IT at SB Partners LLP

To ensure responsible, secure, and professional use of SB Partners’ information technology systems, including email, internet, software, data resources, and personal devices.

This policy applies to all SB Partners team members and partners who access or use company-owned or managed IT systems, devices, software or data. It also applies to personal devices used in work-related communications and tasks.

1. Acceptable Use

Firm messaging, email, and internet systems are provided for business purposes. Limited internet for personal use is permitted if it does not interfere with work or violate firm policies.

All communications via firm systems must be professional, respectful, and appropriate for a business environment.

Recording and recording devices, such as computers, tablets, phones, watches, eyewear, and any other device must only be used for business purposes. The action of recording must be fully disclosed to all individuals being recorded.  Disclosure must occur prior to the commencement of any recording, ensuring that all parties are aware before recording begins. This includes audio, video, and photos at locations in the office, firm events\gatherings outside of the office, and in virtual meetings or conversations.

2. Ownership and Monitoring

All data, emails, and internet activity on SB Partners systems are firm property. SB Partners reserves the right to monitor, restrict, or revoke access to IT systems without notice. Monitoring covers device security compliance, data security, and may include internet usage, software activity, and data access.

3. Data Security and Confidentiality

Confidential data must not be shared with or left visible to unauthorized individuals. Distribution lists must be verified before sending sensitive information using the SafeSend add-on in Classic Outlook.

Personal devices (e.g., home computers, USB sticks) must not be used to store firm or client data.

Data taken off-site must be:

• For SB Partners’ business use only.
• Stored securely and confidentially.
• Returned to the firm network/cloud promptly.
• Deleted from portable devices, including laptops, after use.

4. Device and Access Control

Firm devices are for use by authorized team members only and devices must be locked when unattended (to lock manually, press the Windows key + L).

Passwords must be kept confidential and comply with the Passwords and Authentication Policy.

Unauthorized access to another user’s files or credentials is strictly prohibited.

5. Software and System Integrity

Only licensed and authorized software may be used, including cloud-based apps.  All software installations will be screened by a Privileged Access Management tool (AutoElevate) and must be pre-approved by the IT Operations Manager. Altering system configurations or software without approval is prohibited.

All hardware or software malfunctions must be reported to the IT Department in a timely manner by sending an email to ITSupport@sbpartners.ca.

Distribution of malware (e.g., viruses, worms) is strictly forbidden.

6. Legal and Ethical Use

All use of IT systems must comply with applicable laws, including copyright and privacy regulations including PIPEDA.

Prohibited content includes:

• Harassing, defamatory, or offensive material.
• Discriminatory remarks based on race, gender, age, disability, sexual orientation, or political beliefs.

Users are personally responsible for any illegal or unethical use of firm systems.

7. Reporting and Enforcement

Any suspected abuse or violation of this policy must be reported to the IT Operations Manager.

Any suspected security threat or anomaly must immediately be reported to the IT Department.

Violations may result in disciplinary action, including loss of access or termination.

This policy outlines the secure and responsible use of Artificial Intelligence (AI) tools and applications within SB Partners LLP (the “Firm”) and all its affiliated companies. It aims to mitigate risks associated with using AI tools and applications, including data leaks, impersonation threats, and deepfakes, while ensuring compliance with Canadian regulations such as the Personal Information Protection and Electronic Document Act (“PIPEDA”) and  applicable Canadian privacy, confidentiality, professional, and emerging AI governance (Canada’s National Artificial Intelligence Strategy: AI for All ). The purpose of this policy is to provide protocols that maximize the benefits of using AI tools while minimizing any potential risks or concerns.

This policy applies to all team members, contractors, and third-party service providers who use AI tools and/or applications in the course of their work for the Firm and all its affiliated companies. It covers all devices, networks, and platforms used to access AI tools and/or applications. This policy applies to the use of AI tools and applications both during and outside of normal hours of work, whether at the Firm’s office or from a remote work location.

Definitions:

Artificial Intelligence (“AI”): Technologies that enable machines to perform tasks that typically require human intelligence, such as learning, reasoning, and problem-solving.

