Password/PIN Policy

Developing a password and personal identification number policy helps ensure employees are creating their login or access credentials in a secure manner. Common guidance is to not use birthdays, names, or other information that is easily attainable.

Device Controls

Proper methods of access to computers, tablets, and smartphones should be established to control access to information. Methods can include access card readers, passwords, and PINs.

Devices should be locked when the user steps away. Access cards should be removed, and passwords and PINs should not be written down or stored where they might be accessed.

Assess whether employees should be allowed to bring and access their own devices in the workplace or during business hours. Personal devices have the potential to distract employees from their duties, as well as create accidental breaches of information security.

As you design policies for personal device use, take employee welfare into consideration. Families and loved ones need contact with employees if there is a situation at home that requires their attention. This may mean providing a way for families to get messages to their loved ones.

Procedures for reporting loss and damage of business-related devices should be developed. You may want to include an investigation method to determine fault and the extent of information loss.

Internet/Web Usage

Internet access in the workplace should be restricted to business needs only. Not only does personal web use tie up resources, but it also introduces the risks of viruses and can give hackers access to information.

Email should be conducted through business email servers and clients only unless your business is built around a model that doesn't allow for it.

Many scams and attempts to infiltrate businesses are initiated through email. Guidance for dealing with links, apparent phishing attempts, or emails from unknown sources is recommended.

Develop agreements with employees that will minimize the risk of workplace information exposure through social media or other personal networking sites, unless it is business-related.

Encryption and Physical Security

You may want to develop encryption procedures for your information. If your business has information such as client credit card numbers stored in a database, encrypting the files adds an extra measure of protection.

Key and key card control procedures such as key issue logs or separate keys for different areas can help control access to information storage areas.

If identification is needed, develop a method of issuing, logging, displaying, and periodically inspecting identification.

Establish a visitor procedure. Visitor check-in, access badges, and logs will keep unnecessary visitations in check.