Cyber Security Policies

Cyber security policies can help companies establish a common understanding of the expectations they have of their employees regarding work, the work environment and employee behavior. As a best practice, policies should be in writing, easy to read, understand, and enforce.

Written cyber policies

All companies should develop and maintain comprehensive and clearly written policies to help safeguard employee, customer, company and third-party business data and sensitive information. Many of these types of policies may already exist for your business operations but may need to be tailored or updated routinely to reflect the increasing impact of technology on everyday transactions.

     

The policies or statements should be revisited and renewed at least annually. As the laws and regulations surrounding the internet and data security change, business practices, policies and procedures also may need to change.

Some employee security policies to consider include:

Information security policy

An information security policy can specify how the company collects, uses, discloses, and protects personal data of its customers and employees. In doing so, your internal privacy and data security policies can help determine who needs access to confidential data, how this data can be secured, and procedures for effectively deleting or destroying data once it is no longer needed by the company.

Customer privacy policy

Your privacy policy can be in the form of a pledge to your customers that you will use and protect their information in ways that will secure their identity and confidentiality of information and adhere to your legal obligations. The policy can include a description of the information that you collect, who has access to this information, how the information will be used, and a description of your internal policy requirements for protecting a customer’s information, such as, but not limited to:

• Your company uses technical and physical safeguards that comply with regulatory requirements and contractual agreements to help protect the personal or sensitive data of customers.
• Your employees maintain the confidentiality of sensitive information and are prohibited from transferring sensitive information to any computer systems, storage devices, flash drives, hardware, email boxes, public site or other service that is not company owned or authorized.
• Your employees can access only information that they are authorized to access.
• Your employees can use customer information only for company authorized purposes.

It also is important to share your privacy policies, rules and expectations with all partners who may come into contact with your company’s customer information.

Password policies

A password policy should be established for all employees, contractors or temporary workers who will access corporate resources to use strong passwords. Passwords are your first line of defense, but do not replace the need for other data security measures. Longer passcodes are more secure, but if you require your users to have very long passcodes, they may have trouble remembering them. Codes may be numeric, alpha numeric, upper and lower case letter combinations or symbols. In general, password complexity can be established in accordance to the job functions and data security requirements. The password policy can provide, among other things:

• Automatic password expiration dates requiring users to enter a new password after a specified period of time and disallowing re-use of a former password within a specified number of iterations.
• Employee responsibility to not share passwords and not engage in unauthorized use of other users’ passwords.
• Employee responsibility to safeguard her/his password.

Internet usage policy

Employee internet usage can result in violation of intellectual property rights, privacy rights, and rights to publicity, as well as defamation. Establishing limits on employee internet usage in the workplace will vary from business to business. Your guidelines can allow employees the maximum degree of freedom they require to be productive while maintaining security and compliance with laws and regulations.

An internet usage policy can help ensure that all employees are aware of boundaries, both to keep them safe and to keep your company safe. Some risk control considerations related to internet use includes:

• Safe browsing rules. Consider restricting or blocking access to some internet websites, shared devices or other information resources. Your employees should have clear knowledge of what types of sites are restricted by your policy. Some restricted sites may have a legitimate business purpose. Companies can provide a process allowing users to request access to a restricted site stating a legitimate business reason.
• Company right to monitor usage. Consider monitoring or filtering employee use of information resources to help ensure compliance with your policy or for technical, legal, or business reasons. In addition, consider maintaining electronic records so they can be accessed or reviewed by the company for system maintenance or investigation of possible misuse of internet access. Consider having legal counsel and/or human resources review your internet usage policy.
• Copyright compliance. The internet can provide access to copyrighted material and other protected intellectual property. Also, websites may have terms and conditions for using website content. The unauthorized use of intellectual property can have a significant impact on your business.  Consider instructing employees of the importance of abiding by the terms and conditions of websites and avoiding unauthorized use of intellectual property found on the internet. As with internet usage policies, consider having legal counsel assist with your instructions to your employees.
• Third-party website registration authorization. Some websites specifically ask users to confirm agreement with the terms and conditions as part of a registration process. Consider prohibiting employees from accepting any online terms and conditions until approved by your legal counsel.

Email usage policy

Employee misuse of email can result in the loss or theft of data and the accidental downloading of viruses or other malware. Some risk control considerations for e-mail usage include:

• Restrictions on sending business data to personal email accounts.
• Stipulations on when encryption must be used.
• Instructions for handling unknown or suspicious email attachments.
• To help maintain business records, consider restrictions on instant messaging when conducting business transactions.
• Business emails and file attachments can only be sent or received using email or other systems approved by the company.

