Today’s post is from guest blogger, Katie Weaver with Awareity. The article focuses on the importance of not only establishing workplace policies and procedures, but making sure that your employees have read and understand your policies.
Recently, Awareity’s CEO, Rick Shaw, was asked to present at the Infotec conference in Omaha. During his presentation, “The Truths (and Myths) About Assessments, Planning and Implementing”, Rick discussed the three-legged stool each organization is sitting on, and the importance of all three legs (Assessments, Planning/Developing and Implementing).
Most organizations understand the importance of assessments and planning, but where many fail to deliver is in the implementation phase. As we have seen with numerous headlines and lessons learned, a failure to implement can lead to expensive fines, lawsuits, breaches and losses. Rick used a case study for CVS Caremark.
Due to employees carelessly tossing old pill bottles into a store’s dumpster, CVS now has the FTC coming to audit their information security program for the next 20 years and was forced to pay a HIPAA violation fine of $2.25 M. The FTC Complaint Docket No. C-4259 read:
Working on improving employee engagement?
EPIC is an Employee Engagement software that gives you the tools and insights to create a workplace culture that encourages engagement, loyalty, and trust.
“Among other things, respondent failed to: 1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal.”
During the presentation, one woman raised her hand and asked, “What do you mean by “implement”? How do you “implement” your policies and procedures once they are created?” I thought this was a great question and one that should be expanded upon.
An organization can have the best security policy (or plan, program, etc.) in the world, but if the policy is not implemented down to the individual-level, how will individuals be able to help the organization achieve better results?
If your organization is just blasting your security policies out to your people in e-mails and memos…how do you know if anyone received the email or is reading the policies and understands them? Or perhaps you are sending out updated pages for the employee handbooks or manuals…how can you ensure your employees are actually reading these policies? Are the binders just sitting on a shelf untouched?
Implementing policies, procedures, plans and processes means organizations have documentation and proof that individuals have read, understood and acknowledged their roles and responsibilities. Regulations require proof of implementation. Legal due diligence requires proof of implementation. Lessons Learned continue to prove that organizations that lack implementation will continue to experience expensive and embarrassing results.
Organizations must ensure all appropriate individuals (employees, third-parties, etc.) are receiving updated policies and guidelines, reading the policies, understanding the policies, and acknowledging their individual roles and responsibilities. Providing employees with a once-a-year general training session is not good enough as we know risks, threats, best practices, etc. are constantly changing. The bad guys are not taking 364 days off, is your organization?
About the author:
Katie Weaver is with Awareity, a privately held organization founded by Rick Shaw in 2002 with a unique focus on lessons learned in several critical areas of business – compliance, information assurance, public safety, emergency management and enterprise risk management. Awareity’s experts study and research many different types of incidents, regulations, attacks, headlines, failures and successes to reveal costly gaps and dangerous trends. You can reach Katie at info@awareity.com.
Dianne Shaddock
Latest posts by Dianne Shaddock (see all)
- Build the Best Team for Your Small Business - November 12, 2019
- Cross Training Staff – Doing the Right Thing For the Wrong Reasons - January 18, 2019
- Proactive Employee Management Really Boils Down To The Basics - December 21, 2015
- Office Meetings Do Not Have To Be A Productivity Time Drain If Done Right - November 17, 2015
- Proposed Changes To Employee Rights Laws: WAGE Act Bill - November 3, 2015
Leave a Reply