Prior to the coronavirus pandemic, working from home was already evolving as a part of an organization’s overall workforce solution. Some organizations realized and addressed the potential risks and vulnerabilities associated with having employees working from home. These organizations had the foresight to develop records management policies and procedures to keep their intellectual property safe. Unfortunately, many companies decided not to address these potential threats which have now become exponentially larger with the current upended traditional workplace.
As with most everyone, I wake up daily and read the usual news feeds on my phone and computer. One day I found what should be every corporate security department’s nightmare in the following Washington Post headline: Russian Criminal Group Finds New Target: Americans Working at Home. A hacking group calling itself Evil Corp., indicted in December, has shown up in corporate networks with sophisticated ransomware.
Evil Corp. may have already invaded your network, or tried to, and you may consider that Evil Corp. would not be interested in your industry. This does not negate the fact that every company needs to assess its policies and procedures regarding the protection of corporate information and its use to mitigate the risk. Once the risk assessment is made then action should be taken. ALL employees need to be made aware of the organization’s potential exposure areas and the company expectations and action plan.
On the information governance front, organizations can take actions to help assess and mitigate risk:
- Review existing contracts with all information vendors
- Review and update existing IT and Security policies
- Review and continually update Employee Codes of Conduct
- Review records management policies and procedures
- Update records retention schedules (RRS) to reflect that ALL information formats are included
- Create Information Governance Groups such as an Information Governance Steering Committee, IT Council, or a virtual table full of information gurus
- Have these groups gather expert opinions on the existing state of the organization’s information governance concern and authorize it to make recommendations for:
- Updating policy for creation, use, management, and destruction of information
- Enforcing training among all staff, permanent or contract
- Creating new positions to oversee information and records management
There are information governance consultants in your area who specialize in this arena, leverage their knowledge and experience to help your organization. Protecting your business and employees is a now item, do not be the subject of the next headline.
Related Posts
Data Breaches Are All Around Us It seems like every day we hear [...]
Can You Safeguard What You Don’t Directly Control? Navigating a work-from-anywhere (WFA) environment [...]
Information Governance Requires Defensible Destruction Part 1-Implementing Policies-The Hows and Whys Corporate workplaces [...]