As a document that helps to monitor and review IT processes, it also provides guidelines for users.
In place to protect employees and businesses by setting out rules and procedures of IT within the organisation, there are also legal, regulatory and statutory reasons behind the requirement for every business to create an IT policy.
So here’s how we’d recommend putting one together.
3 Steps to Create an IT Policy
1. Understand its purpose
Sure, some businesses may prefer to have the policy of ‘common sense’ in place, but if an issue arises because of usage that, in hindsight, wasn’t appropriate, what ramifications will be in place?
And if you have set up IT risk management for your organisation, then an IT policy is a natural component of mitigating potential threats to your business’s data and information.
Try to cover these six key elements:
- Acceptable use of technology – guidelines around use
- Cyber Security – guidelines around how to ensure personal and business data/information is always secure
- Disaster recovery – procedures on how this will role out in the event of a disaster
- Technology standards – what software/hardware can and can’t be used
- Network set up and documentation – guidelines around how employees are to use the network and what level of access they are provided with
- IT services – information surrounding the service management of IT (ideally linked to already established framework)
2. Set clear guidelines for users
You don’t want to confuse your employees with too many rules around what they can and can’t do when it comes to using technology in the work environment, particularly when IT is so ingrained in our day-to-day lives now.
So be clear and concise about expectations – there’s no point in creating a headache for everyone involved.
It’s also worth noting that a report released by Deloitte and Google, showed that being more flexible with your IT policy can actually provide big rewards for businesses.
With an increase in employment relations issues around the use of Internet and email, the Government’s employment website has this example of what an Internet and email policy could look like (scroll down to 11.4).
3. Be open and honest
When it comes to putting together an IT policy, it’s best to be open and honest about why you have certain guidelines in place. You certainly don’t want to create an atmosphere of ‘big brother is always watching’ as it doesn’t tend to foster a positive environment for employees.
So if you provide a particular guideline to reduce risk for your business – explain why it is in place, as you’ll find there will be a greater level of compliance.
This blog post is a condensed version of an article in our latest eBook. Keen on further knowledge on how to manage IT in your business? Download: An essential guide to IT for SME business – Risk, Security and Productivity
