Everyone likes to start the new year with resolutions for improvement. For organizations, January is the perfect time to tackle new goals. When it comes to technology, we have suggestions to get your business on track. That said, our first technology resolution is actually not technical at all.
We recommend taking a huge step toward improving your cybersecurity posture by revisiting essential policies that play a fundamental role in protecting your organization from security breaches and hacks. Too often companies draft policies but don’t update them regularly, or they fail to communicate the importance of those documents. An annual New Year’s resolution to review, update, and communicate cybersecurity policies is an effortless way to tackle that challenge, helping your organization to remain current on cybersecurity best practices.
Writing or revising business policies can be overwhelming, but we’ve found that starting with documentation that touches the widest swatch of data or devices in your business is a good first phase of your annual policy review. From there, phase 2 should address any unique, specific needs that you may have with policies that may play less of a role in protecting your organization from bad actors but are essential, nonetheless. Last, phase 3 should include a review of your incident response plan and cyber insurance policies to make sure you are prepared in case a cyber attack does happen.
Why are security policies so important to your organization? Most cyber attacks take advantage of simple vulnerabilities, such as a lack of MFA or unsecured devices such as personal laptops used for BYOD. By regularly reviewing your policies and making sure you communicate the rules and reasons for the documentation across your organization, you can often improve your cybersecurity stance without spending a dime.
Essential policies and plans most organizations should have:
Acceptable Use Policy
An Acceptable Use Policy (AUP) explains the permitted use of your organization’s IT equipment. This policy should define appropriate and inappropriate use of technology systems and devices, and clearly outline the risks of misuse. The AUP addresses routine use, guidelines for mitigating cyber risks, rules for handling proprietary information, and steps to protect sensitive data.
Data Management/Data Classification Policy
How you classify data provides the foundation for securing sensitive, private, or confidential information within your organization, a challenge that grows each day with the advent of tools such as generative AI, which increases the opportunity to inadvertently share classified information in a less-than-secure environment. This policy can be simple, classifying data into a handful of categories and defining usage rules for each grouping. For example, data encryption may be required for highly confidential data, even within the organization. That guidance includes rules for both internal use and access as well as external use cases. This policy may also address data retention rules and processes for protecting that archived information.
Access Control Policy
There are two types of access control: physical and digital. A physical access control policy addresses access to buildings, rooms, and physical IT assets—a requirement of most regulatory compliance standards. Additionally, digital access control limits connections to IT networks, system files, and data. Your access control and data management policies should align, creating a secure environment for assets both physical and digital. When it comes to physical access control, organizations should address user credentials, settings for physical systems such as card readers, and outline tracking, alerting, management, and auditing processes. Digital access control systems perform identification authentication and authorization of users by evaluating credentials such as passwords, personal identification numbers, biometric scans, security tokens, or other authentication factors. Multifactor authentication (MFA) is an essential part of access control. Some organizations with highly valuable or sensitive data may require granular data access policies that go as far as file or folder rules. Other best practices include using the principle of least privilege, which grants the minimum amount of access necessary for a user to complete tasks, and adopting a zero-trust stance, which assumes that both internal and external threats are always in play and no entity is trustworthy.
Password Creation and Management Policy
The next layer of access control is the password management policy that guides creating, changing, and safeguarding strong and secure passwords to verify user identities and obtain access to company systems or information. This policy should be clear and simple since password usage impacts employees daily and can impact productivity if not managed and communicated well. The policy should address specific password complexity and length requirements, in addition to noting any exceptions, such as apps that have different password requirements. Best practices require employees to use unique passwords and change those passwords every three months, as well as demanding MFA. Many organizations use password managers to support complex requirements while simplifying the user experience.
Remote Access Policy
A remote access policy addresses devices connecting to your organization’s network from outside the perimeter. The policy should enforce strong passwords, MFA, logging off when leaving devices unattended, and restrict connection to other networks while connected to the company network. Often, this policy addresses schedules for updating software to prevent vulnerabilities. It also covers the process and requirements for bring-your-own-device (BYOD) options. With today’s abundance of work-from-home and remote options, this policy has gained importance. Mobile devices represent a substantial risk since they often house confidential information and can access the corporate network, so be sure to set reporting procedures for lost or stolen equipment whether it is company-owned or BYOD.
Data breach or incident response policy
The incident response policy is typically part of an organization’s business continuity plan and is likely required by any cyber insurance provider to secure coverage as well as to meet compliance requirements. The policy outlines your organization’s response to a cybersecurity incident. The incident response policy should be documented separately from a disaster response policy because it focuses solely on procedures for cyber attacks. This policy should identify the incident response team and their roles and clearly outline procedures.
Download our sample incident response template
Business Continuity or Disaster Recovery Plans
While these may not be policies by definition, they are critical elements in a seamless cybersecurity stance. Often referred to as “ cyber resiliency,” this approach weaves policies such as access control and incident response with a 360-degree look at your organization from defenses to operational security measures to response to a breach or disaster. Don’t forget to include internal and external communication plans within these documents.
By investing time each year to thoroughly review and update your security policies, you will build a strong cybersecurity culture that bolsters your strongest defense—your employees.
Need guidance on policies to improve your cybersecurity? Schedule a consultation with Exigent now, and let’s get started.
Daniel Haurey Jr. is the president and founder of managed IT services provider Exigent Technologies, which he founded in 1997. Under his leadership, the MSP has earned accolades ranging from Channel Futures MSP 501 to being named SonicWall’s 2024 MSP Growth Partner of the Year. Dan is a true entrepreneur, dedicated to growing, investing in, and mentoring small businesses. You can find him on LinkedIn, where he regularly posts about technology, business, leadership, and community.