The E-Policy Handbook: Designing and Implementing Effective E-Mail, Internet and Software Policies

Read an Excerpt

1. Forming Your E-Policy Team

The size of your e-policy team will depend on the size of your organization, the scope of your electronic exposures, and your willingness to commit financial and human resources to e-risk management. For most organizations, the e-policy team will be made up of some or all of the following professionals.

Potential E-Policy Team Members

Increase the likelihood of e-policy success by appointing a senior executive to head up your e-policy team. The involvement of a top executive will signal to the staff that your company is fully committed to its e-policy program and expects employees to support the policies as well. With a white knight leading the charge, your e-policy team should have no trouble receiving the funding and support necessary to complete its assignment in a timely manner.

Research Consultant

You cannot hope to change staff behavior until you know precisely what type of computer-related activity your employees are engaged in. Merely assuming your employees are using your computer assets appropriately is not good enough. As a responsible employer, you must ascertain exactly how your employees are using, and perhaps abusing, their e-mail, Internet, and software privileges.

The mosteffective way to gather that intelligence is to conduct a comprehensive internal audit. An organization with a large staff and significant e-risks may want to retain a professional research consultant or other cyberexpert to customize a written e-mail, Internet, and software usage questionnaire, tabulate responses, and prepare a written report for the e-policy team's review. At smaller operations, the tasks of drafting the questionnaire, tallying responses, and preparing a summary report likely would fall to an e-policy team member who can be counted on for accuracy, sound judgment, and discretion. (See Chapter 2 for a sample e-mail, Internet, and software usage questionnaire.)

Human Resources Manager

Regardless of your industry or organization size, your human resources (HR) manager should play a key role in the development and implementation of your e-policies. Involve your HR manager in all aspects of the e-policy program, from planning, through writing, to training and enforcing.

If you don't have an in-house HR manager, assign the executive responsible for hiring, disciplining, and terminating employees a spot on your e-policy team.

Chief Information Officer

Your chief information officer (CIO) can help the e-policy team bridge the gap between people problems and technical solutions. Information management professionals can play an important role in identifying electronic risks and recommending the most effective software tools and techniques to help manage those risks.

Legal Counsel

No matter how well-written, comprehensive, and compelling you believe your e-policies are, do not circulate them to employees until they have undergone thorough review by an experienced employment law or cyberlaw expert. Have your legal counsel review your epolicies to ensure that all applicable federal and state laws and regulations are addressed and that rights are protected (see Chapter 3).

E-Risk Management Consultant

Effective electronic risk management calls for coupling management techniques and software tools. Have you educated your employees about your organization's risks and the ways they can help limit liabilities? Do you consistently delete e-mail messages that some day could come back to haunt you? Have you installed monitoring and filtering software? An e-risk management consultant can work with you to develop effective risk management guidelines to help structure and support your e-mail, Internet, and software usage policies.

Computer Security Expert

While developing your e-policies, take time to assess and address your organization's computer security concerns and capabilities. Computer security policies and procedures are designed to mitigate risks by keeping malicious external hackers and internal saboteurs out of your system. If your organization does not employ an in house computer security professional or team, hire an outside consultant to assess and address your e-security risks (see Chapter 5).

Cyberinsurance Broker

No organization is completely free of electronic risk. Even with comprehensive, written e-policies in place, disaster will strike on occasion. Mitigate e-disaster liabilities and costs by putting into place a comprehensive cyberinsurance program. If you have not done so already, consult with an experienced cyberinsurance broker to review your e-risks and discuss the protection e-insurance offers (see Chapter 6).

Training Specialist

Your written e-policies are only as good as your employees' willingness to adhere to them. Spend as much time communicating your epolicies as you do developing them. Don't rely on employees to train themselves. Support initial e-policy training with continuing education tools and programs.

Make employee education the shared responsibility of your training manager, HR director, and the managers and supervisors who interact with employees daily and are positioned to correct inappropriate behavior on the spot.

Writing Coach

One of the most effective ways to control e-risks is to control e-content. An experienced corporate writing coach can help craft your written epolicies and develop a customized electronic writing policy for your organization. Your e-writing policy will work in tandem with your e-mail and Internet policies to ensure content is clean, clear, and compliant. Maximize the effectiveness of e-communication by having your writing coach take employees and executives through a refresher course on the ABCs and Ps and Qs of effective electronic writing (see Part 4).

Public Relations Manager

In the event of an electronic disaster-a hacker attack that shuts down operations, a high-profile lawsuit that captures the attention of the media, the arrest of an employee accused of soliciting sex from minors via the company's Internet system-your PR manager will play an important role in keeping employees, the media, customers, shareholders, and others informed, while killing rumors. Hope for the best, but plan for the worst. Incorporate a written e-crisis communications policy into your organization's comprehensive e-policy (see Chapter 19).

Chapter 1 Recap and E-Action Plan: Planning a Risk-Free Future

operate e-mail systems to facilitate internal and external communication. Access to the Internet is a given in most offices. And there has been explosive growth in the number of companies that have established Web sites to dispense information and sell products and/or services. From start-up dot-coms to Fortune 500 companies, it seems as though everyone today is engaged in e-commerce and e-communication.

According to Forrester Research, business-to-business transactions over the Internet are expected to reach $1.3 trillion by 2003.' All that e-communication and e-commerce is not restricted to corporate giants. Even the smallest companies are getting into the act. A survey conducted by Bruskin-Goldring for Bank One reveals that almost half (49 percent) of small-business owners with 10 or fewer employees have Internet access. Among them, 35 percent operate their own Web sites.

With all that electronic activity comes risk. Employee use of corporate computer resources can open an organization to liability risks, jeopardize security, and waste productivity.

Fortunately, employers do not have to sit by and wait for e-disaster to strike. By assessing employees' attitudes toward and use of computer assets, establishing proper e-risk management and security procedures, buying the right cyberinsurance products, and enforcing written e-policies, employers can take big strides toward reducing electronic risks in the workplace.

No organization-public or private, for-profit or not-for-profit, international giant or regional small business-can afford to engage in electronic communication and e-commerce unprepared. The potential risks and costs are too great.

1. Marshal the combined expertise of your e-policy team, and get to work on the timely development of written e-mail, Internet, and software usage policies.

2. While developing your e-policies, review related policies that can play a significant role in e-risk reduction. If your e-risk management, e-security, e-insurance, and e-writing policies are inadequate or nonexistent, now is the time to address them.