Company-owned mobile device security policy

Company-owned mobile devices can provide a more consistent level of security than employee-owned mobile devices because the company has control over the types of the devices, applications and software that will be used. This can allow the company to more readily apply needed security upgrades. Organizations can adopt a formal process and management infrastructure for the configuration and control of mobile devices. Some risk control considerations include:

• Requiring users to be responsible for protecting company-owned mobile devices and sensitive information from loss or theft.
• Requiring password protection on all devices that can access corporate resources, with passwords that comply with the password policy.
• Establishing guidelines to require prior approval before downloading applications onto company-owned devices.
• Requiring and enabling encryption on all mobile devices to protect data while in transmission or in storage in the device. If a mobile device cannot be encryption enabled, consider restricting it from connecting to sensitive company data.
• Requiring employees to promptly notify management if a device is stolen or lost.
• Establishing guidelines that require all corporate-owned devices and company information to be returned immediately upon termination of an employee.
• Deploy a Mobile Device Management solution to ensure central monitoring and management of company owned mobile devices.

Employee-owned mobile devices security policy

Because of the wide range of devices, applications and software available, allowing employees to access company information with employee-owned mobile devices can pose a significant security challenge. With the increased processing power of consumer devices, such as smart phones and tablets, it has become easy to interconnect these devices to company applications and infrastructure. Use of these devices to interconnect to company email, calendaring and other services can create conflicts between company controls and consumer controls. Employees who request and are approved to have access to company information via their personal devices should understand and accept the limitations and controls imposed by the company. In addition to complying with the company-owned mobile device policy (above), some risk control considerations for employee-owned devices include:

• Require authorization for employee-owned devices to connect to the company resources. If employees have more than one device that they want to connect, require authorization for each device.
• Require user to agree to keep the device software current and apply all patches or antivirus upgrades as they become available from the vendor, or when notified to do so by the company.
• Restrict sensitive business data from being stored, and/or accessed and processed on personal devices.
• Requirements for the installation of a company approved sandboxing application on the device to help prevent malware or unauthorized users from interacting with company information.
• Requirement for user to remove all company data from mobile device upon termination of employment.  

Social media policy

Social networking applications can present a number of risks that are difficult to address using technical or procedural solutions. All users of social media need to be aware of the risks associated with social media networking. A social media policy can help businesses that seek to use social networking to promote their activities and communicate with customers. A social media policy can include, among other things:

• Rules of behavior for employees using personal social networking accounts to make clear what kinds of discussion topics or posts could cause risk for the company.
• Guidance on the acceptability of using a company email address to register for, or get notices from, social media sites.
• Requirements that passwords used for social networking are different than their company network and data passwords.

Copyright and licensing policy

• Employees should comply with the licensing requirements for software used on company computers and other electronic devices. In support of compliance, consider having all software used in conjunction with any information resources approved by and licensed to your company and prohibit the unauthorized use, downloading, installation, copying or distribution of copyrighted, trademarked or patented material.

Records retention and disposal policy 

The records retention and disposal policy can help to establish legal and regulatory guidance on what types of information should be retained, how long it should be retained and procedures for disposing or destruction of unneeded data.

Security incident reporting procedures

Responsibilities for reporting and guidance should be established for employees and contractors on how to report and handle potential or actual cyber security incidents caused by malicious malware and/or loss or theft of data or equipment. This information should be conspicuously posted and can be included in training sessions for newly hired employees and contractors.

Security awareness training

The Security Awareness and Training Policy establishes the requirements to assist Information Technology (IT) system managers, administrators, and users of an organization’s systems and data the steps to ensure that systems and data are appropriately safeguarded. A policy sets out what constitutes your critical information, how it is protected from external and internal threats, gives important safety guidelines and outlines steps to be taken in an emergency situation.

A security awareness policy can include, among other things:

• General security awareness for all staff members, intermediate security awareness for managers and decision makers and in-depth, role-specific security awareness training for IT personnel and specialized personnel such as accounting and procurement workers.
• Some key areas of focus for security awareness, at all levels, should at a minimum include topics such as business email usage, use of passwords and protections of credentials, malicious software download, social engineering, phishing emails, and data storage and disposal.
• Security awareness training should be mandatory for all new hires, as part of onboarding or within first 30 days of hiring, and should be administered every twelve (12) months thereafter.