Classification Policy to ensure corporate information is appropriately categorized and protected based on its sensitivity and importance to the organization. Users are responsible for classifying data according to established guidelines and ensuring appropriate handling and protection. We have defined three classification levels for our data. For detailed guidelines on data classification and handling, refer to the organization’s Data Classification Policy.
4.6.2 Prohibitions
- Accessing, modifying, copying or deleting Corporate Data without proper authorization.
- Sharing or disclosing sensitive Corporate Data with unauthorized individuals, entities or systems, whether internal or external.
- Transferring Corporate Data to unauthorized personal devices, storage or third parties.
- Backing up, relocating, storing or otherwise accessing any Corporate Data with unauthorized devices.
- Bypassing security controls (e.g., disabling encryption, removing access restrictions) to manipulate or extract Corporate Data.
- Engaging in activities that could lead to data breaches, leaks, or exposure of confidential corporate information.
- Retaining confidential files after employment ends.
- Failing to report suspected or actual data breaches to the IT within 1 hour of discovery.
4.7 Corporate Storage
Corporate storage is provided to securely store, manage and access organizational data, ensuring smooth business operations and data integrity.
4.7.1 Personal Use
Limited personal use of corporate storage systems may be allowed under the following conditions:
- Personal files should not exceed nominal storage capacity and should not interfere with business operations.
- Personal documents, photos or media uploaded to corporate storage must not contain sensitive, confidential or illegal content.
- Personal use should not impact system performance, security or other employees’ ability to access resources.
- The enterprise assumes no responsibility for the loss, protection or recovery of personal files stored on corporate storage systems.
4.7.2 Corporate Use
Employees must use corporate storage systems primarily for:
- All corporate data related to business operations must be stored in the designated corporate storage systems, including Microsoft 365 services (OneDrive, SharePoint, Teams) and corporate file server.
- Ensuring all work-related files are stored in corporate storage to comply with backup and disaster recovery protocols.
- Confidential or sensitive information must be encrypted or stored in designated secure corporate storage.
- Access to corporate storage must only be via authorized devices and accounts.
- Storage usage will be monitored to ensure compliance with this Policy.
4.7.3 Prohibitions
The following activities are strictly prohibited:
- Storing personal files of excessive size, such as movies or large media collections.
- Corporate information must not be stored on personal storage devices, personal cloud accounts or unauthorized external platforms.
- Uploading copyrighted, pirated or illegal content.
- Storing corporate data in non-secure folders.
- Sharing login credentials or granting unauthorized access to corporate storage.
- Using corporate storage for personal businesses, side hustles or commercial purposes.
- Overloading storage with irrelevant files that compromise system performance.
- Bypassing security measures, such as access controls or using unauthorized third-party apps for storage.
4.7.4 Data Retention
Upon an employee’s resignation, termination or permanent leave, individual storage accounts will be deactivated and deleted according to the following schedule:
- Data stores will be retained for 30 days after the last working day to facilitate potential handovers or reviews.
4.8 Password
4.8.1 General Guideline
- Do not share your password with anyone, including coworkers. Passwords must be treated as sensitive and confidential information of the organization.
- Avoid writing passwords down or saving them in unsecured locations.
- Passwords must not be stored in clear text on paper or saved in non-protected files (e.g., unencrypted text files).
- The same password must not be used for multiple accounts.
- Passwords must be updated every 90 days.
- PCs must not be left unattended without activating password-protected screensaver or logging off the device.
- After 5 unsuccessful login attempts, accounts will be locked and require IT Helpdesk assistance to reset.
- Enable two-factor authentication (2FA) to add an extra layer of security to your accounts where system support.
- If you suspect your password has been compromised, report it to the IT Helpdesk immediately and reset your password.
- Passwords should not be shared via insecure transport mechanism or in clear text.
- Temporary passwords should be changed at the first logon with the default password provided by the IT Helpdesk.
