Kevin Ian Schmidt

When a business hasn’t experienced a significant security incident for a while, C-suite executives typically become complacent and begin to question if all of the security procedures, systems and jobs currently set up are needed. However, complacency isn’t the right reason to reduce the security budget, particularly in a recession when crime usually increases. It is the responsibility of a security manager to make sure the organization always remembers the importance of physical security programs.

To avoid an upswing in security incidents, security management should conduct a physical security audit of their facilities. Evaluating current physical security procedures will reveal areas where security might need to be increased to protect the company’s assets, including facilities and employees.

To design a cost-effective security program, you need to carefully consider developing a well-balanced program. While designing a well-balanced security program, you will need to take note of the 3 fundamental components of physical security strategy.

Types of Physical Security

• Organizational (security staff and procedures as well as organizational security): Covering the involvement in the security programs by management, security staff, tenants and employees.
• Mechanical (electronic systems): Covering the use of security hardware including access control, Closed Circuit Television (CCTV), door locks, monitoring systems, emergency call boxes and intrusion alarms.
• Natural (architectural elements): Covering basic security philosophies involving property definition, natural surveillance and access control. Also known as Crime Prevention Through Environmental Design (CPTED), you are utilizing psychological techniques to reduce risk.

Unfortunately, countless security professionals concentrate too closely on just one of the three security concepts. A number of facilities depend too much on security guards who will be able to only protect a entrances or handle a limited number of people entering the building. Utilizing a massive security team is a sizable, long-term cost. Many other facilities concentrate on mechanical security, leaving their security team and tenants untrained and uninvolved in the security process. While other facilities go without the utilization of mechanical and organizational security, dependent upon the goodwill of others or simply the psychological effect of signage.

Establishing a security program that utilizes a balance of all the above physical security strategies, will keep the program flexible and ready to handle potential risks that may develop.

A physical security audit is the first step to proper design of a comprehensive physical security program. The following steps will walk you through the initial steps of conducting a physical security audit:

Check Out: Risk Assessment Guidelines

Examine Your Risks

Before you develop your security program, you must first determine the level of risk to your facility. The higher the risk, the greater need for physical security and planning. There are three forms of risk:

• Terrorism (International and Domestic)
• Criminal (Crimes against people and property)
• Environmental (Risk from nature or manmade incidents)

First, ask yourself these questions:

• Do you have neighbors who might attract unsafe individuals to your neighborhood for either terrorist or criminal activity?
• Does your facility contain individuals or activity that might bring risk to your doorstep?
• How well known is your facility on a local, national or international basis?
• Is your facility near railroad tracks, major freeways or a toxic manufacturing/storage facility?
• Are you near a university or college?
• Is your facility near a public park or government facility?
• Do any of the tenants in your building have negative media or internet exposure?
• Are there certain organizations that are not thrilled with the existence of one of the tenants in your building?
• What is the crime rate in your neighborhood?

The responses to these particular questions are going to determine the measure of risk for your facility. That is, an office building full of proctologists almost certainly carries a lower chance of terrorist attack compared to an office building containing a Federal Government Agency. A property positioned adjacent to an abortion clinic almost certainly carries a greater risk of becoming affected by safeguards or various other harmful events. A lot more Us office buildings have been evacuated as a result of toxic fumes from derailed trains and overturned trucks as compared to terrorist activities.

Check Out: Physical Security Risk Assessment: 9 tips to secure your workplace

Creating a Balanced Physical Security Program

Utilizing the aspects of organizational, natural and mechanical security you can develop layers of physical security around your facility.

Organizational Security

To begin with, who may be allowed in the building? The following recommendations come under the organizational method of physical security. In the event that your company is the solitary tenant of the building, what sort of background checks do you happen to be performing on new staff members or contractors? Are you able to know if the new personnel coming through the door is a legal resident of the United States of America? Does this new staff member have a record of violence, drug use or theft? In the event that they are handling cash, have you performed a credit check? Are you permitting undocumented associates of the cleaning staff to enjoy open access to every office in the facility at night? The expense of a background investigation for every new employee are dwarfed beside the losses you could possibly experience should you allow a violent person into your work site. In the event of contract companies providing staff to the facility, does the contract require the companies to perform background investigations of their staff, and can you at any time audit this process?
Do your tenants and staff members obtain some type of security and safety orientation? Will they be familiar with who to contact in an emergency? Do they understand who needs to have access to their work space? Do they know the emergency evacuation routes, and do they understand exactly where they need to meet once they evacuate the building so a headcount may be conducted? Is the lone emergency meeting location you have chosen in close proximity to any kind of potential neighborhood problems like a railroad track?

