Regulations on the Use of IT Resources - Scope

1. This regulation applies to the employees of the cantonal administration (excluding schools), the members of the cantonal government, the employees of the financial audit office, the data protection supervisory authority, the ombudsperson, as well as the courts of the Canton of Basel-Landschaft (hereinafter referred to as "employees").

2. The regulation must be signed by all employees who use IT resources. The supervisory authorities shall determine the procedure for signing.

3. Amendments to the regulation must be communicated to the employees in an appropriate manner, but are valid for them even without written confirmation, unless another decree requires otherwise.

1. The regulation governs the safe and lawful use of IT resources.

2. It aims to protect electronic information regarding confidentiality, availability, and integrity, to ensure the economical use of IT resources, and to uphold the personal rights of employees.

1. Employees are personally responsible for the use of the IT resources they utilize in accordance with the applicable legal framework and these regulations.

2. Supervisors and project managers are responsible for communicating and enforcing the regulations.

1. In the use of information technology resources, the Law of February 10, 2011, on Information and Data Protection, the Ordinance of December 4, 2012, related to the Law on Information and Data Protection, as well as the Ordinance of March 11, 2008, on Information Security and the regulations based thereon, apply in particular.

1. For the purposes of this regulation, the following shall be understood as

a. * "Information Technology Resources": all devices, programs, facilities, and services that enable the processing, storage, interpretation, reproduction, and transportation of data;

b. "Hardware": all technical devices that enable the processing, storage, or transmission of data (e.g., computers, notebooks, memory sticks, mobile phones, smartphones, and tablets);

c. "Software": all operating systems and programs available on the hardware;

d. "Data": information processed or generated by the canton in the fulfillment of its duties, regardless of the data carrier (e.g., hard drives, memory sticks, notebooks);

e. "Cloud": virtual infrastructure or services offered over a network (e.g., data storage, computing capacity, applications);

f. "Social Media": digital media and technologies that enable the exchange of communication, opinions, and media content individually or in communities;

g. * "Remote Access": access to the networks of the cantonal administration or systems connected to it from outside the premises of the cantonal administration (e.g., telework/home office, mobile work, third-party device/personal device);

h. * "Mobile Device": information technology resources used in a mobile context, distinguished as

1. Smartphones and tablets (both business and personal) used for business purposes by employees; these devices are not defined within the BL domain;

2. BL standard devices, which are defined within the BL domain and can be used mobily (e.g., convertibles);

i. * "VDI" (Virtual Desktop Infrastructure): technology that allows a user's workstation to be centrally operated on a server; the workstation is accessed via a special application that can be installed and used on almost all end devices.

1. Employees must use the IT resources they utilize with care and in a resource-efficient manner. In particular, they are responsible for ensuring that their use does not result in damage to the IT resources themselves, associated systems and networks, or the data stored on them.

2. Security measures implemented by the canton must not be tampered with or removed.

3. If an employee is not directly using an IT resource, access to it must be locked in such a way that it can only be unlocked with personal access credentials.

4. Employees must ensure that, when using IT resources and printing documents, personal data and other information with sensitive content are not accessible to or handled by unauthorized persons.

5. Printing business documents and data with non-public content is prohibited outside the operational environment/teleworking. Within the operational environment, it must be ensured that non-public data cannot be viewed by unauthorized persons.

6. Upon completion of work, the computer must be completely shut down. This ensures that technical and security updates are installed and activated.

1. Employees are responsible for the proper use of the available access control facilities and measures (e.g., password selection and safekeeping, certificates, SmartCard).

2. Passwords for personal identification means, such as user IDs or SmartCards, are to be treated confidentially and must not be shared.

1. The IT resources shall be procured by the competent procurement office in accordance with the applicable guidelines and standards.

1bis. All IT resources made available remain the property of the canton.

1ter. No on-site support is provided for telework. The usual tools and processes for reporting malfunctions and defects are available.

2. The installation of software on hardware provided by the canton (including VDI) and the installation and use of hardware not provided by the canton at the workplace are generally prohibited. Exceptions require a decision by the IT department, the ITO Council, or the Executive Council.

3. Employees are required to return IT resources without being asked when changing positions or when the reasons that led to the allocation of IT resources cease to exist.

4. Before leaving, employees shall forward the business-relevant data from their personal (non-private) storage to the position designated by their supervisor. After leaving, user accounts and email accounts (like all other personal and private data storage) will be deactivated and subsequently deleted. Employees may take their private emails and data with them.

1. For operational or business reasons, the superior may grant approval for remote access upon request. The approval for telework occurs in accordance with the guidelines of the Personnel Office concerning telework.

2. If remote access is approved via a third-party device, the employee is responsible for ensuring a functional and up-to-date malware protection on this device.

3. Central IT provides secure access for remote access.

3a Employees who have a mobile workspace device (e.g., convertible) or use a private device with installed VDI client software must access the cantonal network and associated systems remotely. The devices automatically establish an encrypted connection to the cantonal network through the accesses provided by Central IT. This connection must not be altered or modified in any way.

3b For telework, employees must provide a suitable internet connection.

4. In the case of remote access, employees will not be reimbursed for installation or operating costs (electricity, telephone, etc.).

1. Confidential calls must only occur without unauthorized listeners. Intelligent voice assistants (Alexa, Siri, etc.) must not be within earshot.

2. No screenshots of business data may be taken if these are not stored in the secure memory (BL-Addon) on smartphones/tablets or in the data repositories of the Central IT Services (Convertibles).

