Electronic Devices and Passwords Policy - Revision history

Seymour Jacklin at 11:07, 6 January 2026

2026-01-06T11:07:44Z

← Older revision		Revision as of 11:07, 6 January 2026
Line 1:		Line 1:
			'''This is an old version of the policy. Please see [[Cyber Policy]] for the updated issue.'''

	At Handcrafted, we are dedicated to supporting our staff and service users in line with our Christian ethos and values. We recognise that safe and responsible use of electronic devices is essential to protecting both personal data and organisational integrity.		At Handcrafted, we are dedicated to supporting our staff and service users in line with our Christian ethos and values. We recognise that safe and responsible use of electronic devices is essential to protecting both personal data and organisational integrity.

Seymour Jacklin: Undo revision 543 by Seymour Jacklin (talk)

2026-01-06T11:04:48Z

Undo revision 543 by Seymour Jacklin (talk)

Show changes

Seymour Jacklin: update approval date

2026-01-06T11:02:30Z

update approval date

← Older revision		Revision as of 11:02, 6 January 2026
Line 10:		Line 10:
	\|-		\|-
	\|'''Last review and approval'''		\|'''Last review and approval'''
	\|26/03/2025		\|31/12/2025
	\|}		\|}
	----		----

Seymour Jacklin: Updated entire policy to most recent version

2026-01-06T10:59:10Z

Updated entire policy to most recent version

Show changes

Seymour Jacklin at 12:30, 6 May 2025

2025-05-06T12:30:01Z

← Older revision		Revision as of 12:30, 6 May 2025
Line 7:		Line 7:
	{\| class="wikitable"		{\| class="wikitable"
	!Group or individual responsible for review		!Group or individual responsible for review
	![[The ~~Safeguarding Steering Group~~\|'''The ~~Safeguarding Steering Group~~''']]		![[The Support Systems Officer\|'''The Support Systems Officer''']]
	\|-		\|-
	\|'''Last review and approval'''		\|'''Last review and approval'''

Seymour Jacklin at 12:28, 6 May 2025

2025-05-06T12:28:31Z

@@ Line 1: / Line 1: @@
-(continued...)
+At Handcrafted, we are dedicated to supporting our staff and service users in line with our Christian ethos and values. We recognise that safe and responsible use of electronic devices is essential to protecting both personal data and organisational integrity.
 = Passwords =
 Employees at Handcrafted Projects must access a variety of IT resources, including computers and other hardware devices, data storage systems, and other accounts. Passwords are an important part of our strategy to make sure only authorized people can access those resources and data.

Seymour Jacklin at 12:16, 6 May 2025

2025-05-06T12:16:31Z

← Older revision		Revision as of 12:16, 6 May 2025
Line 40:		Line 40:
	Shared accounts should be avoided where possible. If a shared email account is needed, this should be set up by the Support Systems Officer using Gmail’s delegated access function, so that the login credentials can still be owned by a single employee and not shared.		Shared accounts should be avoided where possible. If a shared email account is needed, this should be set up by the Support Systems Officer using Gmail’s delegated access function, so that the login credentials can still be owned by a single employee and not shared.

	If the security of a password is in doubt – for example, if it appears that an unauthorized person has logged in to the account – the password must be changed ~~immediatel~~		If the security of a password is in doubt – for example, if it appears that an unauthorized person has logged in to the account – the password must be changed immediately.

			= Compromised Devices and Accounts =

			Employees should be vigilant for any possible compromise of their devices or accounts. This could take the form of a variety of different situations, including:

			* A device that accesses organisational data has been lost or stolen.
			* Emails not being sent or received correctly
			* A staff member gets notifications that someone has attempted to change one of their passwords
			* An account/device appears to have been hacked
			* A device has a virus or malware
			* Any other suspicious activity

			Employees should report any possible device/account compromise to the Support Systems Officer and their line manager immediately upon noticing an issue, by phone where possible. The Support Systems Officer will help the employee to assess the cause of the issue and advise on any next steps.

			= Offboarding =

			Employees must surrender any Handcrafted-owned devices and account access to the organisation when they stop working for Handcrafted.

			The Support Systems Officer will ensure that access to all accounts (e.g. Airtable, Gmail) has been revoked on the employee’s leaving date, and then delete accounts in a timely manner. Employees should make sure that they have copies of important documents such as payslips before their leaving date, and that they have set up email forwarding where appropriate.

			= Routers =

			Routers should have firewall turned on at all times.

			Router admin passwords must be changed from the default password immediately upon setup.

			= Procurement/Setup =

			Purchase of new organisational devices should be approved via the normal finance process, with the model approved beforehand by the Support Systems Officer to make sure it is in line with any requirements for the job role for which it will be used.