Do you have contact with community law enforcement representatives to know what is happening in your neighborhood? Do you have meetings with your neighboring businesses to discuss the issues they are facing? Could your company be impacted by a strike next door? Is one of your neighbors being threatened? Have any of your neighbors experienced an upswing in criminal activity? Do you have a clear communication method to pass this information to your tenants, employees, or neighbors?

More robust physical security controls, for instance physical security training as well as more effective background investigations, may have averted many of these attacks. Physical security controls consist of taking preventive measures to stop unauthorized physical access to restricted areas in addition to preventing physical theft. Insider threats to physical security may come from current or perhaps previous staff, contractors, or even respected business associates, which includes custodial personnel or security guards. Employees granted open access must be comprehensively vetted. As an example, custodial employees as well as security guards must submit to the exact same background investigation just like all the other insiders. Staff with this kind of access should likewise undergo regular security awareness training due to the fact their jobs cause them to become popular prey for social engineering attacks.

 

Natural Security

Now consider your facility perimeter utilizing natural security aspects. Look at your facility as a stranger might from the outside. Are your property boundaries clearly defined? Would a stranger know if he or she were walking or driving from public to private property? Is this clearly defined by signage or architectural design? Does the signage define the rules of your property? Are the rules enforced? Is your property given the appearance of being well maintained? Is graffiti quickly removed or covered? Are bushes trimmed low so they cannot be used for hiding? Is the lawn maintained? If you answered no to one or more of these questions, you will give the unsafe stranger the impression that you don’t care about your facility’s appearance and probably also do not care about security.

At night, is the area around your property dark and foreboding or well illuminated? Do your employees or tenants feel apprehension when they walk from your building to the parking lot or parking deck at night? Could they see danger at a distance or are there shadowy hiding areas where unsafe individuals could be lurking?

If you have a large parking lot or a parking deck, do you provide your employees, visitors or tenants emergency call boxes? Such call stations reduce the fear of isolation and distance. Are these boxes well illuminated and marked? Are they easily seen from all areas of the parking facility? Are the call boxes regularly checked to make sure they are working? Is there someone always ready to answer an emergency call from the call box? If the call comes in, will the person answering know where the call is coming from if the person making the call cannot speak?

 

Mechanical Security

The use of security hardware can greatly enhance your security program if there is a high risk to your property. How many entrances are there to your building? Are these entrances monitored? When we say monitored we could mean a lobby receptionist, a CCTV camera or an employee that can observe the entrance from his or her desk. Could an office creeper or stalker enter your facility without ever being seen or recorded by anyone or any system? Don’t forget about the back doors and the loading dock. These back doors can be a problem when they are left propped open by smokers. Limit the number of access points to your building and use some form of natural or mechanical surveillance so that those approaching and entering the facility have the feeling they are being monitored. You want to make the unsafe individual feel uncomfortable.

When using mechanical security systems, such as CCTV, look for systems that will give you the best bang for your buck. Which would be more helpful, a CCTV system that records individuals walking down a hallway at three in the morning or a system that records and alerts your monitoring station that someone is walking down that hallway and advising them what action may need to be taken? Make sure you are using all the features available in your security systems or that you purchase a system that meets your needs.

Access control systems provide a positive confirmation that the persons entering your facility or a particular strategic area are authorized. In very high-risk buildings or areas, the use access cards, combined with Personal Identification Numbers (PIN) key pad or a biometric reader will confirm a stolen access card is not being used to gain access.

Depending on the level of risk at your facility, you may want to introduce an inspection layer in your lobby. You may want to install signage that indicates you plan to randomly inspect packages carried in by visitors. You may have visitors walk through a magnetometer. Again, this will be defined by the potential threats to your facility.

One other access point is your air intake vents. This is not about a disgruntled ex-employee entering the facility through the vent, but instead introducing some toxic substances to your building to disrupt your operations. Are your air vents on the roof or at ground level? Many of these vents are in buildings built in the 1960’s, in the loading dock area where a badly positioned vehicle could introduce exhaust into the HVAC system. Are your ground-level air intakes monitored?

