Nowadays, an IT policy is a necessary inclusion within your business regardless of its size or scope. Indeed, as long as your business uses a single computer there is the potential for misuse of company equipment or even security breaches. Even more so, many companies that rely on computer systems have outdated policies without knowing it; opening themselves to potential security breaches and lawsuits.
Here are our recommendations on what areas you must cover in an IT policy, and where an inadequate policy can expose you.
Complete and download your IT Policy for free.
Create this and other workplace policies on our platform.
Acceptable use policy
This is the crux of any strong IT policy. Within this section, you will outline what functions are and aren’t acceptable for your employees to perform with the company computers. For example, these may include:
- Use of resources.
- Inappropriate material.
- Use of personal equipment.
These are necessary to ensure that on every level, you can account for the actions of your employees. However, you must also ensure that the policy is clear to employees. These aren’t to trap employees, they are to ensure consistent and proper operations.
An example of why this policy is so necessary would be in the case of an employee accessing inappropriate material on their work computer. Say an employee searched for pornographic material at work. If another employee saw this, they may consider it sexual harassment. Hence, resulting in a lawsuit against the individual and company. Fortunately, via a strong acceptable use policy, you would be able to shield your business as the action was beyond the expectations of the company.
Security and data protection
This policy outlines acceptable use centred on protecting the company and employee data. For some companies, many of these functions will also fall within their acceptable use policy. Within this policy, you must set standards for:
- User IDs and passwords.
- Remote access to company networks.
- Policy towards protecting particularly sensitive information.
- Confidentiality.
- Data use (privacy policy).
These policies become more important where large numbers of employees can access client and customer information. For example, in a delivery service, a large number of employees would be privy to information like the customer’s name, address and likely their phone number. Hence, depending on the level of confidentially the service requires, there may be expectations regarding how the customer’s personal information is handled. These will include how the data is stored, used and transferred between systems.
This is also why acceptable use is important. Employees accessing inappropriate sites or networks may open up the possibility of malware and breaches of company systems. Your policies should mitigate these risks wherever possible. Where a company mishandles personal information, it runs the risks of large fines and further legal repercussions.
Disaster recovery
While your policies may look to prevent worst-case scenarios, you can never be sure. Freak events like flooding or fires may damage your businesses facilities housing important IT equipment or data. Likewise, despite strong policies, there’s always the chance that malware sneaks its way into your systems. In these events, it may be that your business grinds to a halt. Fortunately, with a strong policy, you will have a response plan outlined. Within this plan, you will include:
- Recovery personal: Being who performs which tasks to recover potentially compromised data or systems. This may also include policies regarding remote access to systems should it be necessary.
- Critical areas of focus: In a tiered system, prioritise what systems you will address first (likely starting with the most sensitive data).
- Continuity: consider what steps will be critical to ensure as little delay as possible. For example, will it be practical to try continuing to operate or to close halt business during the recovery phase?
- Personale: In the event of an actual emergency, say a cyclone, have measures in place to allow families to focus on themselves first and potentially have the company support them. The safety of your employees should take priority over these other policies.
Technology standard and IT services policy
These policies dictate the standards of the actual hardware and operating systems your business will use. These are paramount to both ensuring productivity and security in the day-to-day operations. Ensuring that there is continuity amongst your company will also make identifying breaches easier and more reliable.
An example of a stong policy would be in standardising that your company use a certain email service. Linking back to your acceptable use policy, you can restrict what functions company email may used for too.
Likewise, outlining the expectations of your IT services will ensure continued support and improvements are provided to your business.
Final thoughts
As businesses continue to get swept up in the evolving age of technology, it is becoming increasingly important to have strong IT policies in place. Regardless of the size and scope of your business, where client information is handled electronically or employees use a computer for business purposes, an IT policy is a necessity. If you are unsure whether your current IT policy is sufficient, we recommend contacting a lawyer to review your current policy.
