February 26, 2018
As a business owner and employer, it is your job to map out a cybersecurity plan and make sure your employees understand and follow the protocols. Additionally, it is your job to screen all employees and figure out which positions have the most access to sensitive information, and in turn, pose the biggest threat to the company.
First, an employer should conduct a vulnerability assessment to identify and evaluate risks based on each employee’s job position and his or her access to sensitive data. For companies with complex compliance requirements, such as healthcare companies or financial institutions, the consequences of being found noncompliant must also be considered. Across all levels of the company, identify the employees and managers who have access to financial data, credit card numbers, customer information, trade secrets, or other confidential business information. The cybersecurity program should be adapted to address identified risks and include things like employee background checks, credit checks, access control and monitoring of system use. In addition, encrypting confidential and sensitive data could be a crucial step in preventing data loss.
In order for your employees to follow your cybersecurity plan, you must:
- Include all employees in the cybersecurity planning and education process, not just those directly involved with the company’s IT services.
- Ensure that all employees are aware that they are instrumental in the cybersecurity plan and in preventing unintentional data loss.
- Avoid a culture of blame and victimization. You want employees to come forward when they suspect there has been a security breach. This should be a learning situation for the company and proper actions should be taken as to not damage the relationship between the organization and its employees.
- Provide your employers with the technology devices and services they need to do their jobs (computer, cell phone) so you have the right to check or monitor the devices.
Your employees can either be your biggest asset or your biggest risk when it comes to cybersecurity, depending on how thorough and inclusive your cybersecurity training program is. An employee who is educated about your cybersecurity plan, and whose questions and concerns are addressed, is likely to take ownership of his or her role as a protector of your company’s data and other assets.
