ASF Institutional Policy Manual · Aligned with PHIG, September 2026
Part of the ASF policy framework, aligned with the equivalent PHIG policy. To raise a concern: see the ASF Complaints and Reporting Channel.
ASF systems are protected by access control, encryption and backups, and staff use them only for ASF work. Owner: Standards & Accreditation Committee, with the Operations Liaison.
- Accounts: individual accounts only; strong passwords and two-factor authentication on email, finance, hosting and website administration.
- Devices: encrypted, screen-locked and updated; lost or stolen devices reported within 24 hours.
- Backups: financial, grant and research data backed up at least weekly to a separate location; restore tested every six months.
- Access: granted on need-to-know, reviewed every six months, removed the day a person leaves.
- Websites and platforms: administrator credentials held by named staff only; security updates applied promptly; incidents logged under Policy 14.
- Prohibited equipment: ASF does not buy, with US federal funds, telecommunications or video surveillance equipment or services from the companies named in US law as prohibited sources.
- Acceptable use: no illegal content, no unlicensed software, and no personal commercial use of ASF systems.