IT Acceptable Use & Information Security Policy

Company: Blue Gold
Policy Owner: Management / IT
Version: 1.0
Effective Date: 19/01/2026
Review Frequency: Annually or following significant IT or regulatory changes

1. Purpose

This policy defines the acceptable, secure, and responsible use of information technology and information assets at Blue Gold. It exists to:

• Protect Blue Gold’s systems, data, people, and reputation

• Reduce cyber, legal, financial, and operational risk

• Set clear expectations for employees and contractors

• Support compliance across all countries in which Blue Gold operates

2. Scope

This policy applies to:

• All employees, contractors, consultants, temporary staff, and third parties (“Users”)

• All Blue Gold–owned or Blue Gold–approved IT systems, accounts, and data

• All locations, including offices, home working, client sites, and travel

• All countries of operation, including the UK, US, EU, UAE (Dubai), and Ghana

3. Key Principles

Users must:

1. Use IT systems responsibly and primarily for business purposes

2. Protect Blue Gold data, systems, and credentials at all times

3. Follow security controls and instructions issued by Blue Gold

4. Act lawfully, ethically, and professionally

5. Promptly report mistakes, incidents, or suspicious activity

Limited personal use is permitted only if it is reasonable, minimal, lawful, and does not create risk or interfere with work duties.

4. Company Equipment Only (No BYOD)

4.1 Device Use

• Only Blue Gold–supplied computers and devices may be used to access company systems or data.

• Personal laptops, tablets, or desktop computers must not be used for Blue Gold work.

• Company devices must not be shared with family members, friends, or unauthorised persons.

4.2 Device Security

Users must:

• Keep devices physically secure at all times

• Lock screens when unattended

• Allow required security software, updates, and monitoring

• Never disable antivirus, encryption, firewall, or endpoint protection tools

5. Accounts, Passwords & Access Control

Users must:

• Use only their own assigned accounts

• Never share passwords, MFA codes, or login credentials

• Use strong, unique passwords as required

• Enable multi-factor authentication where provided

• Log out or lock devices when not in use

Access to systems and data is granted on a least-privilege, need-to-know basis and may be removed at any time.

6. Data Protection & Information Security

6.1 Data Handling

Users must:

• Access only the data required for their role

• Store data only in approved Blue Gold systems

• Use approved methods for file sharing and collaboration

• Protect confidential and personal data from unauthorised disclosure

6.2 Data Classification (Baseline)

• Public: Approved for external sharing

• Internal: For Blue Gold internal use only

• Confidential / Restricted: Strictly limited access (e.g. financial data, personal data, contracts, credentials)

Confidential or personal data must never be copied to:

• Personal email accounts

• Personal cloud storage (e.g. Google Drive, iCloud, Dropbox)

• Unapproved software or platforms

• External storage devices e.g. USB dongle, without prior approval

7. Email, Internet & Communications

Users must:

• Treat all communications as professional business records

• Be cautious with links and attachments

• Report suspicious emails (phishing) immediately

• Use company-approved communication tools only

The following are prohibited:

• Harassment, discrimination, hate speech, or offensive content

• Misrepresentation or impersonation

• Excessive non-work use

• Accessing or distributing illegal or inappropriate material

8. Software, Cloud Services & Shadow IT

• Only approved and licensed software may be installed or used

• Users must not sign up for new tools or SaaS platforms using a Blue Gold email address without approval

• Browser extensions, scripts, or automation tools require approval

9. Generative AI & Automation Tools

Blue Gold recognises the benefits of AI but requires responsible use.

Users must:

• Use only AI tools approved by Blue Gold for work purposes

• Never enter confidential, restricted, or personal data into public AI tools

• Never input credentials, system configurations, or proprietary code

• Treat AI output as unverified and review it for accuracy, bias, confidentiality, and legal risk

Users remain fully responsible for any work produced using AI tools.

10. Remote Work, Travel & Physical Security

When working remotely or travelling:

• Use secure internet connections as instructed

• Avoid public Wi-Fi hotspots, stick to hotel provided Wi-Fi only

• Avoid using internet cafes or other third party devices to access work data

• Protect screens from shoulder-surfing

• Never leave devices unattended in public places or vehicles

• Report loss or theft immediately

11. Monitoring & Privacy

To protect the business, Blue Gold may monitor and log:

• Network activity

• System usage

• Security events

• Use of company devices and accounts

Where permitted by local law, users should have no expectation of privacy when using Blue Gold systems.

Monitoring will be lawful, proportionate, and business-justified.

12. Legal & Regulatory Compliance

Users must comply with applicable laws and regulations in all operating regions, including data protection, cybersecurity, and computer misuse laws.

This includes respecting:

• Personal data protection obligations

• Confidentiality agreements

• Contractual and regulatory requirements

13. Incident Reporting

Users must immediately report:

• Phishing or suspicious messages

• Malware or unusual device behaviour

• Lost or stolen devices

• Accidental data disclosure

• Policy breaches (including their own mistakes)

Prompt reporting is essential and will be treated responsibly.

Report to: [email protected] telephone: +44 1225 588582

14. Exceptions

Exceptions to this policy must:

• Be documented

• Be risk-assessed

• Be approved by management

• Be time-limited

15. Enforcement

Failure to comply with this policy may result in:

• Removal of system access

• Disciplinary action up to and including termination

• Legal or regulatory action where applicable

16. Policy Review

This policy will be reviewed:

• At least annually

• After significant security incidents

• Following major regulatory or operational changes

Employee Acknowledgement

IT Acceptable Use & Information Security Policy Agreement

I confirm that I have read, understood, and agree to comply with Blue Gold’s IT Acceptable Use & Information Security Policy.

I understand that failure to follow this policy may result in disciplinary action, up to and including termination, and/or legal consequences.