TABLE OF CONTENTS
1. Key Takeaways ………………….1 2. Introduction ………………….2 3. Information Security ………………….2 4. Stewardship ………………….3 5. Legal Compliance ………………….4 6. Key Links ………………….5
Objective Technology is a powerful catalyst for productivity and informed decision-making. It can also bring significant risks for you and the foundation. To maximize its potential while mitigating these risks, the foundation has put into place a Technology Usage Policy that promotes the following outcomes: • You are supported in doing your best work.
• The foundation, including its information assets, reputation, and relationships with grantees and partners, are protected.
The foundation expects you to be knowledgeable about risks and to use informed good judgment when using technology resources. Inappropriate use of technology or failure to comply with this policy may result in disciplinary action, up to and including
termination of employment.
Technology Usage Policy
1
Technology Usage Policy
2
1. Introduction
1.1 Philosophy on Technology Usage
Responsible use of technology in today’s connected world is essential to safeguarding the foundation’s reputation and
ability to achieve its mission. Our philosophy is to balance flexible choice and use of technology with information
security and stewardship of resources. You are empowered to use technology to maximize your productivity with
minimal restrictions. In return, you are expected to use common sense and informed good judgment to make decisions
in the best interest of the foundation and to protect our information assets.
The Technology Usage Policy applies to all technology you use to do your work, including personal computers, mobile
phones, e-readers, tablets, online services, and hotel kiosks. It does not cover all situations or answer every question
regarding technology usage. If you encounter a situation that is not addressed or if you simply have questions regarding
this policy, please contact the foundation’s IT Service Desk.
2. Information Security
2.1 Foundation-Issued Devices
Foundation-issued devices are for staff use only, that is, for foundation employees and contingent workers. To perform
your job, you may be assigned foundation-issued equipment, such as a computer or mobile phone. You are responsible
for the equipment issued to you and its use. Due to the risk of theft or potential loss/compromise of foundation data,
you should always exercise caution if leaving your equipment unattended.
Foundation-issued equipment is configured with a number of safeguards. These may include anti-malware protection
software, screen locking, firewalls, automatic software patching, and encryption. It is essential for the security of the
foundation that these safety mechanisms remain enabled and functional as configured by IT. Contact the IT Service
Desk as soon as possible if you believe that one of these safeguards is not functioning properly.
2.2 Non-Foundation Devices
You may access certain foundation systems and information from non-foundation devices through specific IT services
designed to enhance your productivity, mobility, and ease of use. Information about these services, including specific
terms and conditions, may be found in the Any Device, Anywhere section of the IT Portal. If you utilize these services,
it is your obligation to understand and comply with the terms and conditions.
2.3 Information Access and Storage
You are expected to use informed good judgment in managing the foundation’s information to ensure protection
against unauthorized disclosure or use. Where and how information may be stored and used is dependent on its
sensitivity – that is, the ability of the unauthorized disclosure or use to cause harm to the foundation. Please refer to
the Data Storage Guideline for more information.
An important step in protecting foundation information is preventing unauthorized parties from accessing the systems
that store our information. Based upon your role at the foundation, you are assigned credentials that grant you the
access necessary to perform your job. Your credentials provide access to your confidential personal information, such
as HR data, as well as confidential foundation data. For these reasons, you must never share your credentials with
anyone, including co-workers and IT Service Desk professionals. These credentials are for your use only, and you are
responsible for their safekeeping.
In particular, be aware of phishing scams, in which fraudulent sites or email lure people into submitting confidential
information (e.g., passwords). Refer to the Awareness Guide – Phishing Attack document to learn more about
phishing attacks. If you believe your credentials have been compromised, contact the IT Service Desk immediately.
Also, do not reuse foundation passwords on external web sites or services. This puts the foundation at unnecessary
Technology Usage Policy
3
risk if the site or service is compromised. Refer to the Password Management Guideline for best practices on creating
and managing secure passwords.
2.4 Monitoring of Electronic Content, Electronic Communications, and System Use
It is not the foundation’s regular practice to monitor electronic content, electronic communications, or system use.
However, the foundation reserves the right to perform such monitoring as it deems necessary. Monitoring may be
performed without notification to support activities such as operational maintenance, auditing, and security on both
foundation-owned and non-foundation (e.g., personal) devices that are used for foundation work. Monitoring may also
be performed to understand how you use digital productivity tools and find ways to make them more accessible.
2.5 Awareness of Environment and Information Disclosure
In order to prevent the inadvertent disclosure of confidential or sensitive information, consider your surroundings
when you engage in discussions or work on sensitive documents, whether in person or online. Be particularly careful
in airports, airplanes, restaurants, and other public venues. Without knowing it, you may inadvertently disclose
information if people overhear your conversations or view information within your control.
