For many enterprises, IT infrastructures have broadened to the extent that they seemingly have no boundaries. Many employees are working remotely or via a hybrid model. Cloud-based services have become the norm. Edge computing and the internet of things are continuing to grow.
This can all be great from the standpoint of keeping staffers happy, increasing access to data for those who need it, and enhancing data analytics, among other benefits. But it can also increase cybersecurity risks. Because of this, organizations must continually revisit their IT policies to see whether they need updating, and they must remain vigilant in defining new policies as new technical use cases arise.
Here are some important IT policies to consider defining for your organization in order to ensure a more secure enterprise.
Acceptable use policy
It’s one of the basics of any cybersecurity program: ensuring the proper use of IT assets throughout the enterprises. Acceptable use policies describe what organizations determine to be acceptable use of their assets and data. In short, this policy explains what is expected of employees while they’re using company assets.
By providing users with guidelines for what they can do and limitations on how they do things, enterprises can reduce risks.
“When it comes to IT policies, one of the most critical areas to address is the acceptable use of assets and data, including user behavior,” says Esther Strauss, co-founder of Step by Step Business, a provider of online guides for creating businesses.
“This policy is vital for maintaining the integrity and security of an organization’s IT infrastructure,” Strauss says. “The acceptable use policy sets clear guidelines on how employees can use company resources, such as computers, networks, and data.”
This policy is essential for several reasons, Strauss says. For one, it helps prevent misuse of resources, which can lead to security breaches. “For example, employees may inadvertently download malicious software by visiting unauthorized websites or using personal devices that are not secure,” Strauss says.
For another, an effective use policy helps protect sensitive data. “It provides guidelines on how data should be handled, stored, and transmitted,” Strauss says. “This is crucial for ensuring compliance with data protection regulations.”
AI use policy
Artificial intelligence continues to grow in importance for many organizations, but the technology is not without risks and users need guidance on how to properly leverage tools and data.
“Businesses need to start defining clear acceptable use policies for AI,” says Ari Harrison, director of IT at BAMKO, a provider of promotional products. “If there are existing policies about data exfiltration, they should be updated to include specifics about AI” large language models (LLMs). “For example, policies should explicitly state that prompting tools like ChatGPT with company information is strictly prohibited,” he says.
It’s crucial not only to have acceptable AI use policies but also to enforce them through defined protections, Harrison says. “Microsoft Defender can now track, alert, and block the use of LLMs, ensuring compliance with these policies,” he says. “Implementing such measures helps safeguard against unauthorized data usage and potential security breaches.”
More and more companies are integrating LLMs while ensuring that these models are not trained on their proprietary data, Harrison says. “This approach helps avoid risks and maintain control over AI usage within the organization,” he says.
Using the recently released ISO 42001 AI certification framework can significantly enhance an organization’s approach to AI governance, Harrison says. ISO 42001 is specifically designed for AI. “The framework presents a structured model to manage AI risks and provides a defensible approach to AI usage,” he says.
Data management policy, including data classification
Protecting data, particularly information that is highly sensitive, is a vital part of any IT policies strategy.
Companies should have a data protection and privacy policy in place to ensure compliance with data protection laws and to safeguard personal data, says Kayne McGladrey, CISO at risk management software provider Hyperproof and a senior member of the IEEE.
This should include data collection, processing, and retention guidelines;
mechanisms for enforcement of policies; security controls for data storage and transmission; and procedures for data breach response.
In addition, enterprises need a data retention and disposal policy to establish guidelines for retaining and securely disposing of data, McGladrey says.
This should include data retention schedules based on data classification; procedures for securely disposing of data that is no longer required for legitimate business purposes; compliance with legal and regulatory requirements for data retention; and documentation and audit trails of data disposal activities.
Incident response policy
Security teams need to be prepared to respond quickly when any kind of breach or other attack takes places. How long it takes to react can mean the difference between thwarting an attack before it does damage and experiencing a significant impact from an incident.
An incident response policy outlines the approach for managing and responding to cybersecurity incidents, McGladrey says.
This should include a definition of what constitutes an incident; roles and responsibilities of the incident response team; steps for incident detection, analysis, containment, eradication, and recovery; mandatory time reporting windows and contact information for reporting bodies; and post-incident review and improvement processes, McGladrey says.
Incident response can be part of a general information security policy that establishes a framework for managing and protecting a company’s information assets, McGladrey says. This should include objectives and scope of information security, roles and responsibilities related to information security, general security principles and practices.
Hybrid and remote access policy
The pandemic forever changed work models, and now it is common for employees to work from home or another remote location at least part of the time. The hybrid/remote model is likely here to stay, and brings its own set of security challenges.
Among the more common risks are expanded attack surfaces, non-compliance with data privacy regulations, increased susceptibility to phishing and other attacks, and improperly secured devices and networks that are used to access enterprise systems and data.
Organizations need to set policies regarding remote data access. “Remote access has evolved from an after-hours system management tool to a key aspect of modern operations across industries in the past five years,” says Leon Lewis, CIO at Shaw University. “Information, software, and settings must be easily accessible in the digital age, to achieve [corporate] goals.
Today’s organizations must balance network security and accessibility, Lewis says. Due to the increase in regulations in financial services, healthcare, and other sectors, and the emergence of data privacy and protection laws around the world, this task is difficult, Lewis says.
“Remote access solutions allow employees, students, and clients to access resources from anywhere while protecting sensitive data,” Lewis says. “By following strict security protocols, firms can protect their infrastructure and encourage innovation.”
Meeting the increasing demands of stakeholders, whether they are students and staff in education, patients and medical professionals in healthcare, and clients and employees in the corporate world, requires safe remote access, Lewis says. “Accessibility and data protection must be balanced for high-quality services and legal compliance,” he says. “Security and accessibility help the next generation of professionals succeed and flourish.”