3. Users of a mobile device must ensure that private apps and applications do not access business contact data and do not synchronize with them.

4. Mobile devices must not be used by third parties, which includes family members.

1. The automatic forwarding from a personal cantonal email account to internal or external email addresses is not permitted.

2. In the event of absence, an alternative contact point is designated in the automatic absence notification of the cantonal email account.

3. Only the cantonal email account may be used for business activities.

4. Sending emails containing business information to one's own private email account (e.g., for further processing) is not allowed.

1. Confidential emails must be marked and sent with the confidentiality option "Confidential."

2. Confidential data, particularly personal data, may only be sent to email addresses outside of the administration if encrypted or password-protected. The techniques provided by the canton should be used for this purpose.

1. Private e-mails must be marked with the confidentiality option "Private" and sent without a cantonal signature under the conditions of § 17.

2. The storage of private e-mails must be done in the directory "Private."

3. The cantonal e-mail address must not be used for private newsletters, orders, competitions, social networks, or similar purposes.

1. Any mass distribution to all employees of the cantonal administration requires the approval of the Secretary-General responsible for the content, the Cantonal Secretary, the heads of the Financial Control and Data Protection Supervisory Authority, the Ombudsperson, or the Court Administration.

2. The Conference of Secretaries-General determines who receives the technical authorization for such a distribution.

1. Private and confidential calendar appointments must be marked with the confidentiality option "Private."

2. Confidential documents may only be attached to calendar appointments marked "Private."

1. All devices connected to the networks of the cantonal administration exclusively use the centrally provided internet access.

2. There is no legal entitlement to access the internet.

3. The governing council reserves the right to block or filter information/publications with unsuitable content (e.g., pornographic, racially discriminatory, unethical, immoral).

4. Permanent blockages due to security-related or technical requirements require the approval of the competent IT committees.

1. The use of information technology resources must comply with the applicable legal regulations and take into account the interests of the canton.

2. It is particularly prohibited to access or distribute data with illegal, copyright-infringing, racist, offensive, pornographic, or degrading content.

1. The private use of information technology resources is permitted, provided that the resources utilized (working time, network capacity, storage space, connection time, and volume) are negligible.

2. Private use during working hours must not interfere with the completion of assigned tasks and is to be limited to what is absolutely necessary.

3. ...

4. The costs for private use abroad must be borne by the employees and accounted for in accordance with the instructions from the Finance and Church Directorate.

1. Data that is not public or intended for publication must be stored on the data repositories of Central IT. In particular, it is prohibited to store such data on private storage devices (hard drives in PCs or external drives, mobile devices or other mass storage, USBs, etc.) or on the internet (e.g., on a website, a social media platform, or via personally opened or third-party provided cloud accounts such as Dropbox, iCloud, etc.).

2. Exceptions require approval by the IT Council based on a risk analysis.

3. The transport of confidential data, particularly personal data, on storage media may only occur in encrypted form. These storage media must be obtained from the appropriate procurement office.

4. Private data must be stored (under the conditions of § 17) in a folder labeled "Private".

1. In the event of an unforeseen absence of an employee and a need to access their business data arises during such time, access to such data must be individually authorized by the Secretary General, the Canton Clerk, the heads of the Financial Audit Office, the Data Protection Supervisory Office, the Ombudsperson, or the Court Administration.

2. Access is granted by the immediate supervisor and one other person according to the four-eyes principle.

3. The process is recorded in a protocol. This record is handed over to the absent person upon their return.

4. Whenever possible, the absent person should be informed about the access beforehand.

1. Reports on technical defects and security-related incidents concerning IT resources (e.g., inexplicable system behavior, loss or alteration of data and programs, suspicion of misuse of one's own user identification, etc.) must be reported to the Service Desk immediately.

2. If notifying the Service Desk could lead to a conflict of interest or if it is not accessible, the supervisor must be informed.

1. In the event of the loss of a device, it is mandatory to inform the help desk and file a theft or loss report with the relevant police authority.

2. The SIM card must be immediately blocked by the employee with the mobile service provider.

3. Any potential liability of the employee is governed by the Law of 24 April 2008 on the Liability of the Canton and Municipalities.

1. Log data is used exclusively for data security and to ensure proper operations, for the purposes of data protection control, and for IT audits. They are not used for preventive behavior or performance evaluation.

2. The logging complies with cantonal regulations on data protection and information security and other provisions regarding the retention of documents.

1. The positions designated by the Secretary General, the Cantonal Secretary, the Heads of Financial Control and Data Protection Oversight, the Ombudsperson, and the Court Administration periodically review a summary, anonymous evaluation (without tracing back to specific individuals) of the use of systems, applications, networks, email communications, remote access, and internet access, as well as the data stored on servers.

2. If the review reveals a suspicion of a violation of these regulations, appropriate personal examinations remain reserved.

3. Preventive personal monitoring is not permitted.

4. In principle, employees are informed in advance if a personal examination is to be conducted. Advance notice may be waived if

a. data security, particularly the availability of the system, can no longer be guaranteed, or

b. there are indications of unlawful, particularly criminal, conduct.

5. If misuse is determined based on the personal examination, the competent department or law enforcement authority will be informed.

6. The supervisor may check business data insofar as it is necessary for their supervisory role. Special confidentiality provisions as well as provisions regarding official secrecy remain reserved.

1. The Regulation on the Use of Information Technology Resources of December 17, 2002, is repealed.

1. This regulation shall enter into force on January 1, 2015.