Always-On VPN Policy

1. PURPOSE

The purpose of this Always-On Virtual Private Network (VPN) Policy is to establish the standards for securing remote access to VA Works internal networks, client data, and cloud-based applications. Given VA Works' role as a Business Process Outsourcing (BPO) provider for the mortgage, real estate, and home services industries, maintaining a secure, encrypted tunnel for all data transmissions is critical to protecting sensitive personal identifiable information (PII) and maintaining regulatory compliance.

2. SCOPE

This policy applies to all VA Works personnel, including full-time employees, part-time staff, and independent contractors, who utilize company-issued or authorized hardware to access corporate resources or perform work for clients. This policy covers all remote work environments, including home offices and authorized satellite locations.

3. ALWAYS-ON REQUIREMENT

VA Works mandates the use of an "Always-On" VPN configuration for all corporate-managed devices and for all work activities conducted on any device used to perform VA Works work (including, without limitation, CRM access, email, client portals, cloud applications, messaging tools, and any other business systems).

• Automatic Connection: The VPN client must be configured to initiate a secure connection automatically upon the device connecting to any internet service (ISP, public Wi-Fi, or cellular data).
• Persistent Connectivity: The VPN must remain active at all times during the work session and throughout all work activities. Users are prohibited from manually disconnecting, disabling, or snoozing the VPN service while performing any work-related tasks or accessing VA Works or client systems.
• Split Tunneling Disabled: Split tunneling is disabled. All internet traffic must be routed through the encrypted VA Works VPN tunnel to ensure continuous security monitoring and filtering.

4. TECHNICAL STANDARDS AND ENCRYPTION

To maintain the integrity of our AI-assisted oversight and time management systems, the following technical standards must be met:

• Encryption: All VPN connections must utilize industry-standard encryption protocols (e.g., AES-256 or higher).
• Authentication: Access to the VPN requires Multi-Factor Authentication (MFA). Credentials must not be shared or stored in plaintext.
• Endpoint Integrity: The VPN client will perform a posture check prior to establishing a connection to ensure that antivirus software is active and the operating system is up to date.

5. USER RESPONSIBILITIES

All users are responsible for:

• Ensuring their internet connection is stable enough to maintain the VPN tunnel.
• Reporting any VPN connectivity issues immediately to the VA Works IT Support Desk.
• Refraining from any attempts to circumvent, bypass, or modify VPN settings.
• Verifying that the VPN "lock" or "active" icon is visible in the system tray before accessing client mortgage or real estate files.

6. MONITORING AND COMPLIANCE

In alignment with VA Works' integrated operating system and talent performance tracking, the company monitors VPN logs and tracks compliance via the VA Works integrated operating system for AI-assisted oversight to:

• Verify compliance with the Always-On requirement.
• Detect unauthorized access attempts or unusual traffic patterns.
• Ensure that remote teams are working within authorized geographic regions as per client agreements.
• Maintain an audit trail for compliance with mortgage and financial services industry regulations.

7. PROHIBITED ACTIVITIES

The following activities are strictly prohibited:

• Using unauthorized third-party VPNs or proxy services on VA Works devices.
• Attempting to bypass security filters or geographical restrictions via the VPN.
• Sharing VPN authentication tokens or passwords with any other individual.
• Modifying system registry files or network configurations to disable the Always-On functionality.

8. INCIDENT REPORTING

If a user suspects that their VPN connection has been compromised, if the VPN is unexpectedly disconnected during work, or if they identify a vulnerability in the VPN software, they must report the incident to the Compliance Center or the Ethics and Reporting Hub within five (5) minutes of discovery.

Technical issues or connectivity problems that may affect availability, productivity, or logged time must be reported to VA Works management first. Team members must not communicate technical issues or connectivity problems directly to clients as a reason for downtime, in alignment with the Non-Circumvention and Communication Protocol Policy.

9. ENFORCEMENT

Failure to adhere to this Always-On VPN Policy may result in the immediate revocation of remote access privileges. Disciplinary action, up to and including termination of employment or contract, may be taken in accordance with VA Works' Code of Conduct and local labor laws.

10. POLICY REVIEW

This policy shall be reviewed annually or as needed to account for changes in the threat landscape, technological advancements in VPN protocols, or updates to the VA Works "Live-First" protocol.