ISO 27002 Standard 8.3.2

SIGS No Match

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

A formal process is required when allocating laptop computers to staff.  Staff are required to sign the Laptop Custodian Form which states they agree to be responsible for the equipment and any peripherals.  Upon leaving the company, the equipment is to be handed back to the Line Manager and the Laptop Custodian Form resigned to release the individual from their responsibility of the "custodianship" of the laptop.

       

ISO 27002 Standard 11.3.1

SIGS Chapter 9 Control of Access to

    Information Systems 25-26

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

Laptops may contain sensitive information or information that you would not want to lose due to the inconvenience of not having it available.  In the event that the laptop is lost or stolen, thieves may not bother with a device that they cannot gain easy access to.  There is also the problem of unauthorised persons gaining remote access to your corporate accounts if the dial in facility has been enabled.

       

            ISO 27002 Standard 9.2.7

SIGS No Match

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard No Match

No matter where it is located, the company reserves the right to conduct an inspection of the equipment and its contents.   This policy ensures that company management can carry out its duty protect corporate assets by firstly confirming the existence of the equipment and secondly, that users are observing both Health and Safety and security policies and procedures. 

       

ISO 27002 Standard 7.1.3

ISO 27002 Standard 9.2.4

SIGS No Match

     BS 25999 Standard No Match

SOX Section 404 No Match

PCI DSS Standard 12.3.5

Users must not alter equipment provided by the company as errors could cause the device to malfunction and void manufacturers' warranties.  A user may inadvertently or deliberately bypass security measures, cause confidential or sensitive information to be lost or disclosed and provide an opportunity for hackers to compromise the machine.  In addition, the policy protects against the removal of internal components like memory chips and helps to ensure the equipment issued to a user is the same equipment that will be returned when the user no longer requires it.  This is important where equipment is leased.