Who is responsible for securing an organization’s information? Perhaps the Research and Evaluation department? Not exactly. The Management Information System (MIS) staff? Wrong again.

Discussion Question 2
No unread replies.
No replies.
Topic 2 dealt with Security Policies for companies. Using notes from Chapter 2 and after watching the Video Link below, please come up with some policies you think would be important to implement at your workplace, school or home.
Link:

Why Do You Need a Security Policy?
Who is responsible for securing an organization’s information? Perhaps the Research and Evaluation department? Not exactly. The Management Information System (MIS) staff? Wrong again. Ultimately, it is not only individual employees or departments that are responsible for the security of confidential information, but also the institution itself. It is, therefore, incumbent upon top administrators, who are charged with protecting the institution’s best interests, to ensure that an appropriate and effective security policy is developed and put into practice throughout the organization.

While policies themselves don’t solve problems, and in fact can actually complicate things unless they are clearly written and observed, policy does define the ideal toward which all organizational efforts should point. By definition, security policy refers to clear, comprehensive, and well-defined plans, rules, and practices that regulate access to an organization’s system and the information included in it. Good policy protects not only information and systems, but also individual employees and the organization as a whole. It also serves as a prominent statement to the outside world about the organization’s commitment to security.

Getting Perspective
Although finalizing organizational policy is usually a task reserved for top-level decision-makers, contributing to the development of policy should be an organization-wide activity. While every employee doesn’t necessarily need to attend each security policy planning session, top-level administra-tors should include representatives from all job levels and types in the information gathering phase (just as in the case of brainstorming during risk assessment). Non-administrative staff have an especially unique perspective to share with policy-makers that simply cannot be acquired by any other means. Meeting with staff on a frequent basis to learn about significant issues that affect their work is a big step toward ensuring that there is buy-in at all levels of the organization.

While it makes sense to get as much input from potential users as is possible, it is also essential that voices from outside the organization be heard during the information gathering stages of policy development. Why? Because decision-makers need to be informed of security arrangements that other organizations are making that potentially impact them and the policies they will be developing. If, for example, every school but one in a district commits to encryption software to protect messages sent over the Internet, the lone school that does not have the encryption key is going to have a very difficult time communicating with its partners. The point is that just as security planning demands coordination internally, it often requires it externally as well–a recommendation that should not be overlooked, especially by those organizations that practice site-based management.

Last Completed Projects