- If the security of an account is in question, the password must be changed immediately. If passwords are discovered exposed, secure them and report the discovery to IT.
4.8.2 Password Requirements
When creating a password, all employees must follow the standard password guidelines below to ensure strong and secure passwords
- Passwords must be at least 8 characters long (a longer password is recommended). For privileged and service accounts, a minimum length of 16 characters is required.
- Passwords must not contain your username, full name or any other personally identifiable information.
- Passwords must include at least one uppercase letter, one lowercase letter, one number and one special character.
- Passwords should not contain repetitive sequences (e.g., “aaaa”) or sequential patterns (e.g., “abc”, “1234”).
- Do not reuse old passwords or use simple variations of previous passwords (e.g., “Password1” to “Password2”).
- Users cannot reuse the same password within a certain timeframe (7 password entries).
- Multi-factor authentication shall be used where the system supports it for all accounts on SaaS platforms, externally hosted and internet facing systems.
- Sharing your credentials gives others access to your identity on the network, making you responsible for any misuse or security incidents that may occur under your ID.
4.9 Remote Work
This Policy applies to all IT personnel performing remote work and governs their use of organization systems, data, applications and resources. It establishes guidelines to ensure secure, compliant and efficient operations while working outside organization premises.
- Users are required to ensure that the Group IT-Security team verifies and configures the required assets and applications. Following approval by the Group IT-Security team, remote work will be permitted by the organization.
- The organization may provide specific tools or reimbursement for necessary equipment as assigned by the organization.
- Users should always use secure connections, such as Virtual Private Networks (VPNs), instead of public Wi-Fi when accessing Corporate Data. This helps protect sensitive information from potential cyber threats.
- Users must ensure that they have the necessary technology and a conducive work environment.
- Users must adhere to data protection and confidentiality policies while working remotely.
- Use of secure connections and company-approved software is mandatory.
4.10 Bring Your Own Device (BYOD)
This Bring Your Own Device (“BYOD”) Policy applies to all employees and other personnel who access company systems, emails, documents, communication platforms, applications or data using personal devices.
Yoma Group holds ownership of corporate data and resources that may be accessed or stored on a device, but the device itself remains the property of the User. The BYOD privileges are conditional and revocable at the Group’s discretion.
This BYOD Policy encompasses the following:
- All personal devices must be registered with the IT department before accessing Corporate Assets. IT department reserves the right to refuse by non-physical means the ability to connect such devices to Corporate Assets if it feels such devices are being used in such a way that puts the Group’s system, data and users at risk.
- Users are required to install and maintain the latest antivirus software on their personal computers.
- Personal devices must have up-to-date operating systems, both mobile and computers.
- Use of company-approved applications for accessing files and communication.
- Personal devices must not be used for illegal, inappropriate or unauthorized purposes while connected to company systems.
- Inform the IT department before disposing of or replacing the personal device, or immediately after losing it or having it stolen.
- Use a device lock with authentication, such as a fingerprint or strong password, on each personal device, and refer to Section 4.8 (Password) for additional information.
- Upon termination, users must remove all Corporate Data from their personal devices. The IT department will verify compliance.
- Adhere to all company security protocols while using personal devices.
- Immediately report any incident or suspected incidents of unauthorized data access, data loss, or disclosure of organization’s resources, databases, or networks to IT department.
- Users are fully responsible for any misuse or unauthorized access caused by their personal devices.
- Users are fully responsible for maintaining their personal hardware and software.
4.11 Security Awareness Training
All employees, including permanent, temporary and contractual staff, who utilize the Yoma Group’s IT resources are mandated to complete an annual online Security Awareness Training course every twelve months. Newly hired employees are specifically required to attend and complete the Security Awareness Training course within the initial thirty days of their employment or prior to gaining access to the Yoma Group’s IT systems and data.
4.12 Reporting Violations
Users who are aware of any event that threatens the availability, integrity or confidentiality of Corporate Data or breaches any standard, policy, procedure or any associated requirement or is contrary to law, must promptly contact IT Support or their line manager.
