Data and the policies that protect it: 4 essential plans to have in place
These four sample policies can help you protect your data by ensuring it’s properly encrypted, stored safely, only accessible by certain people, and securely backed up.
Image: Andriy Onufriyenko / Getty Images
It’s been said we’ve gone beyond the information age and into the experience age, imagination age, fourth industrial revolution or one of a dozen other names for our current technological era. It doesn’t matter what we call it, the underpinning of it all is still information and data.
There’s an inconceivable amount of information being generated daily around the world, and some of it is incredibly valuable to the right—and wrong—sorts of people. That’s where having proper data security policies comes into play: You need them, full stop.
Protecting and securing data is more than just saying you’ll do it, though: There are a lot of things to be considered when thinking about how to secure data. Is it encrypted at rest? What about in transit? Is the cloud service hosting your data storing it and securing it properly? Which users have access, and how are they managed? These four sample policies from TechRepublic Premium will help you answer some of those questions in your organization.
This policy covers what should be encrypted, how it should be encrypted, examples of how to enforce encryption policies, which software to use for full-disk encryption and more. This policy focuses on data at rest and stored on organization-provided hardware, like laptops, servers, mobile devices and other hardware.
Storing sensitive data in third-party cloud storage should at the very least raise the hairs on the back of your security team’s collective neck: It’s a risk, no doubt about it. Modern cloud providers have made security features part of their systems, but problems of regulatory compliance, loss of access, service outages and other problems make using the cloud a potential tinderbox.
This policy will help you choose the right cloud vendors, determine what can and can’t be stored in the cloud, and how to handle other issues of access and security. It also covers how to handle the theft or loss of hardware with access to cloud services, and what to do to in order to better secure personal devices used for work.
People are often the weakest link in a security chain, and that includes the people you trust to manage organizational security. IT professionals need policies that cover how their access and privileges are assigned, managed, and monitored for violations. The policy covers access control for IT, as well as anyone else with administrator-level privileges on business systems.
Two words for you: Ransomware recovery. That phrase alone should clue you in as to why end user data backups are essential. Employees can often have important data stored on their work machines, and if access is lost due to device theft or malware infection there’s a quick, easy choice if a backup has been made: Just restore the infected machine, or a new one, so the employee can go on working. This policy will help you establish guidelines for setting up an environment where backups are routine, expected, and reliable.