Overview
Policy Statement
your organization uses many types of computer software to perform its business operations and always relies upon the correct functioning and security of that software. It is imperative therefore that steps are taken to ensure that only approved software is used within the organization and that no classified information is put at risk.
This policy sets out how the software will be acquired, registered, installed, and developed within your organization.
This control applies to all systems, people, and processes that constitute the organization's information systems, including board members, directors, employees, suppliers, and other 3rd Parties who have access to your organization systems.
Procedures
Procedures and mapped controls
Purchasing Software
All computer software to be used within the organization must be purchased through your organization. This is necessary to ensure that:
- Licensing requirements are addressed
- The software works effectively with the standard corporate software image
- Use of the software can be supported by the your organization IT Support
- Best value for money is obtained in procurement
- A record is kept of installed software within the organization
Under no circumstances should software be purchased using local departmental budgets.
Software Registration
All software in use within your organization must be correctly licensed.
All installed software programs will be registered in the name of the organization, not the individual. Purchased software is a corporate asset and licenses will frequently be reused as the shape of the organization changes.
Under no circumstances will corporate software be copied (other than for backups) or installed for personal use.
your organization will maintain a register of all licensed software within the organization and licensed copies of media such as DVDs.
Asset management software will be used to keep track of all installed instances of software titles and regular audits will be carried out. Any user with unlicensed software installed will be asked to remove it; it is the responsibility of users to ensure that all the software on their computer equipment is licensed.
Software Installation
Licensed software will be installed by the your organization IT Support or appropriate technical team or supplier upon request and once any required licenses have been purchased. In few cases (such as development tools), license keys would be supplied to specific users after your organization has purchased the software for commercial usage. The trial version of the software may be used but the your organization IT Support team should be informed. Upon expiry of the trial license, software components MUST stop using the software and should be uninstalled completely.
The software will not be installed before a valid license being ordered except for a trial license. However, this should be brought to the notice of your organization IT Support before installation and usage.
Removal of Software
If a software program is no longer required the your organization IT Support should be informed. The software will then be removed from the device in question and where possible the license will be re-used elsewhere within the organization.
Users should not remove licensed software from their devices without informing the your organization IT Support as this potentially represents a waste of a corporate asset.
In-House Software Development
your organization develops its software for particular purposes where a commercial package is not available or does not fulfill the identified requirements. In such cases, a structured development method will be used to ensure that software is developed to organizational standards and is tested and implemented in a managed way.
Alterations to in-house developed software such as the addition of fields or screen changes may be requested through the change request process. This process is described in the Change Management Process document.
Changes to in-house developed software must not be made without following the change management process.
Query logic
These are the stored checks tied to this policy.
No stored query bodies are attached to this entry.