Keep in mind that it is extremely difficult to use the Internet (including web browsing) anonymously. If you visit a
website, your activity on that website may be traced back to you or the foundation. Additionally, any information
you input into that website can be collected and used to learn about your web surfing patterns and habits. In the case
of controversial topics, this information can be used to build profiles and help malicious users exploit the foundation
by potentially damaging its reputation or stealing important foundation information.
3. Stewardship
Stewardship at the foundation applies not only to money, but to the use and security of technology and information.
3.1 Personal Use of Foundation Technology Resources
You are ultimately accountable for all activity that originates from your use of foundation technology. The foundation
takes no steps to maintain, retain, back up, or return personal data. You should not store sensitive or confidential
personal information on foundation resources.
Permitted use of foundation technology resources does not extend to individual political activities, which should occur
during off-duty hours, at your expense and without use of the foundation’s name, resources, facilities, technology or
equipment. More information about these prohibited political activities may be found in the Conflict of Interest Policy.
Your Gates Foundation email address is the property of the foundation. As such, please use discretion when sending
email from this address.
Gates Foundation email must not be used for signing personal, legally binding documents (including
DocuSign or similar technologies) or to communicate with outside attorneys on personal/non-foundation
business.
Foundation email must not be used to conduct non-foundation business transactions (i.e. mobile app store
purchases, content streaming sites and e-retailers).
3.2 Physical Loss
You should treat foundation-issued equipment with care. If you believe any of your foundation-issued equipment has
been lost or stolen, contact the IT Service Desk immediately. IT will work with you to assess the information lost and
help you to take the necessary steps to recover the data or prevent it from falling into the wrong hands.
3.3 Software and Technology Services Not Provided by IT
The freedom to install software and to use external technology services is a significant privilege that carries significant
responsibility.
Technology Usage Policy
4
If you install software or use external technology services on a foundation-issued device or on a personal device used
for foundation business, you must understand the associated risks. Unpatched software is a common source of viruses
and other malware, which pose a threat to the foundation’s information assets. Software written by untrustworthy
authors can result in loss of confidential data or system compromise. Use of online services can result in unintended
disclosure or even loss of foundation information assets.
You are responsible for managing these risks, including ensuring that the software or service is properly licensed (see
Section 4.2) and kept current with security patches. If the software has an auto-update function, consider enabling it.
Procurement of software and technology services must be in accordance with the foundation’s Travel and Expense
Policy.
4. Legal Compliance
You are required to use technology resources in accordance with all applicable laws and foundation policies.
4.1 Records Management
The foundation has a Records Management Policy that requires you to manage records under your control. Records
disposition includes the identification, retention, preservation, and disposal of electronic and physical records as part
of your day-to-day work. You are responsible for ensuring your use of technology complies with the foundation’s
Records Management policy.
In no event are you permitted to delete or destroy data that may be relevant to a pending or threatened claim or
government investigation.
4.2 Licensing and Copyright Laws
When installing or using software not provided by the foundation, you must ensure that the software is properly
licensed. This also applies to copyrighted materials, including music, pictures, videos, and movie files, as well as
written media. Contact the Legal Department with questions about copyrighted material and the IT Service Desk with
questions about software licensing.
4.3 Electronic Content and Messaging
You are encouraged to use electronic messaging technologies to facilitate the exchange of information and to promote
collaboration at the foundation. However, you may not send, download, store, or forward electronic messages or other
electronic content containing offensive language, images, sound clips, or harassing statements. This includes but is
not limited to disparagement of others or inappropriate content based on race, sex, sexual orientation, religion, caste,
creed, national origin, age, disability, marital or veteran status, or any other protected status. Please refer to the
foundation’s Online Social Media Policy for additional information about online communication.
4.4 Recording of Video, Web, or Telephone Conferences
Before recording any meeting or telephone conference, you should determine whether recording the meeting session
is appropriate. Further, to comply with privacy laws, you or the person recording must inform all presenters and
participants that the recording is taking place prior to the start of the meeting by providing the following
announcement:
IMPORTANT NOTICE: This meeting is being recorded by the foundation. Any documents and other
materials exchanged or viewed during the meeting session may also be recorded. By joining the meeting,
you consent to such recording. If you do not consent to the recording, you have the option not to participate
in the meeting.
