When it comes to IT security, clearly defined and documented policies which can be translated into actionable and repeatable procedures.
Clearly documented and articulated policies leave no room for doubt as to what is expected and acceptable behavior. If your policy is vague and ambiguous, not only will employees be frustrated never being certain if they are compliant, but you will likely have multiple interpretations of how to implement the policy. Worse, you may wind up in litigation if you take disciplinary or civil action against someone violating policy based on their interpretation. Remember the old "Welcome Screen" of yore? Did companies really intend to "welcome" everyone, including hackers?
Policy is great, but limited. Policies need to be put into action, meaning translated into procedures which can be repeated and measured. If you have a policy that says everyone is required to have an ID and a password to access your systems, but you have no procedure defined around user ID provisioning that requires ID's be created with a password, then you will have ID's created without passwords someday, somehow, either by accident or via malicious intent. Procedures should drive behaviors, as in this example by the user ID provisioning team, to always create ID's with passwords, and those matching the password controls further defined in the policy (such as length, complexity, change interval, etc.).
A policy that states this and clarifies the nature of the password gives a benchmark to know if you do or do not meet the policy. But having a procedure defined - based on the policy - that drives the behavior of those creating ID's gives you control of the situation.
If you're looking for managed IT services or professional IT services, contact Total BC Inc, today!
