User Responsibilities

ThingLogix users, defined as employees, contractors, or anyone else with authorized access to ThingLogix computing resources, shall have the responsibility to follow good security procedures in the selection and use of passwords and to ensure that unattended equipment has appropriate protection.

These include:

• All users shall be responsible for taking appropriate steps to ensure the security and confidentiality of their passwords.
• Users shall conform to the following standards when creating a password:
  • Passwords shall be strong. A strong password must contain at least one character from two of the following four categories:
    • Letters (upper case characters)
    • Letters (lower case characters)
    • Numeric digits
    • Symbols
  • Strong passwords should be phrase oriented, based on at least 4-5 words, that total between 12-20 characters. Phrases are easier to remember, and provide enough characters to allow you to replace key characters using the rules specified above (e.g. replace an S with a 5, or a 1 with a !, etc.)
• If the system/application supports it, 2-factor authentication should be enabled. The preference is to use an 'Authenticator' App when supported, or to utilize a personal or business cell phone for text-based 2 factor verification.
  • If a cell phone is utilized, the user is required to ensure that their cell phone account with their provider has a confidential PIN number established, known only to the user. This is to make sure that a hacker cannot change their cell phone account, thereby directing texts to another phone.
• Systems should be setup to require password changes a minimum of every 90 days. More often is preferred.
• If supported, systems should not allow re-use of passwords (for a minimum history of 5)
• Multi-Factor authentication shall be used when possible and is mandatory when the above password standards cannot be met.
• Passwords shall not be written down by the user, unless stored in an encrypted electronic file or application for retrieval.
• Passwords shall not be communicated using email, text, slack, or other electronic communication. Passwords, if they must be shared for support purposes, should be shared verbally or, preferably, using an encrypted password management application accessible to all users requiring access to the shared passwords.
• Users leaving their work space shall secure their computer against unauthorized access by locking their screen, thereby requiring login to utilize the computer.
• Usernames and passwords shall not be printed or written on any material or whiteboard. If an exception is needed for this, the material should be shredded or otherwise destroyed/wiped immediately after the exception usage is complete.