			The Support Systems Officer should log any new devices purchased in the IT inventory so that the organisation is able to keep track of devices.

			The Support Systems Officer is responsible for initial setup and configuration of the device before it is used, and ensuring that setup is done in a timely manner.

			= Risks/Liabilities/Disclaimers =

			Employees must report lost or stolen devices to their line manager and the Social Impact and Support Systems Officer within 24 hours. Employees are responsible for notifying their mobile carrier immediately upon loss of a device.

			The employee is expected to use his or her devices in an ethical manner at all times and adhere to the company’s acceptable use policy as outlined above.

			The employee is personally liable for all costs associated with his or her device.

			The employee assumes full liability for risks including, but not limited to, the partial or complete loss of company and personal data due to an operating system crash, errors, bugs, viruses, malware, and/or other software or hardware failures, or programming errors that render the device unusable.

			Handcrafted Projects reserves the right to take appropriate disciplinary action up to and including termination for noncompliance with this policy.

			= Further Resources =

			* [https://www.ncsc.gov.uk/collection/charity/resources#section_3 NCSC Small Charities Infographic]
			* [https://www.ncsc.gov.uk/files/Charity-Guide-v3.pdf NCSC Small Charities Guide]
			* [http://www.itmanagerdaily.com/mobile-malware-grew-three-fold-last-year/ Malware]
			* [http://www.itmanagerdaily.com/spear-phishing-attacks/ Phishing Scams]

Seymour Jacklin: Created page with "(continued...) = Passwords = Employees at Handcrafted Projects must access a variety of IT resources, including computers and other hardware devices, data storage systems, and other accounts. Passwords are an important part of our strategy to make sure only authorized people can access those resources and data. An individual who has access to any of those resources is responsible for choosing strong passwords and protecting his or her login information from unauthoriz..."

2025-05-06T12:14:47Z

Created page with "(continued...) = Passwords = Employees at Handcrafted Projects must access a variety of IT resources, including computers and other hardware devices, data storage systems, and other accounts. Passwords are an important part of our strategy to make sure only authorized people can access those resources and data. An individual who has access to any of those resources is responsible for choosing strong passwords and protecting his or her login information from unauthoriz..."

New page

(continued...)

= Passwords =

Employees at Handcrafted Projects must access a variety of IT resources, including computers and other hardware devices, data storage systems, and other accounts. Passwords are an important part of our strategy to make sure only authorized people can access those resources and data.

An individual who has access to any of those resources is responsible for choosing strong passwords and protecting his or her login information from unauthorized use.

The purpose of this policy is to make sure all Handcrafted Projects' resources and data receive adequate password protection. It covers all employees who are responsible for one or more accounts or have access to any resource that requires a password.

== Password creation ==

Passwords should be reasonably complex and difficult for unauthorised people to guess.

Passwords should be at least twelve characters long and contain a combination of upper- and lower-case letters, and numbers.

Employees should use common sense when choosing passwords to avoid using basic combinations that are easy to crack, such as passwords which use common phrases (e.g. “password,” “1password” and “Pa$$w0rd”). Further guidance on avoiding common passwords is available in the Further Resources section at the end of the policy.

It is recommended that employees use methods to create strong passwords such as:

* Pick a phrase, take its initials, replace some of those letters with numbers and other characters, and mix up the capitalization. For example, the phrase “This may be one way to remember” can become “TmB0WTr!”.
* Combining three random words and a number (e.g. ‘HeartTorchBrick538’)

Employees must choose unique passwords for all Handcrafted accounts and may not use a password that they are already using for a personal account.

Default passwords — such as those created for new employees when they start or those that protect new systems when they’re initially set up — must be changed as quickly as possible.

These requirements will be enforced with software where possible.

== Protecting passwords ==

Employees may never share their passwords with anyone else in the charity, including co-workers, managers or administrative assistants. Everyone who needs access to a system must create his or her own unique password.

Employees may never share their passwords with any outside parties, including those claiming to be representatives of an organisation with a legitimate need to access a system.

Employees should take steps to avoid phishing scams and other attempts by hackers to steal passwords and other sensitive information. All employees will receive guidance on how to recognize these attacks.

Employees must refrain from writing passwords down and keeping them at their workstations. See above for advice on creating memorable but secure passwords.

Shared accounts should be avoided where possible. If a shared email account is needed, this should be set up by the Support Systems Officer using Gmail’s delegated access function, so that the login credentials can still be owned by a single employee and not shared.

If the security of a password is in doubt – for example, if it appears that an unauthorized person has logged in to the account – the password must be changed immediatel