How quickly can you turn off your HVAC system in the event a foreign substance might be introduced to your system? Remember that question asked earlier about being near a railroad track, freeway or toxic manufacturing plant? If a toxic cloud were floating in the immediate area of your facility, how quickly could you turn off your HVAC system so the cloud is not sucked into the building? Before you say your HVAC system is automatically turned off when you sound the fire alarm, remember that audible fire alarm is also telling your employees and tenants to head outside into the toxic cloud when it might be safer to keep them inside your airtight building until the cloud disperses.

 

Levels of Response

Now that you created a balanced security program for your facility you have one additional concern. What will your security levels of response be? What we have described so far are the layers of security planned for your building on the average workday. What if your facility comes under some form of alert? The alert may come from some form of specific or general threat directed towards your building, company, tenant, area, city or country.

You need to develop a plan for additional layers of security in the event of such threats. It is important to pre-plan this higher level of security and have your staff pre-trained on the increased response. Don’t try to handle it on the fly. Will you add security staff? Will you shut down some access points? Will you increase access control? Will you start or increase package inspections? By having an increased security plan already in place with your staff trained in their new duties, when a threat comes around, you are ready.

 

As you can see, planning the security of your facility comes from using layers of organizational, mechanical and natural security. By using all these aspects of physical security, you can develop a physical security program that is both effective and COST effective.

As a physical security professional, you must know how what it takes to secure your workplace, for the safety of your coworkers, as well as for the security of the facility, this is accomplished with a proper physical security risk assessment. These days, companies need to address and prepare for security threats which are more substantial and diverse than any other time. With every technological advancement that enables innovative, effective business strategies, brings a security risk which is just as innovative and equally effective.
Every physical security risk assessment of a company security system must start with the specific security requirements along with the effects they are going to have on your business overall. You may want a facility secure enough for UL 2050 certification or perhaps you will simply have to ensure the staff safety before and after business working hours.

 

9 Tips for a Proper Physical Security Risk Assessment

.Effective Communication: Above all is communicating information to and between employees. A lot of companies utilize e-mail alerts to notify staff concerning would-be hackers. Likewise, make sure that staff remain informed on procedures and prospective site visitors. By letting staff understand what and who to be expecting, they will be better prepared to identify suspicious activities or people. So that you can prevent complacency, make sure to utilize a single way to obtain information that becomes a part of an employee’s habit. This can be a daily server broadcast or informational email. No matter what the source, it needs to be short, practical, and incorporate positive news along with precautionary information.

Key Control: Designate the commitment of locking or unlocking the workplace to as few people as is possible. Eliminating the “first in, last out” approach helps to ensure that all access points are properly secured on a regular basis. Develop a procedure for all those in charge of opening or closing your office which includes taking a look at washrooms, closets, and wherever an individual could possibly hide. Hard keys need to be numbered as well as assigned to specific people. staff assigned keys will need to be regularly be requested to produce their keys to validate against a master registry.

Site-Wide Policies: Something as fundamental as a “clean-desk” policy, training all employees to clear and secure their office desks of valuable equipment or information before departing for the day, significantly decreases potential theft. Mandating staff to possess and display ID badges or access cards all the time enhances the awareness of any unauthorized individuals. Don’t include things like job titles on any directory available to the public as a lot of criminals tend to use a name and title to validate their presence in restricted locations. Finally, be sure to maintain a “chain of possession.” All deliveries need to be given to a person rather then placed in a hallway or even on an unattended desk.

Check out this post on Risk Assessment Guidelines to better understand the process, if you need to.

Small Investments: All computers, laptops in particular, need to be properly secured with cable or plate locks to prevent “walk-off.” Docking stations are rather inexpensive ways to protect electronic devices while not being used. Take into consideration high risk targets such as state-of-the-art equipment, postage meters, check writers, and business checkbooks. Strengthen entry doors by installing peepholes as well as keypads. Implement 2 secured entry doors surrounding a small lobby or foyer. This sort of “airlock” method minimizes piggybacking; a technique intruders utilize to obtain entry by catching a locked door when an employee leaves.

Lights, Camera, Layout: Take note of “dark spots” either inside or outside the office. Put up ample lighting in parking lots and outdoor break areas for staff safety, prevent blind spots in stairwells, and organize hallways and offices to eliminate all areas in which an individual may conceal himself or stolen items. Lacking CCTV, highlighted below, it may be worthwhile to install recording security cameras at key areas like loading bays and access points like after-hours entrances.