4.13 IT Support / Helpdesk
Our Yoma Group has introduced an IT Support Ticketing System to enhance the management of IT-related issues and requests throughout the organization. This system aims to improve our service to you and ensure prompt and efficient resolution of all IT-related concerns. It is crucial for everyone to
utilize this system for all IT support requirements. If you need technical assistance or have any IT-related concerns, please contact our IT Helpdesk through the following channels:
- Self-service Portal: Log in to the ticketing portal at https://helpdesk.yomagroup.net and submit your issue/request by filling out the required fields.
- Email: Raise your issue with the helpdesk via email helpdesk@yoma.com.mm. A ticket ID will be assigned and a technician will handle your request. You can use the ticket ID to communicate and track updates on the status of your request.
- Hotline: For urgent matters, you can contact our IT Helpdesk hotline directly on Ext: 8302 for immediate support.
5. Appendix: Glossary
| Definitions | |
|---|---|
| Corporate Device | Corporate devices encompass any hardware or equipment provided, owned or approved by an organization for conducting business operations. These devices are designed to augment productivity, guarantee secure access to corporate resources and support operational requirements.
|
| Corporate Network | A corporate network comprises a collection of interconnected systems, devices, and infrastructure owned, managed or authorized by the organization to facilitate communication, data sharing and business operations. It serves as the foundation for accessing corporate resources and ensuring seamless collaboration within the organization.
|
| Corporate Software | Corporate software encompasses any application, platform or tool that is provided, licensed or approved by an organization for the conduct of business operations.
Security software (e.g., antivirus, VPNs). |
| Corporate Emaile | Corporate email encompasses the email accounts, platforms and systems provided, owned or managed by an organization for business communication purposes. These accounts typically utilize the organization’s domain name (e.g., name@yoma.com.mm) and are designed for professional correspondence, ensuring secure and efficient communication with employees, clients, vendors and other relevant stakeholders. |
| Corporate Data | Corporate data encompasses all information generated, acquired or maintained during the organization’s operations and is exclusively owned by the Yoma Group. Employees are entrusted with the responsibility of handling this data judiciously, utilizing it solely for authorized purposes and adhering strictly to company policies. |
| Corporate Storage | Corporate Storage refers to the organization-approved systems, platforms, or devices used to store, manage, and protect corporate data. Corporate storage may include:
|
| Password | A sequence of characters (letters, numbers and other symbols) employed for authentication purposes, typically used to verify the identity of an individual or grant access authorization. |
| Multifactor Authentication (MFA) | An authentication system that necessitates the provision of multiple distinct authentication factors for successful authentication is referred to as multifactor authentication. This authentication process can be executed utilizing a multifactor authenticator or by combining authenticators that provide distinct factors. The three authentication factors encompass knowledge, possession and biometric verification. |
| Password Manager | A password manager is a software application that enables users to securely store, generate and manage all their online passwords across various websites and services. Accessible via a single “master password,” it effectively eliminates the need to memorize multiple intricate login credentials for each account. This tool assists users in crafting robust and distinct passwords for each site and automatically fills them in when required, thereby enhancing online security by minimizing the risk of password reuse. |
| Bring Your Own Device (BYOD) | BYOD or Bring Your Own Device is a corporate IT policy that governs the usage of personal devices by employees, contractors and authorized end users on the company network. This policy specifies the acceptable devices, their permitted usage and the appropriate timeframes for accessing corporate data and performing job-related tasks. |
| CIA | C = Confidentiality assurance, I = Integrity assurance, A = Availability assurance |
5.1 Reference
Data Classification Policy
6. Document Control
| Version | Author | Descriptions | Date | Approved |
|---|---|---|---|---|
Revision 1.1 |
Group Technology |
This revision was made following an annual review. The primary objective of this revision is to enhance the protection of the company’s sensitive information |
3/20/2024 |
Phyo Thet Khine (Head of IT) |