At this time, large, medium, and small companies are typically facing cyber security threats and direct attacks that can compromise their business stability and/or its continuity. Therefore, Organizations must properly implement a well design information security program to ensure it fits requirements and local regulations.
One of the foundations in Cyber security programs are Information security policies and standards; those are the guidelines that all members of the organization, partners, and vendors must be aligned to minimize risk and avoid critical incidents.
Information Security policies typically involves everyone, not just IT employees and/or High-level Managers. A cybersecurity policy sets standards of the appropriate technology to adopt, authorize and restrict behaviors for properly using company’s resources and information systems; a notable example of this is the use of encryption for email attachments or reasonable restrictions on the use of social media on company’s assets.
Cybersecurity policies are critical to the public image and credibility of an organization. The omission of cyber security policy can result in cyberattacks and data breaches, they would cause considerable damages for companies such as bad reputation, fines, possible prosecution and so on; in some cases, those critical incidents can compromise the operation and/or the existence of the company.
Recently McAfee in its article called Grand the Thief Data(1) reports that internal employees were responsible for 43% of data loss, half of which is intentional, half accidental. Also, it accurately reports that Customers and employee’s Personal data like credit card information was the number one target (62%).
There are several reasons companies fails to properly implement information security policies, however, often include apparent lack of knowledge about cybersecurity and its importance, also limited resources to implement and enforce them. An effective information security program is a team effort that involves the active participation and support of all employees; therefore, a training awareness plan as part of the policies must be implemented to ensure internal and external actors understand policies, risks, and threats they face every day, be aware that they can be responsible and/or accountable for a data reach.
Information security Policies must properly align to the vision of the organization. Policies must be simple, effective, easy to read and properly understand, and finally fair for employees. The document must consider references like technical explanations that users might consult in case they require further information.
Regarding of the proper length of the policy, this would depend on the organization, its operation and local regulations that cover them, it must prioritize securing main areas of the company, and adequate protection of critical data, Personal Identifiable Information (PII), and Personal Health Information (PHI) if it works with.