Reception: Among the most complete solutions is to utilize one or more full-time receptionists. From a security process perspective, this person enables close examination of credentials and id and funnels security information by means of a single point. When it is impractical to have every site visitor greeted and checked-in by someone, look at a dedicated phone line in the lobby or at the front door that goes directly to a designated person. This process, along with a sign-in station, often is an economical strategy for a lot of offices.

Access Control System: Certainly one of the issues with hard keys is reacting whenever one is lost or stolen. With an access control system, businesses can easily issue access cards to staff while maintaining complete control over what each individual card can open. Additionally, access control systems reduce risk by permitting just enough access to accomplish a job. As a result, employees, contractors, or visitors will be restricted by area or time of day. A couple of things are important with access control systems. First, enable “total access” to as few people as is possible. This will directly clarify who is approved to be where and thereby enable staff to identify and report infractions. Second, maintain a record of the usage of every card. By reviewing card activity, it is possible to ascertain who requires having access to where and at which times, streamlining routines and defining access.

Closed Circuit Television (CCTV): For more advanced security system needs, CCTV is among the most effective method of protection. Using restricted broadcast, every camera is able to be monitored by means of a single user interface. Subject to the specifics of the system, footage may be monitored by a staff member or digitally recorded. Position cameras strategically to achieve the maximum coverage for a single unit. Additionally, cameras or corresponding signs which are visible to visitors and staff will be effective deterrents and create a secure environment. It is essential to keep in mind, however, that as effective as CCTV is, it must be utilized efficiently as well as in tandem with other preventive measures. As an example, installing a unit in an entry with an “airlock” door system enables extended recording of a person (s) entering or exiting the property.

Proper Training: Most of all, make sure that every one of your staff members is properly trained to utilize security equipment and follow procedures. Investment and planning in the ideal security system is going to have minimal effect if people are unclear on preventative measure and intervention. This can be as fundamental as ensuring staff keep doorways and windows secure or safeguard their personal belongings, but usually involves specific training on identifying and responding to suspicious items, persons, or events.

 

Hopefully you found these tips beneficial in conducting a physical security risk assessment of your facility and understanding the physical security needs of your location. Being able to clearly understand these tips and explain them to others for training or securing CAP-ex, is what will make you a successful physical security professional.

I am often asked, “Why should my company hire you as an independent security consultant?” The most significant reason is if you know little to nothing about security, then you need to hire an experienced professional security consultant that has the experience and subject matter expertise required for the tasks at hand. Security consciousness is a necessity for modern business managers. With this in mind, the selection of the security consultant(s) should also take into account their knowledge of the issues and conditions that are particularly relevant to the security threats that may affect your organization. A solid track record proving knowledge in these areas of specialized interest provides a benchmark that can be helpful when evaluating the subject matter experience of the prospective consultant(s).

 WHY HIRE AN INDEPENDENT SECURITY CONSULTANT

The first thing we need to do is define security.

Webster’s dictionary defines security as:

• the state of being protected or safe from harm
• things done to make people or places safe

 

Concerning security as a profession there is not truly a “universally accepted definition.”

Security is a hybrid profession blending various skills, backgrounds, and preparation. Security professionals have varying perspectives, often because of the unique degree of specialization required in their current assignment. Security provides those methods, either active or passive, which serve to protect and preserve an environment that allows for the conduct of activities within a business or society without disruption. There is a lot more than just looking at your doors, windows and locks or alarm systems to figuring out what security measures are needed to protect your synagogue, school, institution, or agency.

The primary goal of an independent security consultant is to prevent loss of life by reviewing your liabilities on security issues and reducing or eliminating them. Planning is required since it is an approach that recommends identifying and stopping a problem before it occurs, reducing hazards in given situations, and of forecasting rather than reacting to circumstances.

Competent security consultants know what to look for when identifying security issues and know how to properly mitigate the conditions through cost effective reductions/eliminations. After careful evaluation, it may make sense to use a security consultant to get the best security/cost value proposition you can; think of the expense as an investment for the future.

Before you hire a security consultant, make sure you know how to vet them, tips here.

An Independent Security Consultant can help you with the following issues:

• Negligent Hiring/Retention
• Premises Liability
• Negligent Security
• Hiring Contract Security Services
• Physical Site Security Surveys
• Anti-Terrorism
• Fraud and Internal Thefts
• Disaster recovery
• Risk Analysis
• Crime Prevention

Along with so much more.

