5.3IT charter & company rules
The essentials in 30 seconds
- Binding, not decorative: appended to internal rules, breaching it can justify a sanction.
- 4 key questions: passwords, personal use, remote work, sanctions — compare 3 real practices.
- Doubt = charter then contact: never intuition; a silent charter does not authorise everything.
Running mini-case — Karim discovers he is out of line
Recovered from the incident, Karim finally re-reads his company charter in Algiers: software installed without approval, password shared with a colleague “to help out”, work email used for personal matters. Three gaps he thought harmless — and which the charter forbids. He fixes them, then asks the contact person about generative AI use, on which his charter is silent. Sequel to cases 5.1-5.2 — Karim moves from reflex to rule.
Sequel to cases 5.1-5.2 — Karim compares his practices with the written rule.
1. A binding document
The IT charter is not a paper to sign and forget: it defines what you can and cannot do with digital tools, and binds your liability. Appended to internal rules, it is binding: breaching it can justify a sanction. Karim stops seeing it as a decorative HR document.
Ignorance is no defence: if the charter has been brought to employees' attention, it applies even without individual signature. Hence the value of (re)reading it.
2. What it covers
Typically: passwords (sharing forbidden), residual personal use tolerated and bounded, software installation, remote work, data, and what IT can see (logs, filtering). Knowing it avoids nasty surprises, up to serious sanctions. Karim finds there the ban on password sharing that seemed like “helping out”.
Charters evolve (remote work, generative AI...): only the current version counts. Checking the date and location (intranet, HR, welcome pack) is part of the move.
3. When in doubt
When in doubt about a use: the charter first, the contact person next — never intuition. A charter silent on a topic (generative AI...) does not authorise everything: ask before pasting company data into it. Karim asks the contact person instead of testing alone.
Work emails are presumed professional: the employer can access them within a proportionate framework — except those marked “personal/private”. The charter specifies the terms: one more reason to have read it.
🔎 Concrete example — Karim's re-reading
Four questions, three practices, one discovery.
Find the charter (intranet, HR, welcome pack) — current version.
Read with 4 questions: passwords? personal use? remote work? sanctions?
Compare 3 practices: personal email, shared password, installed software.
-> 3 gaps fixed + 1 question asked (generative AI) to the contact.Reading: there is almost always an ignored rule.
Lesson: fixing quickly beats pleading ignorance.
Section vocabulary
- IT charter
- The document setting the IS usage rules: tools, passwords, email, remote work, sanctions.
Simple example: Karim reads there the ban on installing software without approval.
What it is not: a decorative HR paper to sign without reading.
Reflex: do I know where to find the current version in 10 minutes?
- Binding value
- Appended to internal rules, the charter can justify disciplinary action.
Simple example: Karim's password sharing is misconduct there, not a favour.
What it is not: “I did not sign, it does not apply to me”.
Reflex: ignorance is no defence: read before acting.
- Residual personal use
- “Reasonable” personal use tolerated and bounded by the charter.
Simple example: Karim checks what his work email tolerates as personal use.
What it is not: using work tools like personal tools.
Reflex: does my personal use stay within the written framework?
- IS administration
- What IT can see (logs, filtering) and within what framework: transparency on both sides.
Simple example: Karim discovers access filtering and connection logs.
What it is not: believing nobody ever sees anything on the IS.
Reflex: act on the IS as if it were traceable — because it is.
- Up-to-date charter
- Charters evolve: only the current version counts.
Simple example: Karim asks for the latest version after remote work was added.
What it is not: referring to the charter read at hiring 5 years ago.
Reflex: does my charter cover generative AI? if not, question to the contact.
In practice — (Re)read your charter like a professional
- Find your organisation's charter (intranet, HR, welcome pack) — if you cannot find it in 10 minutes, ask for it: that is already a signal.
- Read it with 4 questions: what does it say about passwords? personal use? remote work? sanctions?
- Compare 3 of your real practices with the charter (personal email, USB stick, installed software): are you compliant?
- Note one rule you ignored — there is almost always one.
Ready-to-say script — ask the contact about a silent point
“I re-read the current charter: on [generative AI / use of (tool)], I found nothing. May I use it for company data, and within what framework? I prefer written instructions before testing.”
Say or write to the contact/CISO: charter quoted, precise question, awaiting a reply before use.
Copy-paste template — charter review grid
CHARTER (version dated ___ found at: intranet / HR / pack): _______________
PASSWORDS (sharing?): _______________
PERSONAL USE (tolerated? limits?): _______________
REMOTE WORK / SOFTWARE / DATA: _______________
SANCTIONS: _______________
MY 3 PRACTICES COMPARED: 1) ___ 2) ___ 3) ___
SILENT POINT + QUESTION TO CONTACT: _______________Solo / newcomer
Karim newly hired: ask for the charter on day one and read it before installing anything.
Very small business without written charter
No charter found in 10 minutes: ask the manager in writing for the usage rules and keep the reply.
SME in Algiers
Karim compares local habits (shared workstation, troubleshooting between colleagues) with the written rule: mutual help does not justify gaps.
New team
15-minute collective reading: everyone brings 1 practice to compare, the contact person settles doubts.
✓ Best practices
- Read the charter with 4 key questions (passwords, personal use, remote work, sanctions).
- When in doubt: the charter first, the contact person next.
- Ask the question when the charter is silent on a topic.
✗ Common pitfalls
- Signing the charter without reading it.
- Believing ignorance of the charter protects you.
- Trusting intuition rather than the written rule.
Key takeaways
- The charter is not a decorative HR document: it is binding and sets authorised uses.
- Areas to know: passwords, personal use, software installation, remote work, data.
- When in doubt about a use: the charter first, the contact person next — never intuition.
- A charter silent on a topic (generative AI...) does not authorise everything: ask the question.
48h challenge — apply tomorrow
Find your current charter and compare it with 3 real practices (email, USB, software): note 1 ignored rule and fix it.
- I can explain the binding value in one sentence.
- I re-read the charter with the 4 questions.
- I fixed 1 gap (or asked 1 question to the contact).
Frequently asked questions
I never signed a charter: does it apply to me?
If it is appended to internal rules and brought to employees' attention, yes — individual signature is not always required. Ignorance is no defence: hence the value of reading it.
Can my employer read my work emails?
Work emails are presumed professional: the employer can access them within a proportionate framework — except those marked “personal/private” which protects them. The charter specifies the terms.
Karim never signed the charter, brought to staff attention. Does it apply?