Generative AI (“Gen AI”): Large Language Models (LLMs) and related machine-learning systems that create new content (text, images, audio, video, code, or data summarizations) in response to user prompts, using statistical patterns learned from training datasets. Examples: Microsoft Copilot, OpenAI ChatGPT, Anthropic Claude, Sage Intacct Copilot.

Application Programming Interface (“API”): A secure software intermediary that allows external applications to connect to, send data to, and retrieve outputs from a hosted artificial intelligence model.

Agentic AI (“AI Agents”): AI systems that can plan, decide, and take autonomous actions (sometimes called automations) toward a goal by invoking tools, APIs, files, or enterprise systems over multiple steps. Examples: OpenAI ChatGPT Agent Mode, Copilot Edit with Copilot, Claude Cowork.

Personally Identifiable Information (“PII”): Any data that can identify a specific individual directly or indirectly. See full definition at the end of this policy.

Guiding Principles:

The Firm’s objective in utilizing AI is to responsibly integrate AI technology to enhance efficiency, improve client services, and foster innovation — while maintaining the highest standards of security and confidentiality. AI is intended to augment our team members’ capabilities, not replace them. The following principles guide all AI use at the Firm:

• Transparency: Be open when AI is used and why.
• Empowerment: Augment people; don’t replace them.
• Responsibility: Humans remain accountable for all AI-assisted outcomes.
• Ethical Use: Avoid harmful, deceptive, or discriminatory uses of AI.
• Accountability: Keep audit trails and clear ownership of AI-assisted work.
• Privacy & Security by Default: Use only approved platforms with least-privilege access and MFA.
• Human-in-the-Loop: Review AI outputs before any material or external use.
• Client Trust Above All: Every AI decision should reinforce, not jeopardize, the trust our clients place in us.

Data Classification:

The following table classifies data types from least to most confidential and governs which AI platforms may be used with each level.

Approved Tools:

AI tools currently approved for use are listed below. All other AI platforms are prohibited unless explicitly authorized by the IT Operations Manager following a formal risk assessment and review with the AI Oversight Committee. If approved, they will be added to this policy.

Generative AI Tool Usage Table:

The following table identifies approved AI platforms and the data classification levels (per the previous table)  permitted for each:

Note: If you have AI needs that are not being met by these provided tools, please contact the IT Oversight Committee at aioversightcommittee@sbpartners.ca to discuss options and alternatives.  New options and feedback will be taken to the AI Oversight Committee.  Your specialized, unmet use case may provide an opportunity to participate in early-release, beta, pilot, or as-needed software trials that may include but not be limited to all versions of the above Generative AI tools.

Prohibited Practices:

In order to ensure client and firm confidentiality, users must not enter firm names, client names, or any personally identifiable information (PII – see definition at the end of this document) into any AI tool not included in the table above.

The following activities are strictly prohibited:

• Inputting confidential firm, client, or personally identifiable information (PII) into unapproved or consumer-grade AI platforms, including but not limited to Free or Personal licenses.
• Granting Agentic AI tools access or control over systems, files, or communications beyond approved scopes or without explicit authorization.
• Allowing AI systems to perform autonomous external actions (e.g., sending emails, posting updates, or modifying client data) without human review and approval.
• Using AI outputs without human validation, particularly when relied upon for decisions that could affect clients, team members, or firm operations.
• Generating, sharing, or deploying AI content that is false, misleading, discriminatory, harassing, or otherwise inconsistent with our professional standards or code of conduct.
• Using AI to replicate or impersonate any individual, client, or brand without written authorization.
• Circumventing security controls, usage limits, or platform restrictions placed on approved AI systems.
• Retaining or sharing AI-generated materials outside firm-approved storage or collaboration environments.
• Participating in beta tests or experimental features without prior written approval from the AI Oversight Committee.
• Using AI outputs or Agentic workflows to create legal documents, contracts, or client deliverables without appropriate professional review and approval.
• Team members are not permitted to use AI tools to manipulate or alter historical\locked-down\published information and data for resharing.

