Technology Acceptable Use Policy

Organization: Igzibo Engineering Solutions, Inc.
Document: technology-acceptable-use-policy-v2.md
Version: 2.0
Status: Living policy
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and following material changes to technology, law, security requirements, or business operations

1. Purpose

This policy establishes acceptable-use requirements for technology and information resources provided, owned, licensed, administered, funded, or authorized by Igzibo. It is intentionally technology-neutral and remains applicable if Igzibo changes email, collaboration, document, identity, cloud, development, or productivity platforms.

The policy is intended to protect Igzibo, its personnel, clients, customers, contractors, business partners, information, systems, and technology resources.

This policy supplements applicable law, contracts, confidentiality obligations, client requirements, employment or contractor agreements, and other Igzibo policies and standards. Where a binding requirement is stricter, the stricter requirement applies.

Definitions

• AI — Artificial Intelligence, technology capable of performing tasks commonly associated with human intelligence.
• CISA — Cybersecurity and Infrastructure Security Agency, a U.S. government agency that provides cybersecurity guidance and resources.
• Igzibo — Igzibo Engineering Solutions, Inc.
• MFA — Multi-Factor Authentication, authentication requiring two or more independent authentication factors.
• NIST — National Institute of Standards and Technology, a U.S. government agency that publishes cybersecurity and technology guidance.

• Organizational Resource — Any technology, account, system, service, device, information asset, or other resource owned, licensed, administered, funded, or authorized by Igzibo.

• Authorized Purpose — A legitimate business purpose within a user's assigned duties, approved by Igzibo, or reasonably necessary to perform authorized work.

• Organizational Account — An account issued, controlled, or authorized by Igzibo for an organizational purpose.
• Personal Account — An account established for an individual's personal use and not controlled or authorized by Igzibo.
• Organizational Information — Information created, received, stored, processed, transmitted, or maintained for Igzibo or in connection with Igzibo business.
• User — Any employee, contractor, consultant, intern, temporary worker, vendor, or other person or system authorized to use an Organizational Resource.

2. Scope

This policy applies to all Users and all Organizational Resources, regardless of provider, hosting location, device ownership, or access method.

It applies to company-owned, personally owned, client-owned, and other devices when they are used to access Organizational Resources.

3. Policy and Document Precedence

This policy establishes high-level acceptable-use requirements. Supporting standards establish more specific requirements.

The following precedence applies when requirements overlap:

1. Applicable law and binding regulatory requirements.
2. Client or contractual requirements applicable to the activity.
3. This policy and other approved Igzibo policies.
4. Applicable Igzibo standards and procedures.
5. Vendor or platform configuration guidance.

A more specific requirement may supplement this policy but may not be interpreted to authorize conduct prohibited by a higher-priority requirement.

4. Organizational Accounts

Organizational Accounts are provided for Authorized Purposes.

Users must not treat an Organizational Account as a personal identity.

An Igzibo email address or other Igzibo-managed identity must not be used to create, register, or maintain a Personal Account on an external website or service.

This prohibition includes personal:

• Social-media accounts.
• Shopping accounts.
• Banking or financial accounts.
• Entertainment or gaming accounts.
• Dating accounts.
• Cloud-storage accounts.
• Forums and community accounts.
• Personal software-development accounts.
• Personal AI accounts.
• Education accounts.
• Newsletters and subscriptions.
• Loyalty or rewards accounts.

An external account may be created using an Organizational Account only when the account is an authorized business account, is controlled by Igzibo, has an identified business purpose, and can be recovered or transferred by Igzibo.

Users must not make an Igzibo business system dependent solely on a personal email address, personal account, personal payment method, or personal telephone number unless specifically authorized.

5. Credentials and Authentication

Users must:

• Keep organizational credentials confidential.
• Use unique credentials for Organizational Resources.
• Use an approved password manager when provided.
• Use MFA whenever supported.
• Prefer phishing-resistant authentication where practical.
• Protect authentication devices.
• Report suspected credential compromise promptly.
• Deny unexpected authentication prompts.

Users must not share passwords, MFA codes, access tokens, private keys, or similar credentials.

6. Email and Communications

Users must use organizational communication systems professionally, securely, and for Authorized Purposes.

Users must verify unusual requests involving money, credentials, sensitive information, account changes, or payment instructions.

Users must not:

• Forward Confidential or Restricted information to personal email without authorization.
• Send organizational information to unauthorized recipients.
• Use organizational resources for fraud, harassment, threats, unlawful activity, or deception.
• Circumvent approved communication or security controls.

Suspected phishing, impersonation, or business-email compromise must be reported promptly.

7. Information Handling

Users must follow the Data Classification and Handling Standard.

Users must access only information necessary for authorized duties.

Confidential and Restricted information may only be stored, transmitted, processed, or shared using approved systems and methods appropriate to its classification.

Client information must be handled according to applicable client contracts and security requirements.

8. Storage and Collaboration

Business information must be stored in approved organizational systems whenever practical.

Users must not use personal cloud storage, personal repositories, or Personal Accounts as repositories for Igzibo business information unless specifically authorized.

Users must:

• Share information only with authorized recipients.
• Use minimum necessary permissions.
• Verify recipients before sharing sensitive information.
• Avoid public links for Confidential or Restricted information.
• Remove unnecessary access when work is complete.

