Protecting employees and members of the public who visit your facility is a complex and challenging responsibility. Many forget this important step to network security, even though it should be one of your company’s top priorities. Here we'll discuss 6 NECESSARY steps to ensure your facility is secure and our employees are protected (plus offer you a cyber freebie below).
#1. Recognize the importance of securing your company facilities.
The physical security of a facility depends on a number of security decisions that can be identified through a comprehensive risk-management process. The objective of risk management is to identify an achievable level of protection for your company that corresponds as closely as possible to the level of risk without exceeding the risk.
It is easy to think about physical security of your company’s facility as merely an exercise in maintaining control of access points and ensuring there is complete visibility in areas that are determined to be of high-risk – either because of the threat of easy public access or because of the value of information located nearby. However, maintaining security of your company’s facility also includes the physical environment of public spaces.
For Instance: Employees whose computers have access to sensitive information should not have their computer monitors oriented toward publicly accessible spaces such as reception areas, check-in desks and waiting rooms. Employees should be trained to not write out logins and passwords on small pieces of paper affixed to computer equipment viewable in public spaces.
#2. Minimize and safeguard printed materials with sensitive information.
Probably the most effective way to minimize the risk of losing control of sensitive information from printed materials is to minimize the amount of printed materials that contain sensitive information. Management procedures should limit how many instances and copies of printed reports memoranda and other material containing personally identifiable information exist.
Safeguard copies of material containing sensitive information by providing employees with locking file cabinets or safes. Make it a standard operating procedure to lock up important information. Train employees to understand that simply leaving the wrong printed material on a desk, in view of the general public, can result in consequences that impact the entire company and your customers.
#3. Ensure mail security.
Your mail center can introduce a wide range of potential threats to your business. Your center’s screening and handling processes must be able to identify threats and hoaxes and eliminate or mitigate the risk they pose to facilities, employees and daily operations. Your company should ensure that mail managers understand the range of screening procedures and evaluate them in terms of your specific operational requirements.
#4. Dispose of trash securely.
Too often, sensitive information – including customers’ personally identifiable information, business financial and other data, and company system access information – is available for anyone to find in the trash. Invest in business-grade shredders and buy enough of them to make it convenient for employees. Alternatively, subscribe to a trusted shredding company that will provide locked containers for storage until documents are shredded. Develop standard procedures and employee training programs to ensure that everyone in your company is aware of what types of information need to be shredded.
#5. Dispose electronic equipment securely.
Be aware that emptying the recycle bin on your desktop or deleting documents from folders on your computer or other electronic device may not delete information forever. Those with advanced computer skills can still access your information even after you think you’ve destroyed it. Disposing of electronic equipment requires skilled specialists in order to ensure the security of sensitive information contained within that equipment.
If outside help, such as an experienced electronic equipment recycler and data security vendor, is not available or too expensive, you should at a minimum remove computer hard drives and have them shredded. Also, be mindful of risks with other types of equipment associated with computer equipment, including CDs and thumb drives.
#6. Train your employees in facility security procedures.
A security breach of customer information or a breach of internal company information can result in a public loss of confidence in your company and can be as devastating for your business as a natural disaster. In order to address such risks, you must devote your time, attention and resources (including employee training time) to the potential vulnerabilities in your business environment and the procedures and practices that must be a standard part of each employee’s workday.
And while formal training is important to maintaining security, the daily procedures you establish in both the normal conduct of business and in the way you model good security behaviors and practices are equally important. In short, security training should be stressed as critical and reinforced via daily procedures and leadership modeling.
Download this FREE “Top 20” Cyber Security Audit Checklist” ebook for professional firms and small businesses who want to protect themselves from all known cyber threats.