Permitted Uses:

Team members are encouraged to responsibly use AI tools within the boundaries of this policy to enhance productivity, improve quality, and reduce repetitive work — always with appropriate human review and oversight. AI may be used to assist with:

• Research, brainstorming, and summarizing information
• Drafting, editing, and improving communications, documents, presentations, or reports
• Automating or assisting with structured tasks such as scheduling, data reconciliation, or report generation
• Extracting, transforming, or organizing data into usable insights
• Drafting client deliverables or correspondence, provided all confidential data is handled on approved platforms and reviewed by a qualified professional before distribution
• Creating formulas or macros that improve accuracy and efficiency

The purpose of AI at SB Partners is to augment human judgment, not replace it. All AI outputs must be reviewed for accuracy, appropriateness, and compliance before external or material use.

Required Practices:

Accuracy: Review all AI outputs for factual accuracy, bias, or potential risks prior to any internal or external use. Validate that AI-generated content aligns with firm standards and legal or contractual obligations.

Transparency: Do not mislead or conceal the use of AI in client work or external communications. Disclose AI involvement where required by firm policy or applicable law.

Platform Compliance: Comply with all usage policies of approved AI platforms. Use only firm-approved AI tools for the applicable data levels as listed in the tool usage table above.

Accountability: Team members remain responsible for all AI-assisted work products. Human oversight is mandatory for any AI-generated action that could affect clients, the Firm, or external stakeholders.

Reliability:

AI tools and applications have the potential to produce inaccurate outputs or hallucinations. There is also a risk that the output is biased, inappropriate or otherwise offensive. All AI output must be checked by team members for accuracy and to ensure the intention of the content aligns with the intended use before sharing. Critical thought must be applied to all outputs and outputs must always be fact and sense-checked before being relied on for business purposes. Each user is required to ensure that the outputs generated (i) do not contain biased, offensive or discriminatory content; (ii) do not improperly use or disclose personal or confidential information; and (iii) have been verified by other trusted sources to ensure accuracy.

Security Measures:

When using Microsoft 365-based AI tools, such as Copilot, users must have logged in with their SB Partners email address (Microsoft 365 account) and the green checkmark icon for Enterprise data protection must be present.  When using AI tools outside of Microsoft 365 apps, for any work including information beyond Level 1, users must ensure they are using an account based on their firm email address, a strong, complex password and multi-factor authentication.

Professional Standards and Independence:

Nothing in this policy reduces a team member’s professional, ethical, regulatory, legal, or Firm methodology obligations. Professional standards, Firm quality management policies, independence requirements, confidentiality obligations, privacy requirements, and applicable laws always take precedence over AI-generated outputs.

AI tools must not be used in a manner that impairs auditor independence, creates management participation threats, or results in the Firm assuming management responsibilities for a client.

All team members must read and understand this policy and any related materials, complete the mandatory AI training and successfully pass the firm’s AI quiz.

To address emerging AI threats:

• Multi-factor authentication (MFA) and endpoint protection will be enforced on all devices accessing AI tools.
• Regular training will be provided to team members on identifying impersonation and phishing attempts via the Breach Secure Now training system.

The Firm reserves the right to monitor all AI use on its IT systems, as reasonably required, to protect its business interests and meet its legal obligations.

Experimental Features & Beta Programs:

Experimental or early-access AI features (e.g., “Labs,” “beta,” “experimental,” or “preview” settings) must receive explicit approval from the IT Operations Manager before use with any firm or client data (Levels 2–4). This includes but is not limited to:

• New or preview features in Microsoft Copilot (e.g., Frontier program features) or other platforms — must be specifically approved by the AI Oversight Committee (AIOversightCommittee@sbpartners.ca) before use with Data Levels 2–4
• AI features embedded in third-party or vendor software (e.g., practice management or tax software) — must be approved before use with Data Levels 2–4
• Any opt-in AI capability such as browser plugins, third-party connectors, or external APIs

Decision Making:

AI tools may be used to assist in organizing, analyzing, and enhancing content and workflows — but not to replace human professional judgment or automate material decisions. AI outputs are advisory in nature and should never serve as the sole basis for decisions with material, legal, financial, or professional consequences for clients, team members, or the Firm. All AI-assisted deliverables must be reviewed and approved by qualified professionals. Decisions impacting clients or the Firm’s operations must be made by human professionals applying independent professional judgment.