9. Software, Applications, and Services

Users must not introduce software, browser extensions, cloud services, automation services, AI services, or other technology that creates material risk to Igzibo without appropriate authorization.

A service being free, publicly available, or easy to register for does not make it approved for business use.

New business services must be evaluated according to the Technology and Third-Party Service Security Standard.

10. Artificial Intelligence and Generative AI

AI use must comply with the AI and Generative AI Usage Standard.

Users must not submit Confidential or Restricted information, client information, credentials, secrets, or other protected information to an AI service unless the service and use case are approved.

Users remain responsible for AI-assisted work product and must review material output for accuracy, security, confidentiality, intellectual-property concerns, privacy, and client requirements.

11. Software Development

Organizational source code must be stored in approved repositories.

Users must not:

• Publish proprietary code without authorization.
• Commit credentials or secrets to source control.
• Use Personal Accounts or personal repositories for organizational code without authorization.
• Bypass repository security controls.
• Introduce unapproved dependencies or development tools that create material risk.

12. Devices and Remote Access

Users must take reasonable precautions when accessing Organizational Resources remotely.

Users must:

• Keep supported operating systems and applications reasonably current.
• Lock unattended devices.
• Protect devices from unauthorized physical access.
• Use appropriate network protections.
• Report lost or stolen devices promptly.

Personally owned devices may access Organizational Resources only when permitted by Igzibo and subject to applicable security requirements.

13. Prohibited Activities

Users must not use Organizational Resources to:

• Conduct unlawful activity.
• Commit or facilitate fraud.
• Harass, threaten, or abuse others.
• Distribute malware.
• Obtain unauthorized access.
• Circumvent security controls.
• Conduct unauthorized security testing.
• Obtain or use another person's credentials without authorization.
• Conduct unauthorized surveillance.
• Infringe intellectual-property rights.
• Operate unauthorized cryptocurrency mining or similar resource-intensive activity.
• Conduct unauthorized personal or commercial business activity.
• Create Personal Accounts using Igzibo identities.
• Conceal activity intended to circumvent this policy.
• Interfere with the confidentiality, integrity, or availability of Organizational Resources.

This list is not exhaustive. Igzibo may restrict conduct that creates material security, legal, operational, financial, or reputational risk.

14. Third-Party Access

Users must not provide organizational credentials to third parties.

Third-party access must be authorized, attributable to an identifiable individual or system where practical, limited to the minimum necessary, and removed when no longer required.

15. Monitoring and Privacy

To the extent permitted by applicable law and contractual obligations, Igzibo may monitor, audit, retain, investigate, or review use of Organizational Resources for security, fraud prevention, incident response, compliance, administration, business continuity, legal obligations, and protection of Igzibo and others.

Users should not assume that Organizational Accounts or Organizational Information are exclusively private from Igzibo.

16. Security Incident Reporting

Users must promptly report suspected or confirmed:

• Account compromise.
• Credential exposure.
• Phishing or impersonation.
• Lost or stolen devices.
• Malware.
• Unauthorized access.
• Accidental disclosure.
• Unauthorized sharing.
• Suspicious payment requests.
• Other events that may compromise Organizational Resources or information.

Users must not conceal mistakes or delay reporting while attempting to determine whether harm occurred.

17. Separation from Igzibo

When authorization ends, the User must stop using Organizational Resources, return organizational equipment when requested, return or securely delete organizational information from personal devices when instructed and legally permitted, and cooperate with account-transition procedures.

Igzibo may disable accounts and revoke access when authorization ends.

18. Exceptions

Exceptions require documented approval by an authorized Igzibo representative.

An exception must identify the affected resource, requirement, business justification, duration, risk, and compensating controls.

19. Enforcement

Violations may result in additional training, access restriction, suspension or termination of access, investigation, contractual remedies, employment action where applicable, or legal action where appropriate.

Enforcement must be consistent with applicable law and contractual obligations.

20. Technology-Neutral Implementation

This policy applies to functional categories rather than specific vendors.

For example, an Organizational Account may be provided by Google Workspace, Microsoft 365, or another provider. A change in technology provider does not change the underlying user obligations.

Vendor-specific configuration requirements belong in separate standards or procedures.

21. References and Research Basis

This policy was informed by:

• NIST Cybersecurity Framework 2.0: https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20
• CISA cybersecurity guidance: https://www.cisa.gov/
• Google Workspace security guidance: https://knowledge.workspace.google.com/

These sources provide guidance and do not replace applicable law, contract requirements, or Igzibo's own governance requirements.

22. Version History

Appendix A: User Quick Reference

Do

• Use Igzibo accounts for Igzibo business.
• Use MFA.
• Protect credentials.
• Verify unusual requests.
• Store business information in approved systems.
• Follow data classification requirements.
• Use approved services.
• Report suspected security incidents promptly.
• Ask before using a new service for business information.

Do Not

• Create personal website accounts using an Igzibo email address.
• Use Igzibo credentials for personal services.
• Forward protected business information to personal email.
• Store business information in personal cloud storage without authorization.
• Share passwords or MFA codes.
• Approve unexpected authentication prompts.
• Upload protected information to unapproved AI services.
• Publish proprietary code without authorization.
• Circumvent security controls.
• Continue accessing Igzibo systems after authorization ends.