Resolution of the Standing Commission on the Use of Information Technology - Scope of Application

1. This resolution regulates the use of information technology by cantonal employees within the scope of their employment.

2. The resolution also applies to the Appenzell Health Center. The duties and rights of the department head pursuant to this resolution are exercised by the hospital director.

3. In corporations and enterprises with a contractual right to use cantonal information technology resources, the respective authority or management ensures that the substantive requirements outlined in Chapters II and III of this resolution are met by their members or employees.

4. Paragraph 3 applies accordingly to members of the state commission.

1. The Cantonal Council appoints an IT Security Officer and a Deputy for the cantonal administration. With the consent of the bodies and enterprises connected to the AINet, they may also perform their duties for these entities.

1. Information Technology Devices are tools and components thereof that can be used in the processing, storage, or transmission of electronic data.

2. Information Technology Devices particularly include

1. Computers of all kinds, including notebooks, digital assistants, and smartphones;

2. Data carriers of all kinds, such as hard disks, diskettes, or USB sticks;

3. AINet, Internet, and email services;

4. Electronic data and programs.

1. The Use of Information Technology Resources Serves Business Purposes.

2. The private use is occasionally permitted. It must neither impair the employee's performance nor the IT infrastructure, nor impose additional burdens on the employer or pose security risks. It may be restricted or prohibited in justified cases.

1. The storage of data on devices connected to the AINet must be carried out on a server drive of the canton.

2. Personal data should generally be stored on private data carriers, for example, on a designated USB stick.

3. The storage of business data on remote systems, such as in clouds, is not permitted.

1. Programs and devices are considered foreign if they have not been provided by the Canton or explicitly approved by the Office of Information Technology (AFI).

2. Foreign programs may not be installed, and foreign devices may not be connected, unless their use is required by a business mandate.

3. Confidential business data must be stored encrypted on foreign devices and must be immediately deleted when no longer needed.

1. Employees shall protect the information technology resources they use from unauthorized use according to the state of the art, in particular by

1. Locking computers or logging out of the system when leaving the workplace;

2. Keeping personal passwords confidential;

3. Carefully storing and monitoring mobile devices.

2. Programs, files, emails, and attachments suspected of containing viruses must not be opened or forwarded and should be deleted. In cases of doubt, the AFI (IT Support) may be consulted.

3. Employees shall promptly inform their supervisor of any security-related risks, for example, following the loss of a mobile device.

1. Information technology resources must not be open simultaneously in the AINet and another network, for example, in a public, wireless network.

1. Modifications to the provided IT resources, particularly to the configuration of hardware, system settings, and software, as well as circumventing or removing security measures, are not permitted.

2. Copying of programs is prohibited, with the exception of backup copies by the AFI.

1. Upon termination of the employment relationship, the information technology resources provided must be returned in an orderly condition.

2. Private data and emails must be deleted. Professional data and emails should be managed according to the supervisor's instructions.

3. If the departing employee fails to fulfill these obligations, the IT department may, in consultation with the supervisor, clear the information technology resources.

1. The AFI may allow exceptions to the restrictions under this chapter in justified cases and in consultation with the supervisor.

2. The Cantonal Informatics Strategy Commission may issue guidelines for the use of informatics resources and for the secure handling of these resources.

1. Internet Usage and Access to Websites are prohibited if they interfere with work, burden the IT infrastructure, are associated with security risks, or violate the law or good morals.

2. The Cantonal IT Strategy Commission shall establish a list of prohibited usages and accesses within the framework of this provision, which shall be communicated to and made accessible to employees in an appropriate form. Prohibited usages and accesses may be electronically blocked.

3. Particularly prohibited are accesses to websites with erotic or pornographic content or with content that glorifies violence, is racist, sexist, or extremist.

1. The automatic forwarding of emails to external email addresses is prohibited.

2. The AFI may restrict the number of recipients and the size of attachments for operational or technical reasons.

1. The head of the department may allow business-related exceptions from the restrictions under this chapter.

1. The AFI is authorized to record the traffic data of internet access and email communication.

2. In the case of internet access, usernames, accessed internet addresses, the time and date of access, as well as the size of downloaded files may be logged.

3. In email communication, sender and recipient addresses, subject line, time and date of transmission, size of emails, and the designation and size of attachments may be recorded.

4. The control data will be deleted no later than 12 months, subject to cases of suspicion.

1. Employees who observe signs of a violation of this resolution or a criminal law are entitled to report it to the IT Security Officer.

2. The AFI and the IT Security Officer are entitled to inform the responsible authorities about the identified signs.

3. Criminal complaints pursuant to Article 15 of the Introductory Act to the Swiss Code of Criminal Procedure (EG StPO) are reserved.

1. In case of indications of violations, technical or organizational measures to prevent further violations are to be examined.

2. The IT Security Officer may, upon indications of a violation, order a personal evaluation of the control data by the AFI.

3. The IT Security Officer shall notify the affected employee and the respective department head of the conduct of a personal evaluation. The employee is allowed to review the data and results.

4. If the suspicion is not substantiated based on the evaluation of the tangible data, the personal evaluation is to be discontinued. The personal data must be deleted immediately. The IT Security Officer informs the affected employee and the respective department head.

1. If a violation is identified, the IT Security Officer informs the offending person, their supervisor, and the respective department head.

2. Personal data documenting a violation is secured and noted in the personnel file.

1. The Information Security Officer may order personal data evaluations, insofar as this is essential for determining the causes of technical problems or ensuring the functionality of the information system.

2. Notification to the affected individuals is only necessary if there are indications that the cause of the technical problems and the endangerment of functionality are violations of this resolution.

1. In the event of violations of this decision, disciplinary measures and claims for damages may be imposed in addition to criminal consequences.

2. The AFI, in agreement with the supervisor, may in particular

1. withdraw IT resources or restrict their use;

2. restrict or block internet or email access;

3. block or delete data or programs.

1. This resolution replaces the previous regulations for information technology users, in particular the guidelines for information technology users.

1. This resolution shall enter into force on August 1, 2013.