Copyright & Intellectual Property:

Team members must comply with all copyright and intellectual property laws when using AI systems. Do not use AI to generate, reproduce, or adapt content that infringes upon the intellectual property rights of others. Ensure that any third-party materials incorporated into AI prompts or outputs are used in accordance with applicable licenses, fair use, or written permissions. If uncertain about copyright implications, consult the AI Oversight Committee (AIOversightCommittee@sbpartners.ca) before using or distributing AI-generated materials.

Compliance:

All AI usage must comply with PIPEDA and other applicable laws, regulations, and governance, including Canada’s National Artificial Intelligence Strategy: AI for All – link:   Canada’s National Artificial Intelligence Strategy: AI for All .Non-compliance may result in disciplinary action, up to and including termination and possible legal liability.

The Firm may agree to comply with specific client AI use policies in its business dealings. In such cases, the IT Operations Manager and AI Oversight Committee will review such client policies and requirements before these policies are implemented. If the Firm agrees to comply with such additional policies, affected team members will be notified. All affected team members must comply with any such policies, including any related training requirements.

Review Process:

This policy will be reviewed annually, and as new AI tools or applications are approved by the AI Oversight Committee (AIOversightCommittee@sbpartners.ca) to ensure alignment with evolving AI threats and regulatory requirements. Updates will be communicated to all team members and incorporated into mandatory training sessions.

Incident Response:

Any AI-related security incident, including any use of non-approved AI tools or applications, must be reported immediately to the IT department at ITSupport@sbpartners.ca. A formal investigation will be conducted, and corrective actions will be documented and implemented.

Definition of PII:

PII stands for Personally Identifiable Information, which is any data that can be used to identify a specific individual, either directly or indirectly when combined with other information. In Canada, PII is any information about an identifiable individual, including direct identifiers like name, address, and phone number, as well as sensitive details such as race, religion, medical history, financial transactions, Social Insurance Number, and any other identifying numbers. It also encompasses opinions or views about an individual and information that, when combined with other data, can identify someone.

Appendix: AI Notetakers Policy

This section governs the use of AI-powered notetaking, transcription, and meeting summarization tools (“AI Notetakers”) used in connection with any meetings, calls, or work sessions conducted for or by the Firm.

Client Consent: Clients must be given an explicit opportunity to opt out of AI recording, verbally, at the start of a meeting. If a client requests the AI notetaker (transcription) be turned off, the team member must immediately comply.

Team Member Consent: If you are using notetakers (transcriptions), you must disclose its use to all participants. Team members are expected to participate in internal meetings or conversations where a notetaker is being used unless the conversation is of a personal nature. Requests for exceptions or accommodation will be discussed on a case-by-case basis in consultation with the Director, HR. Meetings with a public component followed by a Partner only or private section should be booked as two separate meetings.

AI Notetakers provide assistive outputs only. A human meeting owner remains accountable for accuracy, contextual interpretation, and appropriate downstream use of all AI-generated meeting notes or summaries. For example, the Teams transcription service alone or in conjunction with Copilot must have all output, whether full transcription, summarization, new meeting agenda, action items or any other extraction, reviewed by the human sender before sharing with internal or external recipients.

To protect SB Partners LLP’s information systems and client data, including Cloud-based storage and applications, all computer and software accounts must adhere to strong authentication requirements.

This policy applies to all SB Partners team members, partners, and contractors who access or use firm-owned or managed IT systems, devices, software, and data, as well as personal devices accessing firm apps and data.

Password Standards

Passwords should be a minimum of 12 characters and must include uppercase, lowercase, numbers, and special characters. They must not contain dictionary words, firm name, personal information, names, birthdays or common phrases. Passwords must be unique and may not be used across different systems.

For your voicemail, PINs must be at least 6 random order digits.

Password Management

Passwords should never be written down or shared.

If a password needs to be recovered, IT can reset passwords as needed or users can employ the Reset Password feature in the associated application

Multi-Factor Authentication (MFA)

MFA is mandatory for all cloud services and remote access systems. Approved methods such as Duo, Microsoft Authenticator, Google Authenticator, or SMS, aka text, are to be used.

