IT security procedures -- are they being implemented?<\/p>\n
Tedy Djajawinata, Contributor, Jakarta, tedy.djajawinata@csindonesia.co.id<\/p>\n
Many companies spend long hours and excessive amounts on
\nconsultancy fees in developing IT security procedures for
\ndifferent reasons.<\/p>\n
Some are genuinely keen on protecting valuable information
\nassets, while others are responding to issues raised in audit
\nreports.<\/p>\n
Regardless of the motivations and the energy spent in
\nproducing these procedures, are they actually being properly
\nimplemented?<\/p>\n
It is not surprising to often hear, \"Not exactly\", as the
\nanswer to this question. It is indeed a very challenging job for
\nan IT Manager to ensure that these procedures are effectively
\nimplemented by his staff.<\/p>\n
And, it is a fact, IT staff in turn have numerous excuses for
\nnot implementing them. However, some practical insights could
\nhelp the IT manager address these issues:<\/p>\n
\"We are not aware of any procedures related to what I do\"<\/p>\n
Ensure that all procedures are published and disseminated to
\nyour staff, and your users when appropriate. If necessary,
\ninclude these in their job descriptions. Have the designated
\nchampion for each procedure explain it to the rest of your staff.<\/p>\n
Everyone should know who does what and how. Use the same
\nopportunity to get feedback from your staff on potential issues
\nrelating to the implementation of the procedures.<\/p>\n
\"I don't really understand the procedures. They are too
\ncomplicated\"<\/p>\n
Ensure that your procedures are concise and easy to
\nunderstand. Use the language understood by your staff. For
\nexample, use Bahasa Indonesia if necessary. Also, develop very
\npractical, yet effective and well-structured procedures clearly
\ndescribing who does what.<\/p>\n
Complex and wordy procedures usually discourage people from
\nimplementing them. Remember that the main audience for your
\nprocedures is your staff, not your auditors.<\/p>\n
\"There is no way we can do this here (in this organization)\"<\/p>\n
Recognize the objective of each task. If necessary, use a more
\npractical alternative method for your organization to achieve the
\nsame objective. Ensure that your procedures are well suited to
\nyour IT environment.<\/p>\n
Simply copying and pasting them straight does not help.
\nHowever, bear in mind that some objectives can only be achieved
\nby changing the way certain activities are conducted by your
\nstaff and users. Additional tools and skills may be required to
\nachieve these.<\/p>\n
\"Users complained to us about the bureaucracy\"<\/p>\n
It is commonly understood that, from the users' point of view,
\nit is always easier and faster to get things done without having
\nto go through the procedures. In this case, it is important that
\nthe validation as well as the necessity for changes are well
\ncommunicated to your most senior management and eventually to
\nyour users to gain their full support.<\/p>\n
\"I don't do this because it's not yet on the procedure\"<\/p>\n
Ensure that you keep the procedures up to date and in line
\nwith the changes to your environment. These updates must be
\nimmediately communicated to affected staff. Ensure that your
\nstaff keep only the most current version, and only one version.<\/p>\n
\"What's in it for me?\"<\/p>\n
It may be a disturbing but nevertheless common question from
\nthe IT staff. It may not be easy to establish, but one of the
\nmost effective tools to address this is to use consistency in
\nexecuting the procedures as one of the Key Performance Indicators
\n(KPIs) of your staff.<\/p>\n
Remember that their performance is also your KPI.<\/p>\n
\"How am I doing?\"<\/p>\n
Perform periodic audits on each procedure. If available, also
\nask your internal audit team to perform periodic internal audits
\non your team. Immediately address any issues raised in and during
\nthe audit.<\/p>\n
And finally, congratulate your staff on having fewer IT-
\nrelated issues raised in your organization's audit report.<\/p>\n
The writer is a principal, information system services, at PT
\nConsulting Services Indonesia<\/p>",
"url": "https:\/\/jawawa.id\/newsitem\/it-security-procedures-are-they-being-implemented-1447893297",
"image": ""
},
"sponsor": "Okusi Associates",
"sponsor_url": "https:\/\/okusiassociates.com"
}