Three Reasons You Need an Updated Security Policy

Image

ity is a major concern for businesses of all sizes—and the customers they serve. But it’s surprising how some organizations approach cybersecurity.

Some businesses have no security policy at all, and many have a policy that hasn’t been updated in years. This amounts to a disorganized approach to IT security that’s unlikely to deliver the result you want: reduced risk to the data and applications your business relies on.  

If you’re serious about securing your systems, you need a methodical strategy that keeps all interested parties within your organization working toward a common goal, even as security threats evolve or your businesses changes. Assessing the current state of your security is a great way to find out where you stand with data security, but a security policy is essential for businesses of all sizes and in all industries, no matter how what security solutions you already have in place.

Read on for the top three reasons to implement a security policy—and keep it updated!

What Is a Security Policy?

This information is elementary to some, but let’s make sure we’re on the same page. A security policy is a written statement of how your company plans to protect its IT assets. It might include everything from how employees are allowed to access the internet at the office to what security measures will be carried out.

A large corporation might have a broad policy that outlines objectives at a global level, with lower-level policies including detailed information and requirements for each country where the organization has a presence. A smaller business might only need a single security policy.

Buy-in from senior management is essential, and the policy (and the consequences of non-compliance!) must be communicated to employees.

So, why bother jumping through these hoops?

Reason 1: Most Security Regulations Require a Data Protection Policy

If your organization falls under any law or regulation to protect data and you have no security policy, it’s quite likely that you’re out of compliance with that law or regulation. Why? For starters, many of them require a security policy.

Another reason is your policy is where your organization’s data classification is defined. Part of that definition states how the data should be secured, its encryption requirements, retention period, and so on. Without that definition, data—even PII (Personally Identifiable Information)—is probably not secured in a way that complies with the laws and regulations under which it falls.

Reason 2: In IT, Change Is Constant

New technology! New threats! New ways to share information! If you have no policy or haven’t updated it recently (in the last year or two), it’s unlikely you have addressed your organization’s stance on new technologies.

Does your policy address whether and how employees are to use social media? This extends beyond simple internet use during work hours. (Although, if that’s not addressed in your policy, it needs to be included as well.) No, there are other issues, such as whether your employees are allowed to blog, post on Facebook, or tweet on behalf of your organization. Now is a good time to remind employees that company confidentiality agreements extend and apply to social media.

Other technologies that should be discussed are the use of the cloud, as well as your organization’s stance on BYOD (bring your own device).

Reason 3: You Can’t Enforce a Policy that Doesn’t Exist

If your organization doesn’t have a policy or has an outdated policy, it may open your organization to legal liability. For example, if you don’t want your employees connecting to your network with their own devices but you haven’t told them not to, what happens when an employee’s device with corporate data stored on it is lost?

Your first reaction may be to remotely wipe the device—but can you legally do that without a written and user-acknowledged policy? If you haven’t documented and communicated your organization’s security requirements to your employees, taking action against any violations is very difficult.

How Fortra Can Help

If you don’t have a security policy or your policy needs to be updated, our security consultants can help. Once your policy has been defined, there are a number of software solutions that can help you stay compliant. Powertech Policy Minder for IBM i can help you maintain compliance with your security policy by automating much of the work.