Account Lockout

SB domain accounts will lock after 5 failed login attempts.  IT must verify a user’s identity before they can unlock an account.

Cloud apps each have different lock-out features and tolerances. Please connect with IT if you need assistance.

Any suspicious activity, such as receiving unsolicited MFA codes, should be reported immediately to the IT Department

Failure to comply with this policy may result in account suspension or disciplinary action.

This policy establishes guidelines for the secure and effective use of Microsoft Teams, SharePoint, and OneDrive within the firm. It aims to: maintain confidentiality when collaborating internally and externally, clarify appropriate use of cloud-based storage versus local/network storage and promote secure sharing practices and responsible document management.

Note: Microsoft Teams and OneDrive are components of SharePoint Online, collectively part of Microsoft 365 (M365).

This policy applies to all team members, partners, contractors, and authorized users of the organization’s Microsoft 365 environment.

1. Storage and Collaboration

OneDrive and Teams are for storing non-client documents.  Client documents must be stored in CaseWare Cloud and iFirm Documents and Jobs (some older files remain stored on server drives).

OneDrive should be used for storing files that are primarily for your own use.  OneDrive defaults privacy to per individual user.  You may share documents from your OneDrive but note that you are fully responsible for managing access and changes.

Teams should be used primarily for committee and collaborative documents requiring multi-user access, as well as reference documents for all staff. Teams may also be used for collaborating with external clients for meetings and documents.  The creator of a Team with an external Guest is responsible for member and content management and for ensuring all firm protocols are followed.

Note: iFirm Portal is the preferred application for file-sharing between the firm and our clients

2. Ownership and Responsibility

• The Organizer of a meeting is responsible for content
• The Owner(s) of individual Teams and Channels are responsible for its content and membership
• The original publisher of a document in OneDrive or Teams is its owner and is responsible for managing and sharing permissions and deleting outdated or unnecessary files.
• All content of SB Partners’ Microsoft 365 is firm property.

3. Sharing and Access Control

• Always use ‘Specific People’ when sharing links unless an exception is approved.
• Be mindful of who has access – shared files can be downloaded and redistributed without your knowledge.
• Do not share firm or client data outside of the organization, per the SB Technology Usage Policy.

4. Screen Sharing, Video Communication, Meeting Recordings and Privacy

When presenting via Teams, share individual application windows whenever possible.  Avoid sharing entire screens.  Close or minimize programs to prevent unintentional appearance of confidential information

Individuals appearing on video to other attendees during meetings and chats, must use the provided SB background or the blur feature to ensure no background is visible

Recordings of meetings, their storage location, and access settings are the responsibility of the meeting organizer.

5. Professional Conduct

Maintain professional and respectful language in Teams, Chats, and any other communication.

To establish guidelines for the secure and responsible use of mobile & wireless technology, including firm-owned and personal devices that access SB Partners’ systems, email, or data.  The term “wireless” encompasses all types of non-wired networking connectivity, such as Wi-Fi, Bluetooth, and Cellular.

This policy applies to all SB Partners team members, partners, and contractors who access or use company-owned or managed IT systems, devices, software, and data, as well as personal devices accessing firm apps and data.

Mobile devices and wireless technology introduce unique security risks. All users must adhere to best practices to protect firm and client information.

Covered Devices

Smartphones, tablets, laptops, wearable devices, USB drives, eReader, paper tablets, and any technology capable of storing or transmitting firm data.

Personal devices may be used for work only if they comply with all security requirements

Security Requirements

• Wi-Fi must be password protected and use encryption of WPA2 or higher
• Cellular networks (Bell, Rogers, Telus, etc.) provide security with their access
• Devices must be protected with strong passwords and biometric authentication where available.
• Multi-Factor Authentication (MFA) must be used for all firm accounts.
• Devices must auto-lock after a maximum of 5 minutes of inactivity.  One minute is the preferred lock-out.
• Report lost or stolen devices immediately to IT, including personal devices that contain firm data or email

Prohibited Actions

Avoid connecting to unsecured Wi-Fi networks. Use a smartphone’s password protected Hotspot or a firm TurboHub whenever possible.  Avoid storing firm data in personal cloud services (e.g., Dropbox, Google Drive, iCloud) as these locations are not protected or backed by the firm security tools.

