Device and Remote Access Standard

Organization: Igzibo Engineering Solutions, Inc.
Document: device-and-remote-access-standard-v1.md
Version: 1.0
Status: Active Standard
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and after material security, legal, contractual, or technology changes

Definitions

• AUP — Technology Acceptable Use Policy.
• AI — Artificial Intelligence.
• BYOD — Bring Your Own Device, a personally owned device authorized for business use.
• Endpoint — A device or system used to access organizational resources.
• Igzibo — Igzibo Engineering Solutions, Inc.
• IAM — Identity and Access Management.
• MFA — Multi-Factor Authentication.
• Organizational Resource — Any technology, account, system, service, device, information asset, or other resource owned, licensed, administered, funded, or authorized by Igzibo.
• Remote Access — Access to an organizational resource from outside an Igzibo-controlled physical environment.
• Restricted Information — Information requiring the highest level of protection under the Data Classification and Handling Standard.
• Security Event — An observable occurrence involving a device, account, system, service, or environment that may be relevant to security.

1. Purpose

This standard establishes minimum security requirements for devices and remote access used to access Igzibo Engineering Solutions, Inc. resources.

It supports the Technology Acceptable Use Policy, Identity and Access Management Standard, Data Classification and Handling Standard, Technology and Third-Party Service Security Standard, and Security Incident Response Procedure.

2. Scope

This standard applies to:

• Company-owned or company-managed devices.
• Approved personally owned devices used for Igzibo business.
• Laptops, desktops, mobile devices, tablets, and other endpoints.
• Remote access to Igzibo systems, client systems, and approved third-party services.
• Employees, contractors, and other authorized users.

Client-specific requirements may impose stricter controls.

3. Device Requirements

Authorized users must:

1. Keep supported operating systems and applications reasonably current.
2. Apply security updates within a reasonable period based on severity and operational risk.
3. Use screen locking or equivalent access protection when a device is unattended.
4. Use device encryption where supported and appropriate to the device and information handled.
5. Use approved endpoint protection where Igzibo provides or requires it.
6. Avoid disabling security controls without authorization.
7. Install software only when authorized under the Technology and Third-Party Service Security Standard.
8. Protect devices from theft, loss, unauthorized access, and physical damage.
9. Report suspected compromise, loss, or theft promptly.

4. Personally Owned Devices

A personally owned device may be used for Igzibo business only when permitted for the applicable work.

Users must not store Restricted Information or client information on a personally owned device unless the storage is specifically authorized and appropriate safeguards are in place.

Igzibo may prohibit personal-device access where security, contractual, legal, or client requirements make such access inappropriate.

5. Remote Access

Remote access must use authorized accounts and approved access mechanisms.

Users must:

• Use MFA where required by the Identity and Access Management Standard or service.
• Avoid accessing sensitive information over untrusted networks when reasonable safeguards are unavailable.
• Prevent unauthorized persons from viewing or using business systems during remote work.
• Use approved systems for storing and transmitting business information.
• Follow client-specific remote-access requirements.
• Report suspected unauthorized access promptly.

6. Public and Shared Environments

Users should avoid handling Restricted Information in public or shared environments where unauthorized observation, access, or disclosure is reasonably possible.

Shared computers must not be used for Igzibo business unless specifically authorized.

7. Remote Work

Remote work does not change information-classification or access requirements.

Users remain responsible for protecting Igzibo and client information regardless of location.

8. Lost, Stolen, or Compromised Devices

A lost, stolen, or suspected-compromised device must be reported promptly through the applicable security incident reporting process.

Igzibo may suspend accounts, revoke sessions, rotate credentials, or take other protective measures when warranted.

9. Client Systems

When accessing client-managed devices, networks, applications, or environments, users must follow applicable client requirements in addition to this standard.

Where requirements conflict, the stricter applicable security requirement should be followed unless an authorized exception has been documented.

10. Exceptions

Exceptions require documented approval from the appropriate Igzibo authority and must identify:

• The affected device or access method.
• Business justification.
• Security and privacy risks.
• Compensating controls.
• Approval period.
• Review or expiration date.

11. Enforcement

Violations may result in access restrictions, corrective action, contract consequences, or other measures consistent with applicable agreements and Igzibo policies.

12. Relationship to Other Governance Documents

This standard is subordinate to the Technology Acceptable Use Policy and complements:

1. Identity and Access Management Standard.
2. Data Classification and Handling Standard.
3. Technology and Third-Party Service Security Standard.
4. Security Incident Response Procedure.
5. Employee and Contractor Offboarding Procedure.
6. Backup and Business Continuity Standard.

This standard does not replace client-specific security requirements or contractual obligations.

Version History