 

Written security policies are essential to a secure organization. Everyone in a company needs to understand the importance of the role they play in maintaining security. One way to accomplish this – to create a “security culture” – is to publish reasonable security policies. These security policies are documents that everyone in the organization should read and sign when they come on board. In the case of existing employees, the policies should be distributed, explained and – after adequate time for questions and discussions – signed.

This article will introduce you to seven security policies that every organization should consider adopting. The specific policies that you implement, as well as the amount of detail they contain, will change as a company grows. Certainly, an organization with two employees has different security concerns than an organization of thousands. This list addresses both physical and information security issues, and is meant to provide a starting point for assessing your particular security needs, when establishing your security policy.

7 Security Polices Every Company Needs

Internet Usage

Below are some guidelines that a business should be thinking of using when they are looking to set up any kinds of policies in relation to the use of the internet during business hours.

General Internet  Usage:

• Internet usage is intended for job-related activities. Occasional brief personal use is allowed within reasonable limits
• The Company reserves the right to monitor internet traffic and retrieve any data that is composed, transmitted, or received and, as such, is subject to disclosure to law enforcement or other third parties
• Team members cannot pirate software, or download/copy software without authorization
• Team members should always ensure that the business information contained in internet email messages and transmissions is accurate, appropriate, ethical, and lawful

However if you are a company that is allowing all their employees to have access to the internet then rules and regulations must be in place that will restrict the amount of time that they use it for their own personal use. So therefore when writing up any kind of company internet usage policy document it should clearly shown within it when employees are entitled to use the internet for personal searches and when for company work. To ensure that your employees are sticking to the guidelines provided then a good quality tracking software program should be installed. This will then help you to track when and what your employees are using the internet for. However again employees must be made aware that their use of the internet is being tracked.

 Check Out: Physical Security Program – know the process

Email

What kind of subjects should you cover in the email section of your security policies? Here is a list of ten points to include:

• Email risks: The policy should list email risks to make users aware of the potential harmful effects of their actions. Advise users that sending an email is like sending a postcard: if you don’t want it posted on a bulletin board, then don’t send it.
• Best practices: This should include email etiquette and writing rules in order to uphold the good reputation of the company and to deliver quality customer service. For instance, include 6 etiquette rules:
  • Do not write emails in capitals,
  • Enable spell checking,
  • Read the email before you send it,
  • Include a signature that conforms to company format,
  • Use proper grammar and punctuation,
  • Include instructions on compressing attachments to save bandwidth.
• Personal usage: The policy should state whether personal emails are accepted and if so, to what extent. You can for instance set limits on the times of day that personal emails can be sent (only during breaks), or you could require personal emails to be saved in a separate folder. In addition, state that employees are prohibited from sending or receiving certain email attachments, such as exe, mp3 or vbs files. You could also include a maximum file size for attachments sent via email.
• Wastage of resources: Warn users that they are making use of the company’s email system and that they should not engage in non-business activities that unnecessarily tie up network traffic. The policy must also cover the use of newsletters & newsgroups. For instance you can state that employees may only subscribe to a newsletter or newsgroup if this directly relates to their job.
• Prohibited content: The policy should expressly state that the email system is not to be used for the creation or distribution of any offensive, or disruptive messages, including messages containing offensive comments about race, gender, age, sexual orientation, pornography, religious or political beliefs, national origin or disability. State that employees who receive any emails with this content should report the matter to their supervisor immediately. Moreover, employees should not use email to discuss competitors, potential acquisitions or mergers or to give their opinion about another firm. Unlawful messages, such as copyright infringing emails should also be prohibited.
• Document retention policy: Include information on whether or not email will be archived and for how long. If your organization is required to archive email messages, state that all emails will be archived and include the number of years that the records will be kept. If you are not required to archive your emails, notify your users about whether they can or should delete emails after a number of months or years.
• Treatment of confidential data: Include rules and guidelines on how employees should deal with your company’s confidential information and trade secrets. They should also be aware that they should not forward any confidential messages or attachments from other companies without permission. Make employees encrypt any confidential information that is sent via email and change passwords regularly.
• Email disclaimer: If you are adding a disclaimer to employees’ emails, you should inform them of this and state the disclaimer text that is added.
• Email monitoring: If you are going to monitor your employees’ emails, you must state this in your email policy. Warn that employees should have no expectation of privacy in anything they create, store, send or receive on the company’s computer system and that the company may, but is not obliged to monitor messages without prior notice. If you do not mention that the company is not obliged to monitor messages, an employee could potentially sue the company for failing to block a particular message.
• Measures & violation reporting: Warn that if an employee is found to be in breach of the email policy rules, this could result in disciplinary action, up to and including termination. If an employee witnesses email policy abuse they are required to report the incident immediately. Include contact details of who to contact if a violation of the policy rules is detected. This could be a supervisor but it might also be a good idea to appoint a specific contact person to report email policy breaches to.

