Staff contracts & code of conduct ensuring secure organisation systems

[mrapoc]

Hey guys

I'm a bit stuck on this little question which I need to answer for college.

Having a staff contracts and a code of conduct can assist the production of a secure organisation computer system in these ways:
1.   A staff contract can legally bind staff to appropriate use of the computers. If at any point the staff member breaks this contract, knowingly or unknowingly, they can be disciplined according to the contract. This should generally ask as a deterrent too as staff will/should be aware their limitations.
2.   A code of conduct does a similar job. It will be in place so that staff either initially know what they can or cannot do, to avoid the trouble of breaking the rules, or the code of conduct can be used as evidence in the occurrence of somebody actually breaking the rules.

Is what I have so far, I need five reasons however and I'm stumped as to how much more I can add 

Any guidance/hints what so ever appreciated 

[Simon]

Well, the first two have got me worried! 

How abou mentioning security, confidentiality, privacy issues?

[mrapoc]

Sorry I did not include the actual question:

Continue your report to describe at least 5 ways staff contracts and a code of conduct can assist the task of ensuring secure systems at an organisation.

So yeh its basically all about how they can make the system secure

perhaps i could say about how it can detail the type of sites that are off limits to prevent infection from trojans etc.

could also say how content on usb drives could be limited, again to avoid the spread of trojans etc.

perhaps the contract/code of conduct could make some areas off limits to staff so that they don't have access to server rooms and the like

[Simon]

Yup, it's also about confidentiality though, not letting passwords slip, keeping portable data safe, etc.

[john]

A code of conduct defines what staff can and cannot cannot use a computer for. Staff may not be permitted to use IT equipment for purposes  other than in connection with their work but are usually prohibited from using it to transmit confidential data external to the company. Where they are permitted to use it for private use this usually excludes anything deemed to be offensive or criminal or which may bring the company into disrepute.

Staff are not normally allowed to download software etc which may contain malicious code or otherwise circumvent the companies IT security software/hardware.

[mrapoc]

Thanks guys sorted it now hopefully 

karmic