The 10 Commandments of IT Security

IT Security Commandment #6: Thou Shalt Keep All Thy Policies Up to Date

There is an old proverb attributed to some writings by Sir Edwin Sandys, one of the English colonists responsible for settling Jamestown, Virginia—“Honesty is the best policy.” While we cannot argue that point, we can posit that when it comes to managing a business these days, there are many other policies that are important! A strong management team in any organization will ensure that key policies are created, updated, shared, and enforced as necessary. They can range from the high-level types such as Equal Opportunity, Travel, and Code of Conduct, down to the more mundane such as Vacation, Work from Home and even Inclement Weather policies. These are all necessary to set and manage expectations and establish accountability and compliance across an enterprise.

IT Security Policies and Cybersecurity Insurance Are Vital to the Security of Your Organization

From our perspective as a business focused on Information Technology Consulting to maximize productivity and security for our clients, IT Security Policies are vital as well as a cybersecurity insurance policy! Putting in place and compelling adherence to an IT Security Policy is a way to protect an organization from leaks, attacks, and breaches. Organizations of all sizes need to protect and insure their vital information and operations. IT Security Policies combined with a quality cybersecurity insurance policy do just that.

Which IT Security Policies Need to be Kept Up to Date?

Here is an overview of some key IT security policies to consider and keep up to date:

Access Control Policy – This delineates who/what departments are able to access certain key information and data and even locations/workspaces.

Acceptable Use Policy – This informs what and how company-owned devices, equipment, and software can or cannot be used. For example, it may limit access to some types of websites or forbid use of personal devices for company purposes.

Data Classification Policy – This is designed to provide a way to identify the sensitivity and importance of company data and the proper handling of that data. It aligns with the access control policy—which is the human side of the coin versus this, which is the information side.

Data Security Policy – This governs everything from the physical security of company IT hardware and systems to the software type, access, and security measures to be used by each end user. As an example, it may forbid using public Wi-Fi and oblige all departments to update software and hardware according to a set schedule.

Disaster Recovery Policy – This outlines the specific roles, responsibilities and procedures for all key players and departments when responding to a major unplanned incident such as criminal activity, natural disaster, or cyber breach. When done correctly, everyone knows what to do and when if an unexpected occurrence transpires.

Incident Response Policy – This could be seen as part of the Disaster Recovery Policy, but its focus is on the processes and roles engaged in response to a security incident. It details triage procedures, escalation rules, notification rules, etc.

Email and Communication Policy – Fairly straightforward, this makes sure that all staff are accountable for their actions when using company email. The most important piece of this is protecting against data breaches, but it can also include ways to minimize time-wasting activities.

Personal/Mobile Device Policy – Another straightforward policy that covers smartphones, tablets, e-readers, flash drives, etc. that are not company owned. The policy governs use or limits use of these devices as it relates to creation, viewing, storage and transmittal of organizational information.

Remote Access Policy – This important item contains all guidelines for any connection to an organization’s technology infrastructure from outside the core office. It helps to clarify ways that information can remain secure while staff are remote.

Cloud Policy – This describes the proper ways that organizations can operate systems in the cloud. This is used as another way to secure information and protect staff from making an inadvertent vulnerability come to be.

While the above is not an exhaustive list, it does provide recommendations on ways to keep this commandment of IT security. Strong IT security policies give everyone critical guidelines that when followed help keep the organization safe and secure. Additionally, all these policies help an organization obtain a cyber insurance policy that is well suited for their needs while also being cost effective.

To learn more about these policies or to get help with creating and/or implementing any of them, please reach out to us here at IT Radix. We’re dedicated to helping your organization grow and prosper.