Acceptable Use Policy

VDSS uses technology and information to serve individuals and families across Virginia. Some of this information is sensitive and personal.

This policy explains how to use VDSS systems safely and responsibly. Following these guidelines helps protect people, support daily work and keep services running.

If you ever feel unsure, help is available. Asking questions is encouraged.

Why This Matters

Who This Policy Applies To

What to Expect When Using VDSS Systems

VDSS systems contain private information about real people. Protecting this information helps:

Keep clients safe
Maintain trust
Support reliable services

If you are unsure about any rule, help is available.

This policy applies to anyone who uses VDSS systems or data, including:

Employees and supervisors
Local department staff
Contractors and vendors
Interns and volunteers

VDSS computers, email and networks belong to the agency.
VDSS may monitor system use to protect people and systems.
Emails, files and messages may be public records under state law.
You should not expect personal privacy when using VDSS systems.

These steps help keep information safe and services reliable.

Using VDSS Systems the Right Way

Use Systems for Work

Use VDSS systems to do your job.
Access only the information you need for your role.
Do not look up your own records or those of family, friends or coworkers.

Limited Personal Use

Short personal use may be allowed during breaks or outside work hours.
Personal use must not interfere with work or violate policy.
Personal business or for-profit activity is not allowed.

Internet and Network Use

Internet activity may be logged to keep systems secure.

Allowed

Not Allowed

Work-related internet use
Limited personal browsing during approved times

Downloading attachments from personal email
Using social media for agency business involving sensitive information
Excessive streaming, gaming or downloads
Accessing websites that are illegal or inappropriate
Install unapproved software or browser extensions

Email Use

When using VDSS email:

Write messages as if they are official letters
Use a professional and respectful tone
Encrypt sensitive information before sending
Do not use personal email for agency business
Do not pretend to be someone else
If you receive a suspicious or threatening email:
- Do not respond
- Delete it and report it to security

Remote Work and Access

Use only approved tools and methods to work remotely
Keep connections secure and encrypted
Follow telework and security guidance

Passwords and Account Safety

Strong passwords help protect everyone.

Your password must:

Be at least 14 characters
Use upper- and lowercase letters, numbers and symbols
Be different from past passwords
Never be shared
Change your password on schedule. Your schedule may differ based on your role and access level.

If a password is lost or exposed:

Report it right away
Change it as instructed

Protecting Devices

You must:

Lock your computer when you step away
Use only agency-approved devices
Keep devices password-protected and encrypted
Secure laptops, phones and paper files
Do not connect personal devices to the VDSS network

Protecting Sensitive Information

Sensitive information includes personal details, tax data and confidential records.

You must:

Access only the information you need to do your job
Never look up your own records or those of family, friends or coworkers
Never share sensitive information without approval
Protect devices, files and passwords from misuse
Follow secure handling rules for personal and tax information

Printing

Do not print federal tax information.
If printed by mistake, follow approved destruction steps.

Storage Devices and Software

· Personal flash drives and personal cloud storage are not allowed.

Use only agency-approved storage devices
Report lost devices right away
Install only approved software
Use only approved, encrypted flash drives. Report lost devices right away.

All software and equipment purchases must follow VDSS and state rules. Peer-to-peer file sharing is not allowed.

Illegal or Harmful Activity

Do not use VDSS systems for illegal activities, including:

Hacking or bypassing security
Identity theft
Sharing copyrighted material
Accessing or distributing offensive content

Non-Disclosure Responsibilities

By using VDSS systems, you agree to:

Access sensitive areas only if authorized
Protect personal and tax information
Share information only when approved
Report suspected data breaches right away

These responsibilities continue even after your work with VDSS ends.

If Something Goes Wrong

If you suspect:

Unauthorized access
Data loss or disclosure
A security incident

Report it as soon as possible to your supervisor or the security office.

You are not expected to fix the issue yourself. Reporting helps protect people and prevent further harm.

Acknowledgement and Compliance

Before receiving access, you must:

Read required policies
Sign the acknowledgement and non-disclosure agreement
Follow current and future updates to the policy

Violations may result in loss of access or other actions, depending on the situation.

Information security is about protecting people, not placing blame. Your care and attention make a difference.

If you are unsure what to do, reach out to VDSS.Security@dss.virginia.gov. Support is always available.