Guidelines on Acceptable Software Use
Government institutions must ensure that all software is used in a lawful, ethical, and secure manner. This section outlines detailed procedures, Do’s, Don’ts, and best practices for software usage within public institutions.
Intended Purpose [Mandatory]
Procedures:
- Users must use software applications strictly for their intended work-related purposes.
- Department heads should clearly define acceptable and unacceptable software uses within their units.
- IT departments should monitor software logs to detect non-compliant or unauthorized use.
- Any misuse should be reported immediately to the system administrator or designated ICT officer.
|
Do’s |
Don’ts |
Best practice |
|
Do use government software only for tasks that align with official duties.
|
Don’t use government software for personal, commercial, or political activities. |
Provide annual refresher training on acceptable software use.
|
|
Do follow approved workflows and security policies when using applications. |
Don’t upload, store, or process non-official data using government software.
|
Enforce disciplinary actions for repeated misuse or policy violation.
|
|
|
|
Implement user activity monitoring tools for accountability. |
Licensed Software [Mandatory]
Procedures:
- Only install software that has been properly procured and licensed by the institution.
- Maintain an up-to-date software inventory with license information and expiry dates.
- Periodically verify software compliance through license audits.
- Renew licenses before expiry and uninstall any unlicensed software immediately.
|
Do’s |
Don’ts |
Best practice |
|
Do read and understand software license agreements before installation. |
Don’t install pirated or unapproved software.
|
Schedule quarterly internal audits to check compliance with licensing policies.
|
|
Do store purchase and license documentation securely.
|
Don’t share or copy software installers without authorization.
|
Engage RISA or the national procurement authority for enterprise-wide licenses when possible. |
Intellectual Property [Mandatory]
Procedures:
- Verify ownership or licensing terms before using any third-party or open-source software.
- Acknowledge the developers’ IP when modifying or integrating external code into government projects.
- Ensure that any customization of proprietary software follows contractual agreements.
- Report suspected IP violations immediately to the ICT management or legal department.
|
Do’s |
Don’ts |
Best practice |
|
Do respect copyright and patent laws.
|
Don’t reverse-engineer, copy, or distribute proprietary software. |
Establish an IP compliance checklist before system deployment. |
|
Do use open-source software under approved licenses (e.g: Apache). |
Don’t use cracked or unauthorized versions.
|
Train IT staff and end-users on recognizing and respecting software IP rights. |
Software Updates [Mandatory]
Step-by-Step Procedures:
- The IT department must develop a software update schedule for all critical applications.
- Enable automatic updates for operating systems, antivirus, and productivity tools when feasible.
- For non-automatic systems, conduct monthly patch management sessions.
- Document all updates performed for accountability and auditing.
|
Do’s |
Don’ts |
Best practice |
|
Do apply critical security patches as soon as they are released.
|
Don’t postpone or ignore update notifications.
|
Test major updates in a controlled environment before deployment to production. |
|
Do inform users before major updates that may affect system availability. |
Don’t install updates from untrusted or unofficial sources. |
Maintain rollback plans in case updates cause service disruptions. |
Reporting Violations [Recommended]
Procedures:
- Create an internal reporting channel using email, hotline or ticket system for users to report violations.
- Assign an ICT security focal point to receive, log, and act upon reported issues.
- Protect whistleblowers from retaliation and ensure confidentiality.
- Document all incidents, responses, and resolutions.
|
Do’s |
Don’ts |
Best practice |
|
Do encourage staff to report suspicious activities promptly. |
Don’t ignore minor incidents; report all issues for review.
|
Integrate violation tracking into the institution’s Service Desk system. |
|
Do include violation reporting in cybersecurity awareness sessions.
|
Don’t share violation reports outside official channels.
|
Conduct post-incident reviews to identify root causes and preventive measures. |
Storage Locations [Mandatory]
Procedures:
- Store all government software and data only on officially approved servers, data centers, or cloud platforms.
- Prohibit saving government data on personal USB drives, laptops, or unauthorized devices.
- IT teams must regularly back up software configurations and critical data.
- Apply encryption to data in storage and during transfer.
|
Do’s |
Don’ts |
Best practice |
|
Do use secure government-managed repositories for storing software.
|
Don’t upload software or government data to public storage (e.g: Google Drive, Dropbox) unless officially approved. |
Implement a centralized storage policy defining approved locations.
|
|
Do perform scheduled backups and verify data integrity. |
Don’t use personal email to transmit installation files or system credentials. |
Classify data according to sensitivity levels (public, confidential, restricted). |
|
|
|
Periodically review access permissions to storage systems. |
Security Awareness [Mandatory]
Procedures:
- Conduct regular security awareness training for all employees and contractors.
- Include modules on phishing, malware prevention, and responsible software use.
- Display reminders on login screens or dashboards about secure usage practices.
- Evaluate user understanding through short quizzes or e-learning modules.
|
Do’s |
Don’ts |
Best practice |
|
Do stay alert for phishing emails or suspicious links.
|
Don’t open attachments from unknown senders.
|
Incorporate software security awareness into onboarding sessions. |
|
Do immediately report any suspected malware or data breach. |
Don’t install browser extensions or apps without IT approval. |
Reward compliance and positive reporting behavior.
|
|
|
|
Run simulated phishing tests quarterly to reinforce awareness. |
Central Management [Recommended]
Procedures:
- All software installations must be performed or approved by the central IT unit.
- Use centralized management tools to deploy and update software across all workstations.
- Regularly synchronize software inventory to detect unauthorized applications.
- Establish an institutional software catalogue of approved and supported applications.
|
Do’s |
Don’ts |
Best practice |
|
Do manage all installations from central repositories or IT-managed servers. |
Don’t allow staff to install or modify software independently. |
Adopt an endpoint management platform (e.g: Ansible). |
|
Do enforce standard configurations for uniformity.
|
Don’t maintain outdated or redundant applications.
|
Schedule monthly compliance scans to ensure all systems meet software standards. |
|
|
|
Maintain centralized logs for auditing and troubleshooting. |