The Company Security Policy and Why It Exists

When you start a new job, you are often asked to read and sign a document called the "IT charter" or "security policy", and most people skim it. Yet that document explains how your organization protects its customers, its employees and its future, and your role in it. In this lesson you will learn why companies have security policies, what they typically contain, and how to follow them without feeling that they get in the way.

Until now, you have been protecting your own life. At work, the situation changes in an important way: your actions affect other people. A careless click on your computer can expose colleagues, customers and the whole business. That is why employers turn good habits into shared rules.

Why organizations are targeted

Organizations of every size are attractive to attackers. They hold money, customer data and valuable information, and they have many people and systems, which means many possible entry points. Small businesses are not left alone: attackers often assume they are less protected, and use them as a stepping stone to bigger partners and suppliers.

Employees are, in many incidents, the point of entry, not because they are careless, but because they are the people who receive the emails, use the accounts and make the payments. This also means that employees are the most effective defense, when they know what to do.

What is a security policy?

A security policy is a set of written rules and guidelines that define how an organization protects its information and systems. It answers practical questions:

• What information is sensitive, and how must it be handled?
• Who may access what?
• Which devices and software may be used?
• How should passwords, email and the internet be used?
• What to do if something goes wrong?

It comes in several layers. A high-level policy sets the principles and responsibilities. Procedures describe step by step how to do specific tasks. Guidelines and charters, such as the acceptable use policy that employees sign, translate this into daily rules. In larger organizations, a security manager, often called a CISO or in French an RSSI (responsable de la sécurité des systèmes d'information), leads this work.

Where the rules come from

Policies are not invented from nothing. They are shaped by:

• Laws and regulations: data protection (such as the GDPR you met in Chapter 5), sector rules for health, finance or critical infrastructure, and obligations to report certain incidents.
• Contracts: customers and partners often require security measures in their agreements.
• Standards and frameworks: widely recognized references such as the guidance from the US National Institute of Standards and Technology (nist.gov), international standards on information security management, and the guides from the French national agency ANSSI (cyber.gouv.fr).
• The company's own risks: what it holds, what would hurt most, and what has already gone wrong.

When a rule feels annoying, there is usually a reason behind it: a law, a customer requirement, or a past incident.

What a typical policy asks of you

Although each organization is different, you will recognize most of the following from earlier chapters:

• Passwords and authentication: unique passphrases, a password manager approved by the company, two-factor authentication, and never sharing credentials, even with colleagues or IT staff.
• Email and internet use: caution with links and attachments, rules for personal use, and how to report suspicious messages.
• Devices: automatic updates, screen locks, disk encryption, approved software only, and keeping work devices for work purposes.
• Data classification: a labeling system, such as public, internal, confidential and secret, that tells you how to store, share and dispose of information.
• Clean desk and clean screen: not leaving confidential papers or open screens in view of others, and locking the computer when you step away.
• Physical security: badges, visitors, and not letting unknown people follow you through a secure door.
• Removable media: rules for USB sticks and external drives.
• Cloud and sharing tools: using approved services only, and not sending confidential files to personal accounts.
• Incident reporting: whom to tell, quickly, when something seems wrong. We will cover this in lesson 6.4.

Shadow IT: the quiet risk

Shadow IT means using tools that the organization has not approved: a personal cloud account to share files, a free online converter for a confidential document, an unapproved messaging app for work discussions, or pasting client data into an online tool you do not know. These choices are usually made to get work done faster, with good intentions. But they move company data outside of its protections, where nobody controls how it is stored, who can see it, or whether it can be recovered.

The same applies to new automated assistants and generative tools. Before putting company or customer information into any external tool, check what your organization allows. If a tool you need does not exist in the approved list, ask for it; do not work around the rule.

Why rules should make sense to you

Good policies are written for people, and people ignore rules that block their work without explanation. If a rule seems unreasonable or impractical, you can say so. That feedback is valuable, since a rule that everyone bypasses is worse than no rule. Security that employees understand and accept is far stronger than security imposed on them.

Likewise, a healthy security culture is blame-free about honest mistakes. If employees fear punishment for reporting that they clicked a bad link, they will hide it, and a small incident becomes a disaster. Reporting early should be rewarded and thanked.

Training and awareness

Many organizations run awareness sessions and simulated phishing campaigns, which send fake phishing messages to employees to measure and teach. These are not traps designed to punish you, but exercises to practice. If you fall for one, treat it as free training and use the reporting button next time.

Policies and your personal life

Your job may also affect how you act outside of work. Keep in mind that:

• What you share on social networks about your employer, your projects or your colleagues can help attackers (lesson 4.4) and may be covered by confidentiality obligations.
• Work accounts and personal accounts should have different passwords and different recovery methods.
• Your work email address should not be used to sign up to personal services.

Your turn

Exercise. Imagine you work in a small accounting firm. A colleague suggests sending a client's spreadsheet to a private email address "to finish it at home", since the VPN is slow. List the risks, and propose a compliant alternative.

See a solution

1. Risks: client data leaves the company's protections and ends up in a personal mailbox with unknown security; it may be forgotten there indefinitely; a breach of the personal account would expose the client data; it may violate confidentiality and data protection obligations, and the firm may not even be able to detect it.
2. Compliant alternatives: use the approved remote access, or the approved file sharing tool, even if it is slower; ask IT to fix the performance issue; finish the work during office hours or on a company laptop; if the delay is critical, ask the manager for an exception.
3. Reflex: say politely that you prefer to follow the policy, and tell IT about the difficulty, since a workaround may be needed for everyone.

Add to your Security Notebook

Create the heading "6. Security at work". Write the name of your organization's security contact, the three rules you find most important in its policy, and one tool or habit that you currently use that might be shadow IT, to check with your IT team.

Rules are easiest to follow in the office. In the next lesson we look at what changes when your workplace is your kitchen table.