An information security policy is the same as a staff handbook but focusing on IT and data management. Through it, companies can manage expectations and set out standard rules. This type of policy document is an important tool when it comes to IT security, and will prove to be a vital resource when GDPR comes into effect, because the penalties for non-compliance with data management could be massive.
If you do not let employees know how you like things to be done, how can you expect them to do things in the way you want? That is why companies produce staff handbooks, so people know how they are expected to behave and dress etc when they are at work or representing their company at meetings and events.
Your policy needs to cover topics such as creating passwords, permissions, remote access, data access, monitoring, responsibilities, mandatory training, conduct and disciplinary action, and what happens when a staff member leaves the company.
Your information security policy needs to be clear, so staff understand what they need to do to ensure your company achieves compliance. You must be willing to police it strictly in order to demonstrate its effectiveness, even if this means you will potentially have to discipline or sack employees who are non-compliant. In order to fully manage expectations, the policy document must also include the consequences of non-compliance.
Information to include
When it comes to the information and instructions you will need to include, it may be useful to think of it in terms of the management of speed limits on the roads.
Let us use USB sticks as an example of how this could apply to your information security policy. Unencrypted, these tiny devices can become a huge security nightmare – as it did for Heathrow Airport recently, when an unencrypted USB stick was picked up from the street and accessed. USB sticks are so small, it is almost inevitable that one or more will get lost at some point, which makes it crucial that everyone follows your information security policy to the letter. The information you need to include should be something like this:
If you would like help drawing up your company’s information security policy, contact us to book an appointment to discuss your needs.