Technology Usage Policy
5
5. Key Links
Any Device, Anywhere
Awareness Guide – Phishing Attack
Conflict of Interest Policy
Data Storage Guideline
Email Management Standards
IT Service Desk
Legal Department
Online Social Media Policy
Password Management Guideline
Records Management Policy
Travel and Expense Policy
The foundation hopes that you have a productive, secure, and enjoyable computing experience. For any questions,
please contact the IT Service Desk, or call 206.709.3545
Policy: Records Management Approved by: Connie Collingsworth Revision Date: April 30, 2015
Records Management Policy
Records exist in a variety of forms, including physical and electronic. The foundation produces, receives, stores and disposes of a large number of records in the normal course of its ongoing activities. The foundation must manage and dispose of its records in order to ensure compliance with legal requirements, respond to internal and external inquiries, preserve our institutional knowledge and history, and operate efficiently.
Accordingly, it is the policy of the Bill & Melinda Gates Foundation to ensure its records are (i) properly identified and retained for the time periods needed to support the foundation’s operations and comply with legal requirements, and (ii) disposed of in a responsible and timely manner.The responsibilities in this Records Management Policy and Procedures apply to all foundation staff and/or agents who create, receive, manage or maintain custody or control of records of the Bill & Melinda Gates Foundation and its wholly owned affiliates; IRIS Holdings LLC, Gates Philanthropy Partners, and the Bill & Melinda Gates Foundation Trust.
Inquiries
Any questions regarding this Policy should be directed to [email protected].
Records Management Procedures
2
1.0 Definitions
Active Business Record: A Business Record needed to perform current foundation business/operations, subject to frequent use, and typically easily accessible to the relevant foundation employee(s). Examples include an active investment tax file, current strategy document, or active employee personnel file. Business Record: The official copy of a record that has business or legal significance to the foundation, based on its content and context, and needs to be preserved to meet business or legal requirements. Business Records are identified on the Records Retention Schedule by department and office. Compliance Team: Members of the Legal, IT and Facilities departments and a foundation-wide team of Records Administrators. Electronic Record: A record in digital form (e.g., email, Microsoft Office suite files, Adobe files) generated and used by electronic information systems (e.g., Outlook, SharePoint, Unison, ICS, Workday, Concur, network drives), or information technology devices (e.g., laptop, tablet, phone). Disposal: Secure, permanent deletion or destruction of records so that information cannot be recovered and data cannot be reproduced by the foundation or, if historically significant, transfer of records to the Gates Archive for permanent preservation. Disposal Notice: An annual notice sent to all employees as a reminder that (a) certain Outlook records will be automatically deleted upon the stated Disposal date (generally 28 days following the Disposal Notice) according to the Email Management Standards as well as eligible tagged Business Records in ICS, Unison and SharePoint; and (b) they must identify and Dispose of all untagged Business Records that have met their Retention Period and all Non-Business Records that are no longer useful. Gates Archive: An external partner to the foundation whose purpose is to identify, catalog, preserve and curate records that have historical significance to the foundation and the Gates family. Inactive Business Record: A Business Record that is related to completed activities or is no longer needed to conduct current foundation business, but must be preserved until it meets the end of its retention period to fulfill legal or business requirements. Examples include a closed investment tax file, paid invoice, final annual report, or personnel file for an employee who has left the foundation.
Legal Hold: Procedure used by the Legal department, via a notice sent to specified employees or others, to temporarily cease modification or Disposal of identified records, even though they otherwise may be eligible for Disposal.
Records Management Procedures
3
Legal Hold Release: Procedure used by the Legal department, via a notice sent to specified employees or others, to release the Legal Hold of identified records so that they revert back to their normal operating status and Retention Period.
Non-Business Record: A record that does not have business or legal significance to the foundation and does not need to be retained once it is no longer useful. Examples include working documents, convenience copies, duplicates, drafts, email, and records that may be useful but do not provide formal evidence of a foundation business activity or outcome. Physical Record: A record in paper or other tangible form which takes up physical space (e.g., paper, photograph, DVD). Recordkeeping System: A hard copy or electronic repository designated as the official place of deposit for housing, storing, maintaining, and providing access to a specified Business Record in compliance with law and established business practices. Recordkeeping Systems can be physical (e.g., file cabinets or off-site storage) or electronic (e.g., SharePoint, Unison, ICS or vendor-hosted electronic information systems) and are specifically designated for optimum protection and storage capacity. Records Administrator: A foundation staff person who is assigned to coordinate Records Management administration within his or her department. The Records Administrator works with the Compliance Team and his or her department personnel to support or manage records Disposal, Legal Holds and Releases, offsite and vendor-provided storage, and the foundation’s Records Retention Schedule Records Management: The process of managing records in a cost-effective and legally-compliant manner. The foundation is required by law and foundation business requirements to retain certain Business Records for a specific Retention Period and, once that time has passed, Dispose of those records in a timely and consistent manner. Foundation records must be managed regardless of their format, media, or storage location. Records Retention Schedule: The approved list of all foundation Business Record types, including their description, Retention Period, and designated Recordkeeping System. Retention Period: The period of time for which Inactive Business Records are to be retained prior to routine Disposal, as identified in the Records Retention Schedule. The Retention Period begins from the date a Business Record becomes inactive. For example, if the required Retention Period for invoices is 7 years, then invoices should be retained for 7 years from the date they were paid (i.e., the date they became Inactive Business Records). Retention Policy Tag: A tool available in Outlook, SharePoint, ICS, and Unison which enables staff to automate records preservation and Disposal by incorporating Retention Period metadata into Electronic Records.
