How to Develop a Corporate Information Security Policy

A corporate security policy should address who can access physical customer files.

The security of corporate information is critical to maintain a competitive edge, ensure compliance with government-mandated privacy rules and financial data confidentiality regulations. Information must be kept secure from business competition, from potential hackers looking for customer data and from employees without the need to access sensitive corporate information. Developing a corporate information security policy requires understanding the flow of data in a company, determining the information access needs of different employee groups and establishing the technology framework for a secure corporate infostructure.

Instructions

1. Research the legal requirements for corporate security. If you are a private corporation, look to privacy regulations for customer data, employee information and financial transaction data such as credit card numbers. If you are a public company, also consult Securities and Exchange Commission regulations and Sarbanes-Oxley requirements to establish the minimum data security requirements needed in your information security policy.

2. Establish information access requirements for groups of employees and key personnel. Address who has access to financial data, employee files, customer data and mission critical information. Consider why each group or individual needs access to information and what security liabilities each group represents. Consider employee bonding or insurance options to mitigate the financial exposure for potential security lapses.

3. Develop a written information security policy. Outline the roles and responsibilities of employees, how information is secured in general terms and all security clearance procedures. This document should provide insight into both computer-based data security procedures and physical security of files, documents and corporate information. Provide a policy on how to handle information security lapses including reporting mechanisms, ongoing security review processes and define who is responsible for maintaining security policies.

4. Document an information technology-based information security plan. Expand on your basic information security plan to include network intrusion detection policies, password-based user security setup and database access processes. Establish the basic model for technologically securing your corporate information and the hardware, software and technology foundation necessary to achieve a secure infostructure.

5. Review security policy with management, executives and stakeholders. Make revisions based on input and conduct training session with employees to ensure compliance. Routinely review the security policy and update it based on new threats, legal changes and technology advances.

Tips & Warnings

• Consider security audits to ensure compliance with your security policy.

• Make it clear to employees what information is not allowed to be discussed or distributed outside the company to avoid unintentional information security breaches.

References

• Processor: Corporate Security Policy - Why You Need It & How To Do It
• Symantec: Importance of Corporate Security Policy