Information Security Policy
“Security is not a product, but a process.” –Bruce Schneier
Any business or company that deals in goods, services or information should have a thorough and well-documented information security policy. This policy should fundamentally explain and detail how data is obtained, stored and protected, limit or eliminate potential legal liability and preserve and protect confidential information.
Information security can encompass a variety of topics, including data restoration in the event of a disaster or emergency, computer data, telephone procedures (such as recording for quality assurance), data organization, third party risk management, confidentiality, visitor access, media, passwords, encryption, e-mail, Internet, software, audits, access and ethics.
As Bruce Schneier said, a good security policy is a process that will grow and change as your company grows and changes. With each new client, employee or update in software, you may have to make changes, additions and corrections to your security policy. In the area of debt collection, information security is essential, because collections deals in sensitive information such as addresses, phone numbers, social security numbers, income and banking information.
Like anything significant, developing an effective security policy takes time and tends to happen in stages. Development, enactment, enforcement, monitoring and maintenance are all crucial steps in making sure your information is guarded. Depending on the type of company, developing this procedure could be as simple as enforcing policy on cell phone and social media usage or as complex as obtaining offsite backups in the event of data loss or local disaster.
An information security policy is primarily to manage potential exposure to loss or harm. It is vital that you communicate your policy to clients and train your employees.
This concludes our series on Better Business Practices. Stop by next week for brand new content!
Atkins & Ogle Law 