Brand agnostic IT and Technology (SOPs)

Here are IT and Technology Standard Operating Procedures (SOPs), designed to be brand-agnostic:

IT and Technology Standard Operating Procedures (SOPs)

1. Computer and Software Usage Guidelines

Purpose: To ensure secure, efficient, and compliant use of company-owned computers and software.

Scope: All employees, contractors, and temporary staff using company IT assets.

Procedures:

1. Authorised Use:
   
   • Company computers and software are primarily for business use. Limited, reasonable personal use is permitted provided it does not interfere with job duties, consume excessive resources, or violate any company policies.
   • No illegal activities, unauthorized access to systems, or distribution of inappropriate content.
2. Software Installation & Licensing:
   • Only authorised IT personnel or designated administrators may install, modify, or uninstall software on company devices.
   • All software must be properly licensed and used in accordance with its terms and conditions. Unauthorized software installations are strictly prohibited.
3. Data Handling & Storage:
   • Company data, including documents, emails, and sensitive information, must be stored on designated network drives, cloud storage, or approved business applications. Avoid storing critical business data solely on local drives.
   • Do not transfer company data to personal devices or unauthorized external storage without explicit permission and security safeguards.
4. Device Security:
   • Keep devices locked when away from the workstation.
   • Do not share login credentials. Each user must have unique credentials.
   • Report any suspected compromise, loss, or theft of a company device immediately to IT support.
5. Updates & Maintenance:
   • Ensure operating systems and approved software are kept up-to-date with security patches and updates. Automatic updates should generally remain enabled.
   • Cooperate with IT for scheduled maintenance, updates, and security scans.

2. Network and Internet Security Protocols

Purpose: To protect the integrity, confidentiality, and availability of the company's network and data from cyber threats.

Scope: All users accessing the company network and internet services.

Procedures:

1. Password Management:
   • All user accounts must use strong, unique passwords that meet minimum complexity requirements (e.g., length, mixture of characters).
   • Passwords must be changed regularly as per policy or upon suspicion of compromise.
   • Never share passwords or write them down in an unsecured location.
   • Enable multi-factor authentication (MFA) on all accounts where available.
2. Internet Usage:
   • Exercise caution when clicking on links or opening attachments from unknown or suspicious sources.
   • Avoid visiting known malicious, inappropriate, or unauthorized websites.
   • Do not download files from unverified websites or peer-to-peer networks.
   • Be vigilant against phishing, spoofing, and social engineering attempts. Report suspicious emails or communications immediately.
3. Wireless Network Usage:
   • Only connect to approved and secured company wireless networks.
   • When working remotely, use approved virtual private network (VPN) services to secure internet traffic over public Wi-Fi.
   • Do not set up personal wireless hotspots on company premises without IT approval.
4. Antivirus and Anti-Malware Protection:
   • Ensure all devices have approved endpoint protection software installed and running.
   • Do not disable or bypass security software.
   • Cooperate with scheduled scans and threat remediation actions.
5. Security Incident Reporting:
   • Immediately report any suspected security breach, malware infection, unauthorized access, or unusual network activity to IT support.

3. Data Backup and Recovery Procedures

Purpose: To ensure the regular backup of critical company data and establish procedures for its recovery in case of data loss or system failure.

Scope: All departments responsible for creating, storing, or managing company data.

Procedures:

1. Data Identification & Classification:
   • Identify all critical business data requiring regular backup (e.g., financial records, customer databases, project files, intellectual property).
   • Classify data by sensitivity and importance (e.g., highly confidential, internal use only, public).
2. Backup Schedule & Frequency:
   • Daily: Mission-critical databases and frequently updated operational data.
   • Weekly/Bi-weekly: All primary network shares and cloud-synced folders.
   • Monthly/Quarterly: Long-term archives and less frequently updated data.
   • Specific schedules for individual systems/applications will be maintained by the IT department.
3. Backup Storage Locations:
   • Backups will be stored in at least two distinct locations:
     • On-site: For quick recovery of recent data.
     • Off-site/Cloud: For disaster recovery purposes, protecting against site-specific failures.
   • All backup storage solutions will be encrypted and access-controlled.
4. Backup Verification & Testing:
   • Regularly verify the integrity of backup files to ensure they are not corrupted and can be restored.
   • Conduct periodic test restores (at least quarterly) of critical data to validate the recovery process and ensure recovery time objectives (RTOs) and recovery point objectives (RPOs) can be met.
   • Document the results of all backup verifications and tests.
5. Data Recovery Process:
   • In the event of data loss, system failure, or disaster, IT support will initiate the data recovery process based on predefined recovery plans.
   • Users will be informed of the expected recovery time and progress.
   • Prioritize recovery of mission-critical systems and data to minimize business disruption.
6. Responsibility:
   • The IT department is responsible for managing, monitoring, and testing backup systems.
   • Department heads are responsible for identifying their critical data and ensuring compliance with backup policies.

4. Troubleshooting and Technical Support Processes

Purpose: To provide a systematic approach for reporting, diagnosing, and resolving IT-related issues, ensuring timely support and minimal disruption to business operations.

Scope: All employees requiring technical assistance.

Procedures:

1. Initial User Troubleshooting:
   • Before contacting IT support, users should perform basic troubleshooting steps:
     • Restart the affected application or device.
     • Check power connections and network cables.
     • Verify internet connectivity.
     • Ensure user credentials are correct.
   • Note any error messages or unusual behavior.
2. Reporting an Issue:
   • All IT-related issues must be reported through the designated IT support system (e.g., helpdesk portal, dedicated email address).
   • Provide the following information:
     • Your name and contact details.
     • A clear and concise description of the problem.
     • Any error messages received.
     • Steps taken before the issue occurred.
     • Impact of the issue (e.g., unable to work, specific application affected).
     • Urgency/Priority (e.g., critical, high, medium, low).
   • Avoid contacting IT personnel directly via personal communication channels for new issues, unless it's an emergency as defined below.
3. Issue Prioritization & Response:
   • IT support will categorize reported issues based on impact and urgency:
     • Critical: System outage affecting all users, critical business function completely down. (Response within X minutes/hours, Resolution within Y hours).
     • High: Major functional impairment, affecting multiple users or a key business process. (Response within A hours, Resolution within B hours).
     • Medium: Minor functional impairment, affecting a single user or non-critical process. (Response within C hours, Resolution within D days).
     • Low: General inquiry, minor inconvenience, or feature request. (Response within E days, Resolution within F days).
   • Response and resolution times will adhere to established service level agreements (SLAs).
4. Troubleshooting & Resolution:
   • IT support will attempt to diagnose and resolve issues remotely.
   • If remote resolution is not possible, on-site support will be scheduled.
   • Users must cooperate with IT requests for information or access to devices.
   • Upon resolution, IT will confirm with the user that the issue is resolved and close the ticket.
5. Escalation Process:
   • If an issue cannot be resolved within the agreed-upon timeframe or requires specialized expertise, it will be escalated to the appropriate senior IT personnel or external vendor.
   • Users will be informed of the escalation.
6. Documentation:
   • All troubleshooting steps, findings, and resolutions will be documented in the IT support system for future reference and knowledge base building.