Virtual Private Network (VPN) Policy

Short Description
Defines the requirements for Remote Access IPSec or L2TP Virtual Private Network (VPN) connections to the organization’s network.

Website: www.sans.org | Filesize: 253kb

Content
Virtual Private Network (VPN) Policy
Created by or for the SANS Institute. Feel free to modify or use for your organization. If you have a
policy to contribute, please send e-mail to stephen@sans.edu
1.0 Purpose
The purpose of this policy is to provide guidelines for Remote Access IPSec or L2TP Virtual Private
Network (VPN) connections to the corporate network.
2.0 Scope
This policy applies to all employees, contractors, consultants, temporaries, and other
workers including all personnel affiliated with third parties utilizing VPNs to access the
network. This policy applies to implementations of VPN that are directed through an IPSec Concentrator.
3.0 Policy
Approved employees and authorized third parties (customers, vendors, etc.) may utilize
the benefits of VPNs, which are a “user managed” service. This means that the user is responsible for
selecting an Internet Service Provider (ISP), coordinating installation, installing any required software, and
paying associated fees. Further details may be found in the Remote Access Policy.
Additionally,
1. It is the responsibility of employees with VPN privileges to ensure that unauthorized users are not
allowed access to