 

Social Networking

While you might not have a large staff now, it is a good idea to put an online networking policy into your security policies as soon as possible. Make sure that everyone is aware of the social networking policy when they are first hired. Here are some things to consider when you are coming up with the social media policy for your company.

Social Media Presence:

• Remember to act respectfully at all times when interacting on social media platforms
• Confidential company information should be kept off social media
• Team members should follow company guidelines for how to talk about products (or services) to keep with brand image
• Should team members see negative content regarding the company on social media, they are to follow the set engagement procedures in order to react properly
• Be sure to create a secure password and avoid default privacy and security settings for personal social media pages

• What your employees are allowed to say about the company.
  • I am not suggesting that you totally censor your employees. However, you do have a certain public image to uphold. You have to decide early on what you are going to allow your employees to say about the company on social networking sites. This is definitely something that needs to be outlined in the handbook you create about your company’s social media policy.
• Is there a particular point person to send media requests to?
  • Your employees may run into members of the media while they are networking. The journalist may want to ask them some questions about your company. You have to decide if you want your employees to be able to answer those types of questions themselves or if you want one employee to be the designated spokesperson for the company. Whatever you decide, make sure to communicate this to all staff so there is no confusion.
• What employees are allowed to post on online networking sites.
  • Once again this is a matter of protecting your company image. Your employees are a representative of you. You need to figure out what kind of information you want your employees to post on social media. Are they allowed to reveal your company name on their personal profiles? Can they post pictures of themselves at work? Is it okay for them to post pictures of themselves drinking alcohol? These might seem trivial, but it is important to let your employees know beforehand what they can post rather than trying to discipline them when they cause bad publicity for the company.

Having a social media policy is important for you and your employees. It helps your employees to know exactly what they can and can’t do with their social media profiles. It could also protect you from future lawsuits since the policy will be spelled out in black and white. Now stop reading this article and create a social media policy for your company.

 Check Out: Layered Security

Access Control

You need to have an access control procedure, not just for visitors, venders, and guests, but also for employees, as not every employee needs access to every area. Ask these questions when developing an access control procedure for your security policies:

• Do they have a need to be there? If an employee’s job does not require them to be in an area, clearly state that area is off limits, or set a physical control like key or electronic access to ensure it is enforced.
• Will they need to be there escorted? A good rule of thumb is to clearly state areas like an HR office are restricted access, and only select personnel are authorized access unless escorted by select personnel, other offices and areas may need the same type of policy.

Check Out: How Do Your Alarms Communicate

Mobile Device Security

When you issue company business mobiles you are faced with many pros and cons, one of which is convenience and productivity while the other drawback is how to restrain mobile phone use as you keep your company liabilities at a minimum.

Here are some ways you can create security policies with respect to the use of company issued handsets:

Dispel privacy breach concerns with your company issued mobile phones. Make it a point to inform your employees that they do not have to fear their privacy being breached with the issuance of company mobiles. By doing this, you eliminate the probability of other problems or lawsuits from arising in the workplace.

Be sure that you own the phone numbers issued. It is very vital that you keep ownership of the phone numbers. You have to be clear with this in your policy. It is because you want to limit the likelihood of a leaving employee from further soliciting or doing business with your customers once they are gone.

Check monthly charges from time to time. The moment your employees know that their bills are being checked on a regular basis, they are less likely to incur unexplained surcharges or other unnecessary charges like for instance the purchase of unauthorized 3rd party content such as apps, ring tones, or even mobile games.

