IT Security and Acceptable Use Policy

An IT security and acceptable use policy for NDIS providers that sets the rules for how workers use devices, systems, accounts and participant data. It applies to employees, contractors and volunteers, including anyone who accesses work data on a personal device.

What is inside:

• Device use, personal devices and returning equipment when engagement ends
• Passwords of at least 12 characters, multi-factor authentication and screen locking
• Email and communications, including approved platforms and phishing awareness
• Data storage and sharing: approved systems only, no personal cloud storage, encryption, backups and security patches
• Social media rules, including no connections with participants or their families
• Internet use and prohibited activities
• Incident reporting for lost devices, malware, accidental disclosure and unauthorised access
• Responsibilities, records and evidence, and relevant legislation

• Reviewed against the current NDIS Rules, Practice Standards and Commission guidance
• Editable DOCX with a placeholder legend, so you enter your details once
• Instant download

These templates are general information, not legal advice. No template can guarantee registration or audit outcomes.