Data Handling

Users are required to delete firm-related data from devices when no longer needed, including firm laptops.
For file transfers, use company-approved secure portals, including Microsoft 365.
If using a USB drive, it must be encrypted and authorized by IT.

Compliance

All mobile device use must comply with applicable laws, including Ontario’s Distracted Driving Law (Distracted driving | ontario.ca)

Intentional misuse or failure to comply with this policy may result in disciplinary action, up to and including termination.

Reimbursement Of Mobile Device Charges and Equipment

The cell phone reimbursement plan applies to manager and above team members who have been approved to participate in the plan.

Cell phones and cell phone numbers are the property of the team member. However, all devices must have the appropriate and identified controls and passwords in place, as per the Mobile Technology Policy.  Team members are asked to read the Mobile Technology Policy in its entirety to understand their responsibilities.

The cell phone reimbursement plan applies as follows:

• Monthly Plan Fees: Payment or reimbursement to a maximum of $75 plus HST per month.  If the team member is on the corporate plan, any costs incurred over this amount will be reimbursed by the team member within 10 days following receipt of the cell phone bill. Those who do not participate in the current corporate plan, but who are approved for reimbursement of monthly fees are to submit an expense report and include a copy of the monthly bill.
• Initial Hardware Purchases and Future Upgrades: Payment or reimbursement to a maximum of $250 plus HST every 36 months towards the initial purchase or upgrade of hardware and associated hardware activation or upgrade processing fees including any type of device accessories. If the team member is on the corporate plan, any costs incurred over this amount will be reimbursed by the team member within 10 days following receipt of the applicable invoice for the purchase.  If the team member is not on the corporate plan, an expense report including a paid receipt must be submitted for reimbursement.
• Additional Charges and/or Add-Ons for Business purposes: must be pre-approved by the Controller before being fully reimbursed by the firm.

SB Partners values trust, discretion, and transparency and believes team members deserve to know when and how their work is being monitored. This policy is to be used in addition to the firm “Technology Usage Policy” and “Mobile Technology Policy” and is intended to establish guidelines for firm practices and procedures related to electronic monitoring of team members.

Electronic monitoring: Using technological, electronic, or digital means to track, observe, or monitor someone’s actions.

PII (Personally Identifiable Information): Any data that can directly or indirectly identify a specific individual.

Electronic Monitoring Practices

SB Partners collects information through electronic monitoring for a variety of reasons, including protecting the firm’s legal and business interests. The firm will electronically monitor the following activities and procedures:

• Security of network, servers, computers, and other equipment for protection against viruses, intrusion, and data theft
• Security of Cloud-based applications for protection against viruses, intrusion, and data theft
• Health of network, servers, computers, and other equipment for notifications of failure, malfunctions, misuse, and availability
• Alleged misuse of client contact information/data or workplace misconduct using any firm owned equipment, software, applications or property for the purposes of a workplace investigation

Important items to note:

• Automated presence monitoring by Office Status and Microsoft Teams are used as business functionality tools to help maintain a high level of Client Service and both can be manually adjusted and locked.
• Cloud-based technologies keep an Audit Trail for reference of changes and a history of documents for restoration purposes.
• Workflow and team member education applications track and keep a history of statuses and completion.

Any information collected by electronic monitoring may be used during team member reviews or during consideration of disciplinary decisions.

To promote impartiality, and to ensure any information collected through electronic monitoring is handled appropriately, SB Partners will monitor these activities by:

• Review of management interfaces for Microsoft 365 and individual apps (ie: Duo, Datto RMM, Threatdown Antivirus, Huntress EDR, Avanan SPAM filter, AutoElevate and other cloud management dashboards)
• Reports and alerts from monitoring software deployed by our Managed Service Provider
• Automated alerts of anomalies from our Cloud-based apps

Privacy and Confidentiality

The firm’s monitoring is aimed at collecting information related to its business. However, some information collected by electronic monitoring may be considered PII. When PII is under SB Partners’ control, it is the responsibility of the firm to protect it.

