Many small businesses make the mistake of skipping policies. It feels like things don’t have to be so formal. They tell their employees what is expected of them and think that’s good enough. However, this mindset can cause problems for small and medium-sized entrepreneurs.
Did you know that 77% of employees access their social media accounts while at work? Furthermore, 19% of them spend an average of 1 hour a day on social media. IT policies set expectations and in cases like these, can increase efficiency and reduce idling.
IT policies are an important part of IT security and technology management. With these things in mind, no matter the size of your business, you should have them.
Do You Have These IT Policies? (If Not, You Should)
Password Security Policy
About 77% of all data breaches in the cloud are caused by compromised passwords. Leaked credentials are also the leading cause of today’s global data breaches. A password security policy tells your team how to handle login passwords. It should contain something like:
• Password length
• Password creation method (for example, use at least one number and one symbol)
• Where and how passwords are stored
• Use of multi-factor authentication (if required)
• Password change frequency
Acceptable Use Policy (AUP)
The Acceptable Use Policy is a comprehensive policy. Proper use of technology and data in business is required. The AUP covers things like device security.
For example, you may need staff to keep your devices up to date. If so, it should be included in this policy. Another thing to include in your AUP is where company devices are allowed to be used.
You can also prevent remote workers from sharing work devices with family members and third parties. Data security should comprise another area of the AUP.
You need to specify how data is stored and processed. Your policy may require an encrypted environment for security reasons.
Cloud & App Use Policy
Employee use of rogue cloud applications has become a major problem. This use of “shadow IT” is estimated to account for 30% to 60% of an organization’s cloud usage. Employees often use cloud apps they are not familiar with.
They don’t realize that using unapproved cloud tools on corporate data poses significant security risks. Cloud and app usage policies inform employees which cloud and mobile apps they can use for their business data.
Any IT policy must state that the use of unapproved applications is restricted (and, preferably, accompany this with the appropriate security controls). It should also provide a way to suggest apps that improve productivity.
Bring Your Own Device (BYOD) Policy
About 83% of organizations have adopted a BYOD approach to employee mobile usage. Businesses save money when employees can use their smartphones for work. It’s also convenient for employees because they don’t have to carry a second device.
However, security and other issues can arise if there is no policy mandating the use of BYOD. Employee devices can be vulnerable to attacks if operating systems are not updated. There can also be confusion about compensation for personal device use at work.
A BYOD policy makes it clear how employee devices can be used for business purposes. You can also insist on the required installation of endpoint management apps.
Wi-Fi Use Policy
Public WiFi is a problem when it comes to cyber security. 61% of companies surveyed said their employees connect to public WiFi from company-owned devices. Doing so exposes those credentials and can in turn lead to a compromise of a corporate network.
The company’s Wi-Fi usage policy explains how employees can ensure a secure connection. You should insist that employees use a corporate VPN. Policies can also limit what employees can and can’t do on public Wi-Fi networks. For example, do not enter passwords or payment card details in forms.
Social Media Use Policy
Social media use in the workplace is so common that it’s important to address it. Otherwise, endless scrolling and posting can cost you hours of lost productivity each week. Include details in your social media policy, such as:
• A time limit for employees’ use of personal social media
• Restrictions what employees can post about the company
• Awareness of ‘selfie safe zones’ or facility areas where images are not allowed to be captured
Get Help Improving Your IT Policy Documentation & Security
We consult with your organization to address IT policy deficiencies and security issues. Reach out today to schedule a consultation to get started.
What is an IT policy?
An IT security policy establishes rules and procedures for everyone who accesses and uses an organization’s IT assets and resources.
Why do you need an IT policy?
IT policies and procedures provide clear information to everyone in your organization regarding the use of computers and devices. IT policies are designed to counter threats and manage risks while ensuring efficient, effective, and consistent operations.
How do you write an IT policy?
1. State its purpose.
2. Define the scope of the policy.
3. Define IT policy components (purchase and installation policies). These can include Device, Web, Email, and Social Media Acceptable Use Policies, as well as IT security policies that consider physical security, network security, cyber security and audits, and data security.
4. Consider policy enforcement methods and sanctions.
What is in an IT policy?
IT policies contain information on when and how employees should use company IT assets and devices.
What are the characteristics of good IT security policies?
Good IT security policies are written so that the employees can understand them easily and thus follow the policy without huge inconvenience. User adoption is crucial to ensuring its success.
Another characteristic is that they are prescriptive. They should use clear language about what can and can’t be done.
