Remote Work & BYOD

1. Purpose To define the standards, requirements, and procedures for secure and productive remote work at MFC Safe, including the use of personal devices (Bring Your Own Device - BYOD). This policy ensures continuity, data protection, and security compliance.

2. Scope This policy applies to all MFC Safe employees, contractors, and third parties who work remotely or use personal devices to access company systems, data, or networks.

3. Remote Work Policy

• Eligibility: Remote work is approved by direct supervisors and HR based on role suitability.

• Work Environment: Employees must maintain a secure, private, and distraction-free work area.

• Productivity Expectations: Remote staff are expected to maintain the same availability, responsiveness, and productivity as in-office employees.

4. BYOD Policy

• Device Approval: Only approved devices (laptops, smartphones, tablets) meeting security specifications may be used.

• Mobile Device Management (MDM): All BYOD devices must be registered with MFC Safe’s MDM platform to enable remote wiping and configuration enforcement.

• Security Requirements:

  • Devices must have strong password protection.

  • Operating systems and software must be up-to-date.

  • Anti-virus and endpoint protection must be installed and active.

5. VPN & Network Access

• Secure Access: All remote connections must be routed through MFC Safe’s approved VPN.

• Prohibited Networks: Use of public unsecured Wi-Fi without VPN is strictly prohibited.

• Firewall & Encryption: All remote systems must have firewalls enabled and support full-disk encryption.

6. Data Handling & Compliance

• Storage: No sensitive company data may be stored locally on personal devices unless explicitly approved.

• Access Control: Role-based access restrictions will be enforced.

• Compliance: All remote activity must comply with MFC Safe’s Data Security Policy, ISO 27001, and relevant data privacy laws.

7. Incident Reporting Any loss, theft, or breach involving a personal device or remote access must be reported to the IT department within 1 hour of discovery.

8. Termination of Access

• Access to company systems and removal from MDM will be enforced upon employee termination or contract conclusion.

• Company data must be deleted or returned as part of the offboarding process.

9. Policy Enforcement Violations may result in disciplinary action, including termination, depending on the severity of the breach.

10. Review Cycle This policy will be reviewed annually or upon significant change in remote work structure or BYOD security posture.

---

Approval MFC Safe Executive Team Date: 02 April 2025 Policy Version: 1.0