Email policies: critical for continuity and security
This year should see businesses reviewing and updating their email management policies in line with recommendations in the Lord Chancellor’s Code of Practice on Records Management. But according to Icomm’s Ian Callens there is still a large number of SMEs across the Midlands failing to meet the necessary requirements.
The Code of Practice is an element of the Data Protection Act of 1998 and was passed by Government to control and regulate the increasing use of email in day-to-day business. As part of this act businesses had to review their email management policy at least once every three years.
Callens says it is critical for SMEs to fall in line with the government legislation:
"Due to the nature of email as a business-critical tool, legislation is there to govern the security, storage and retrieval of emails, with fines and market de-listings likely consequences of non-compliance."
One of the most effective solutions SMEs can put into place is an email "acceptable use policy" (AUP), which when comprehensive, transparent and enforceable, can pay dividends for SME business continuity.
The need for SMEs in the midlands to meet these requirements is even greater than before. With recent data leakage stories hitting the headlines from major governmental departments any SME found to be actively non-compliant with the code of practice could face the scrutiny of local authorities and more importantly – clients.
It is common for employees to expect a certain level of personal email use in the workplace despite them being an information risk for business. Excessive and inappropriate use of personal email in the workplace can put a strain on bandwidth and storage archives which may impact on an SME’s ability to use its email infrastructure efficiently. But banning employees from sending or receiving emails is unrealistic despite their threat to security and company data according to Callens:
"SMEs can instead set clear boundaries within employee’s contracts or better still through a well-articulated AUP. The boundaries should clearly outline reasonable, excessive or inappropriate use whilst also taking into account core security issues such as compliance, safe working environments, data leakage and asset abuse."
A clear AUP leaves no margin for error or compromise and protects business continuity. It should take into account the areas of necessity should a regulator wish to see the policy in place and in practice.
According to Callens:
"A well expressed AUP should take into consideration the seriousness of commercial information being placed in unauthorized hands through employees accidentally sending emails containing sensitive information relating to an SME or clients. An AUP can outline what level of information is acceptable for distributed emails."
The message to SMEs is clear: an AUP should also preserve the integrity of the email system and prolong the life of its storage solutions as well as reduce the time spent cleaning personal emails from the system. It will also protect business continuity.
If you require any more information please contact us on 0121 248 7931.
2008.10.10 (LM)
