How to Write Up a Security Policy for Antivirus, Spyware, & Adware
When drafting an IT security policy, one of the most important things to include is a section that describes your company's strategy for dealing with viruses and other malware that may infect the organization's network and individual computers. Defining and describing expectations for employee conduct dealing with visiting Internet sites, downloading unknown files, and using external storage devices will go a long way in protecting your computers and the information they contain.
Other People Are Reading
Instructions
-
-
1
Determine to whom and what the IT security policy addressing viruses and malware applies. Including management at this point can prove extremely helpful as you will find that they will be more apt to approve a policy with their input.
-
2
Inform your users why there is a need to protect against viruses and other types of malware. You have a greater chance of employees following the guidelines of your policy if they understand why it is in place. Provide specific examples of what can happen to the organization, sensitive data and even private employee information should there be a malware outbreak on the company network. Include the need for your organization to abide by national and state legislation written to protect sensitive and personal information.
-
-
3
Provide a general description of the policy. Speak to what you expect from the employees the policy applies to. This is where you will define what the organization will do to prevent malware outbreaks.
Once you have provided a general description, be sure to go into specifics regarding expectations. If the policy states that all external storage devices need to be run through an anti-virus scanner before you access them, explain this and the steps required to complete this.
-
4
Explain the consequences for not adhering to the policy. Tell the employees specifically what will happen if they break any of the guidelines set forth. If there are varying levels of consequences, then this must be included as well. Be sure that whatever consequences you include are ones that can, and will, be enforced by management.
-
1
Tips & Warnings
Be sure to get buy-in from management to enforce policies from the very beginning. If there is no enforcement, the policy becomes useless.
Make sure your policy follows any requirements set forth by federal and state legislation.
