A.16 ABC Inc. InfoSec Anti-Virus Policy

Policy No. 15

Effective date Month / Day / Year

Implement by Month / Day / Year

1.0 Purpose

To establish requirements which must be met by all computers connected to ABC Inc. lab networks to ensure effective virus detection and prevention.

2.0 Scope

This policy applies to all ABC Inc. computers that are Windows-based or utilize Windows-based file directory sharing. This includes, but is not limited to, desktop computers, laptop computers, file/ftp/tftp/proxy servers, and any Windows-based lab equipment such as traffic generators.

3.0 Policy

All ABC Inc. PC-based lab computers must have ABC Inc.'s standard, supported anti-virus software installed and scheduled to run at regular intervals. In addition, the anti-virus software and the virus pattern files must be kept up-to-date. Virus-infected computers must be removed from the network until they are verified as virus-free. Information System Admins and Managers are responsible for creating procedures that ensure anti-virus software is run at regular intervals, and computers are verified as virus-free. Any activities with the intention to create and/or distribute malicious programs into ABC Inc.'s networks (e.g., viruses, worms, Trojan horses, e-mail bombs , etc.) are prohibited , in accordance with the Acceptable Use Policy. Refer to ABC Inc.'s IT Anti-Virus Web page to help prevent virus problems. Noted exceptions: Machines with operating systems other than those based on Microsoft products are exempted at the current time.

4.0 Enforcement

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

5.0 Definitions

6.0 Exceptions

Exceptions to information system security policies exist in rare instances where a risk assessment examining the implications of being out of compliance has been performed, where a Policy Exception Form has been prepared by the data owner or management, and where this form has been approved by both the CSO or Director of InfoSec and the Chief Information Officer (CIO).

7.0 Revision History

Date ___/____/_____

Version:_______________________

Author:____________________________________

Summary:__________________________________