As mentioned previously, it is important that departments maintain up to date records of employee training which can be used as evidence during any investigations of unauthorised use. Training records, at a minimum, should capture information such as: training topic name of the instructor the date length of the training course trainee’s name. Departments should consider the use of training sign-in sheets, which can be used as evidence in the event of a dispute. Training quizzes can also be an effective mechanism to support that an employee not only attended, but understood the content. Departments should also consider keeping a register of other employee communications such as email notifications, alerts and newsletters etc. It is also important that all training records are kept up to date and revised following each training session. Employee acknowledgement To ensure employees have an understanding of, and acknowledge their obligations and responsibilities when using ICT services, facilities and devices, departments may wish to consider the implementation of formal employee acknowledgement/agreements through written agreements. To highlight the department’s policy on the use of ICT services, facilities and devices departments should consider inclusion of what resources (i.e. mobile laptop computers etc.) can be used for private purposes and the limitations on the use of these devices in other departmental policies and documentation such as terms of employment and/or information and systems access forms. Issues to consider when defining policy and practices for this include: How will employees acknowledge they have read and understood the policy and Cabinet Statement on the use of internet and email? An example ‘Employee agreement on use of internet and email’ template is located at appendix E. How will employees acknowledge what is authorised and unauthorised use? How will the department ensure that employees know that when receiving unsolicited or inappropriate material from the internet or through an email, they delete such material from departmental systems immediately? (Action to delete this material would not constitute unauthorised use.) How will employees acknowledge their ethical and code of conduct obligation to report any improper conduct or practices of which they become aware? Relevant departments should also be aware of requirements under the , issued by the Public Service Commission, to have procedures in place when an employee separates from employment in the Queensland public service. Departments should also ensure that these procedures are communicated to employees. Other relevant information In addition to specific departmental policies and procedures on the use of ICT services, facilities and devices, departments should also ensure that they inform employees where they can freely access all other relevant information including:
As mentioned previously, it is important that departments maintain up to date records of employee training which can be used as evidence during any investigations of unauthorised use. Training records, at a minimum, should capture information such as: training topic name of the instructor the date length of the training course trainee’s name. Departments should consider the use of training sign-in sheets, which can be used as evidence in the event of a dispute. Training quizzes can also be an effective mechanism to support that an employee not only attended, but understood the content. Departments should also consider keeping a register of other employee communications such as email notifications, alerts and newsletters etc. It is also important that all training records are kept up to date and revised following each training session. Employee acknowledgement To ensure employees have an understanding of, and acknowledge their obligations and responsibilities when using ICT services, facilities and devices, departments may wish to consider the implementation of formal employee acknowledgement/agreements through written agreements. To highlight the department’s policy on the use of ICT services, facilities and devices departments should consider inclusion of what resources (i.e. mobile laptop computers etc.) can be used for private purposes and the limitations on the use of these devices in other departmental policies and documentation such as terms of employment and/or information and systems access forms. Issues to consider when defining policy and practices for this include: How will employees acknowledge they have read and understood the policy and Cabinet Statement on the use of internet and email? An example ‘Employee agreement on use of internet and email’ template is located at appendix E. How will employees acknowledge what is authorised and unauthorised use? How will the department ensure that employees know that when receiving unsolicited or inappropriate material from the internet or through an email, they delete such material from departmental systems immediately? (Action to delete this material would not constitute unauthorised use.) How will employees acknowledge their ethical and code of conduct obligation to report any improper conduct or practices of which they become aware? Relevant departments should also be aware of requirements under the , issued by the Public Service Commission, to have procedures in place when an employee separates from employment in the Queensland public service. Departments should also ensure that these procedures are communicated to employees. Other relevant information In addition to specific departmental policies and procedures on the use of ICT services, facilities and devices, departments should also ensure that they inform employees where they can freely access all other relevant information including:
IS38implementationguidelinev202-FINAL.docx