Report lost or damaged devices as soon as possible. The instant a company mobile device has been lost, damaged, or stolen, tell employees to report them immediately so all related services will be turned off the soonest time possible. There are some mobile apps that enable users to remotely track a mobile phone’s SIM card and delete all private data once lost or stolen. Expressly indicate who will shoulder the costs in case of loss or damaged business mobile phones. If it’s the employee who will have to bear the financial burden, then by all means let them know and have them sign up an acknowledgement agreement to that effect.

Inform them about GPS tracking. There are several mobile phones out there that come with software that does not only allow GPS navigation but also tracks the bearer. You have to expressly let them know that their business mobiles will come with a GPS tracking feature. Businesses in the field of logistics highly benefit from this practice.

 

Visitor Management and Safety

An unauthorized or unescorted visitor can be a physical threat and can also steal sensitive information. If possible, steer all visitors into a controlled entry point, be it a gate or receptionist’s desk. When writing your policy, decide whether visitors should be escorted at all times, or only in certain areas. Requiring visitors to wear a badge and sign in and out should also be considered. If your visitor management policy is communicated clearly, employees can more easily serve as your eyes and ears as they will feel more comfortable approaching or reporting a suspicious individual.

It would be wise then to craft a safety policy for visitors along the same lines as employers do for workplaces.

1 – Visitors must be notified of any hazards they might encounter.
2 – They must be made aware of all protocols and procedures in the event of an emergency.
3 – All visitors must sign-in and sign-out of your facility.
4 – Similar to all workplaces, must be provided with the appropriate personal protective equipment (PPE) and on its use and reason for it.
5 – Care must be taken to ensure proper fit and use of the PPE.
6 – Visitors must be oriented properly and advised on the basics of behavior during the visit.

Non-Disclosure Agreement

What is a Nondisclosure Agreement?

Fortunately, the United States legal system has several safeguards to protect intellectual property rights. One of these is the nondisclosure agreement (NDA), also known as a “confidentiality agreement.” This is a signed agreement between two or more parties which states they will keep confidential specific information shared during their business relationship, or in the course of a transaction. In the business world, an idea, formula, or process can be a company’s most important asset. The NDA ensures that a company or individual retains exclusive rights to their intellectual property. When you hire a company to manufacture your plush toy, an NDA gives you the assurance that your ideas (and profits) remain yours and legal recourse if it does not.

Types of NDA

There are two kinds of NDA. With a one-way NDA, only one of the parties is disclosing information. If you are hiring a company to produce your plush toy, but that company will not be sharing proprietary information (such as a secret method of stitching) with you, you may only need a one-way NDA. A mutual NDA is necessary when everyone involved in the process is sharing private information. If you sell a new manufacturing process to a soft drink company which shares a secret formula with you, you’ll both want a mutual nondisclosure agreement.

Contents of an NDA

A good NDA contains:

o Definitions of the shared information. For example, yours might include “the design for Skippy the Cat,” without describing the confidential information itself.

o Exclusions. Not all information needs to be confidential. This protects the recipient, in the event that it possesses or discovers information independently of its relationship with you.

o Recipient’s Responsibilities. Shared secret information must remain secret. Neither party can share it or use devious ways to steal it.

o Time Limit. Although you might want your idea to remain secret forever, this is not always going to be the case.

o Miscellaneous Clauses. These are various legal details, such as how a breach will be handled, who will pay attorney fees in the event of a lawsuit, etc.

BONUS: Workstation Security

Physical:

• Ensure monitors are positioned away from public view
• Use screen privacy filters for added security (especially in open floorplan offices)
• Always lock computer (and protect with a password) when stepping away from your desk
• Log off workstation at the end of each business day
• Keep food and drink away from your workstation at all times
• When taking your laptop or other company owned devices out of the office, be sure to keep them in your trunk
  and out of plain sight

Operational:

• Only approved personnel may install software on workstations
• All sensitive information must be stored on network servers and not the workstation itself
• Follow all authentication and password management requirements

 

Conclusion

One key to creating effective policies is to make sure that they are clear, and as easy to comply with as possible. Policies that are overly complicated only encourage people to bypass the system. Don’t make employees feel like inmates. Communicate the need, and you can create a culture of security.

There is always a trade-off between security and convenience. You would like to board a plane without going through the TSA checkpoint, right? But how comfortable would you be knowing that no one else on the plane had gone through security either? The policies described in this article will help to ensure that you and your employees are protected.

For help in developing security policies to protect your organization and its employees, Contact me, I am available for assist you in your security policy development, or any other security needs you may have..