Records Management Procedures
4
2.0 Managing Business Records and Non-Business Records
Business Records must be identified, classified, and retained for the applicable Retention Period, in the designated Recordkeeping Systems, and then permanently Disposed of in a timely and consistent manner. Non-Business Records may be retained while still useful and then Disposed of when they are no longer useful.
These procedures apply to:
• All foundation records created or received in conjunction with foundation programs and operations, IRIS Holdings LLC, Gates Philanthropy Partners, and the Bill & Melinda Gates Foundation Trust.
• All locations where foundation records are maintained, regardless of format or media, including with vendors, in regional offices, at offsite storage locations, and on personal electronic devices.
• All forms of foundation staff (including employees and contingent workers), contractors, consultants, outsourced service providers, vendors, and agents who create, receive, and manage foundation records.
2.1 Records Retention
Once a Business Record becomes an Inactive Business Record, the specified Retention Period begins and, for the duration of the Retention Period, the foundation must retain the Business Record in the specified Recordkeeping System. Non-Business Records should be retained for as long as they are useful.
2.2 Records Disposal
The Legal department will issue an annual Disposal Notice. Within the time frame stated in the Notice, generally within 28 days, each staff member must take the following steps to ensure Disposal of all Business Records whose Retention Periods have expired and Non-Business Records that are no longer useful:
Physical Records stored on or off site: Each staff member will identify and Dispose of physical Business Records in his or her control for which the Retention Period has expired, and physical Non-Business Records that are no longer useful.
Electronic Records in SharePoint, Unison and ICS: IT will Dispose of Business Records in accordance with their assigned Retention Policy Tags. Each staff person shall identify and Dispose of Non-Business Records which are no longer useful.
Electronic Records in Network Drives, Hard Drives, Phones, Thumb drives, CDs, and Personal Electronic Devices: Each staff person shall identify and Dispose of Non-Business Records which are no longer useful.
Electronic Records in Vendor-Hosted Electronic Information Systems (e.g., Workday, Great Plains, BrassRing, Concur): Records Administrators shall provide a Disposal Notice to vendors who may host or store their department’s electronic records.
Email: IT will ensure deletion of certain Outlook records (e.g., email, conversation
history) as established by the Email Management Standards. Each staff person shall identify and Dispose of Outlook items which are no longer useful.
Records Management Procedures
5
In order to protect the foundation’s legal interests, to the best of our ability, Disposal must be performed in a defensible, timely and consistent manner and in accordance with these Procedures. Transferring or duplicating records to circumvent Disposal is prohibited. Disposal of Business Records prior to the expiration of their Retention Period is prohibited. Persons engaging in such actions may be subject to disciplinary actions, up to and including dismissal.
3.0 Legal Hold and Legal Hold Release
When there is a possibility of litigation, audit, or governmental investigation involving the foundation, Disposal of records associated with the inquiry or potential inquiry must be suspended immediately and the records become subject to a Legal Hold. Records subject to a Legal Hold cannot be modified or Disposed of even when otherwise specified by the Records Retention Schedule. Disposing of, discarding, withholding, or altering records pertinent to an audit, litigation or governmental investigation is a crime. Persons found guilty of such actions may be subject to disciplinary actions, up to and including dismissal.
The Legal department will notify all relevant staff of a Legal Hold, identify for them the types of records affected, and assist, as needed, with their preservation obligations. The Legal department will similarly notify all relevant staff of a Legal Hold Release, at which time the subject records are released from Legal Hold. Staff who receive this notice should review the subject records for Disposal no later than the next Disposal Notice. The Legal Department has sole authority to issue a Legal Hold or Legal Hold Release.
4.0 Records Retention Schedule
The Legal department will work with the Records Administrators to periodically review the Records Retention Schedule to identify and incorporate any necessary modifications or updates.
5.0 Records Management Organization
The Compliance Team is responsible for managing execution and compliance with the Records Management Policy and Procedures.
Questions about the Records Management program should first be directed to the appropriate Records Administrator. If the Records Administrator should need assistance in responding to an inquiry, the Records Administrator should contact [email protected].
Top Related