Earlier policy library. This page belongs to an earlier library of ASF policies. The current, approved governance set is the ASF Standards Package 2026 (GOV, OPS, QMS and EV documents). Where this page and the 2026 package differ, the 2026 package applies.
ASF Institutional Policy Manual · Aligned with PHIG, September 2026
Part of the ASF policy framework, aligned with the equivalent PHIG policy. To raise a concern: see the ASF Complaints and Reporting Channel.
ASF systems are protected by access control, encryption and backups, and staff use them only for ASF work. Owner: Standards & Accreditation Committee, with the Operations Liaison.
- Accounts: individual accounts only; strong passwords and two-factor authentication on email, finance, hosting and website administration.
- Devices: encrypted, screen-locked and updated; lost or stolen devices reported within 24 hours.
- Backups: financial, grant and research data backed up at least weekly to a separate location; restore tested every six months.
- Access: granted on need-to-know, reviewed every six months, removed the day a person leaves.
- Websites and platforms: administrator credentials held by named staff only; security updates applied promptly; incidents logged under Policy 14.
- Prohibited equipment: ASF does not buy, with US federal funds, telecommunications or video surveillance equipment or services from the companies named in US law as prohibited sources.
- Acceptable use: no illegal content, no unlicensed software, and no personal commercial use of ASF systems.