Skip to content
Ordermatic Docs

Acceptable Use Policy
Owner [Security Owner — to be named: founder/CTO]
Approved by [signatory]
Effective date [set on approval]
Review cadence Annual; acknowledged on hire and annually
Version 0.1 — DRAFT
TSC mapping CC1, CC2

1. Purpose

Section titled “1. Purpose”

Define the security responsibilities of everyone with access to Company systems and data.

2. Endpoint baseline (all work computers)

Section titled “2. Endpoint baseline (all work computers)”

Every laptop used for Company work must have:

  • Full-disk encryption enabled (FileVault / BitLocker).
  • Automatic screen lock after a short idle period.
  • Anti-malware / malware detection active.
  • Automatic OS and security updates enabled.
  • A password manager in use for credentials.

These are verified continuously by the Drata Agent, which each person installs on their work computer. Installing and keeping the agent running is mandatory.

3. Authentication & accounts

Section titled “3. Authentication & accounts”
  • MFA is required on every system that supports it (identity provider, GitHub, Google Cloud, secrets manager, password manager).
  • Use your own individual account; never share accounts or credentials.
  • Use strong, unique passwords stored in the password manager.

4. Handling data & secrets

Section titled “4. Handling data & secrets”
  • Access only the data you need for your role; do not exfiltrate customer data.
  • Secrets are never committed to source control, written to files, or logged. Read credentials at runtime from Infisical / 1Password.
  • Restricted data (customer PII, POs, ERP credentials) stays within Company-managed systems.

5. Acceptable use

Section titled “5. Acceptable use”

Company systems are for Company work. Prohibited: bypassing security controls, installing unauthorized software that touches Company data, using Company access for personal gain, or disabling required endpoint protections (including the Drata Agent).

6. Reporting

Section titled “6. Reporting”

Report any suspected security issue, lost/stolen device, or policy violation immediately via the designated channel (#security / Security Owner), per the Incident Response Policy. Reporting in good faith is never penalized.

7. Acknowledgement

Section titled “7. Acknowledgement”

All personnel acknowledge this policy on hire and annually. Acknowledgement is tracked in the compliance platform (Drata).

8. Review

Section titled “8. Review”

Reviewed at least annually by the Security Owner.