• Use company-managed devices, or personal devices only if enrolled in [device management].
• Keep disk encryption, screen lock (after [5] minutes) and automatic updates on.
• Report a lost or stolen device within [24] hours.

• Use a password manager and a unique password for each service.
• Multi-factor authentication is mandatory on all company accounts.
• Never share accounts or credentials.

Access is granted on a least-privilege basis and reviewed every [quarter]. Leavers lose access on their last day.

• Store work data only in approved tools: [list].
• Classify data: public, internal, confidential, restricted; restricted data is encrypted and never sent by email.
• Do not paste confidential or personal data into AI tools that are not approved by [Company].

Use the VPN on public networks. Do not connect unknown USB devices.

Reasonable personal use is allowed if it does not affect work or security. Illegal content, harassment, mining, and unlicensed software are forbidden.

[Company] monitors its systems for security in a proportionate way, as described in [notice]. Content of communications is not read except in the cases the law allows.

Report phishing, malware or suspicious activity at once to [contact]. Do not try to investigate alone.