All information collected through electronic monitoring will be securely stored and protected. If any PII is collected, its use and disclosure will be limited to achieve the stated purpose of its collection. The firm will adhere to all privacy and confidentiality legislation that applies to the collection, use, and disclosure of PII obtained by electronic monitoring.

To ensure secure and responsible use of firm-owned hardware, which includes computers and peripherals (defined below), as well as the professional appearance of all equipment.

This policy applies to all SB Partners team members and partners who access or use firm-owned or managed IT systems, devices, software and data. It also applies to personal devices used in work-related communications and tasks.

Team members must:

• Use hardware for business purposes and occasional personal use in compliance with firm policies.
• Maintain equipment in good condition and report any damage or loss immediately.
• Make their equipment available for professional cleaning semi-annually.
• Follow protocols ensuring physical security of all devices and privacy of displayed data.
• Not add any personalization or decoration to the equipment in their possession.

The IT Department enters all inventory of larger and costlier items (computers, monitors, docks, printers, etc.) in the Sortly inventory tracking system and places a corresponding QR code sticker linked to entries in Sortly on the device. The QR code sticker should not be removed and if it falls off or is damaged, report it to IT as soon as possible.

Responsibilities

1. Ownership and Usage

All hardware and peripherals provided by the firm remain firm property. Team members may use them for occasional personal tasks provided security and compliance standards are maintained.

2. Remote Work Considerations

Team members working remotely must ensure devices are stored or used in secure environments and are not left unattended unless in a locked area.  All users are assigned a laptop lock, which can be taken from the office for use at home or a client site.

3. Device Lifecycle and Sustainability

Professional technology cleaners are contracted twice per year to ensure our equipment is well maintained optically.  During cleaning, devices are also disinfected.

Computers are replaced with a 4-year lifecycle for Partners and permanent team members.  Other equipment is replaced as it fails.

Team members must return devices upon termination or upgrade. The firm will ensure proper recycling and disposal of outdated equipment.

4.  Data Removal and Equipment Disposal

• Team members must return all equipment to the IT Department at end-of-life\replacement.
• Team members who are discontinuing use or disposing of personal phones and devices need to remove firm accounts or perform a wipe\reset.
• The IT Department is responsible for performing data erasure or physical destruction of storage media on firm-owned devices.

Peripherals include:

• Monitors
• Portable Monitors
• Scanners
• Printers
• Keyboards
• Mice
• Webcams
• Projectors
• Memory sticks
• Portable hard drives
• Mobile phones
• Headphones & speakers
• Headsets
• Cables
• Routers
• Presentation pointers
• Paper tablets
• Fobs

Compliance

Failure to comply with this policy may result in disciplinary action, including revocation of equipment privileges.

To ensure timely reporting and mitigation of lost or stolen equipment incidents to protect firm and client data, while adhering to security and compliance standards.

This policy applies to all SB Partners team members and partners who access or use firm-owned or managed IT systems, devices, software, data. It also applies to personal devices used in work-related communications and tasks.

In this policy, equipment includes door fobs, laptops, desktops, tablets, smartphones, USB drives, cameras, docking stations, monitors, portable scanners, printers, projectors, and any other device provided by the firm or personally owned that connects to firm resources.

Responsibilities and Reporting Procedure

Team members must report lost or stolen equipment immediately to the IT Department so that lock-out procedures can be implemented quickly.

Report losses to ITSupport@sbpartners.ca and make sure to get personal acknowledgement from a member of the IT team (the automated “ticket received” email is not sufficient).  If there’s no response within one hour, contact the IT Operations Manager directly at 905-869-1079, particularly when phones are involved.

When reporting lost or stolen equipment, please Include the following details:

• Type of equipment
• Specify whether it was lost or stolen
• Last known location
• Date and time of incident
• Circumstances of loss
• Data contained on the device

Compliance & Privacy

This policy aligns with PIPEDA and other applicable data protection regulations. Team members must maintain confidentiality and report breaches promptly.

Failure to comply may result in disciplinary or legal action.