What is a "Failure to Implement"?

Friday, April 30, 2010

Katie Weaver-Johnson


Recently, Awareity’s CEO, Rick Shaw, was asked to present at the Infotec conference in Omaha.   During his presentation, “The Truths (and Myths) About Assessments, Planning and Implementing”, Rick discussed the three-legged stool each organization is sitting on, and the importance of all three legs (Assessments, Planning/Developing and Implementing).

Most organizations understand the importance of assessments and planning, but where many fail to deliver is in the implementation phase.   As we have seen with numerous headlines and lessons learned, a failure to implement can lead to expensive fines, lawsuits, breaches and losses.  Rick used a case study for CVS Caremark.   Due to employees carelessly tossing old pill bottles into a store’s dumpster, CVS now has the FTC coming to audit their information security program for the next 20 years and was forced to pay a HIPAA violation fine of $2.25 M.

The  FTC Complaint Docket No. C-4259 read:

 “Among other things, respondent failed to: 1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal.”

During the presentation, one woman raised her hand and asked, “What do you mean by “implement”?  How do you “implement” your policies and procedures once they are created?”

I thought this was a great question and one that should be expanded upon.

An organization can have the best security policy (or plan, program, etc.) in the world, but if the policy is not implemented down to the individual-level, how will individuals be able to help the organization achieve better results?

If your organization is just blasting your security policies out to your people in e-mails and memos…how do you know if anyone received the email or is reading the policies and understands them? Or perhaps you are sending out updated pages for the employee handbooks or manuals…how can you ensure your employees are actually reading these policies?  Are the binders just sitting on a shelf untouched?

Implementing policies, procedures, plans and processes means organizations have documentation and proof that individuals have read, understood and acknowledged their roles and responsibilities.  Regulations require proof of implementation.  Legal due diligence requires proof of implementation.  Lessons Learned continue to prove that organizations that lack implementation will continue to experience expensive and embarrassing results.

Organizations must ensure all appropriate individuals (employees, third-parties, etc.) are receiving updated policies and guidelines, reading the policies, understanding the policies, and acknowledging their individual roles and responsibilities.   Providing employees with a once-a-year general training session is not good enough as we know risks, threats, best practices, etc. are constantly changing.  The bad guys are not taking 364 days off, is your organization?

Budgets Enterprise Security Security Awareness Security Training
Post Rating I Like this!
Anthony M. Freed I think a lot of companies fall into the category of "failing to implement" by assuming their employees are actually paying attention to and then following policy. Even companies that followup with their employees regarding policies and their implementation, often times do not 'police' the policies implementation by tracking their 'employees implementation procedures'. Just because an employee receives training, signs a document, or says they understand policy does not mean their daily procedures follow policy.
Sandra Avery Great points. What about accountability? Organizations need to follow up and make sure that policies are being followed and hold employees accountable for non-compliance. Many times employees know that there is no actual enforcement or consequences associated with company policies.
Katie Weaver-Johnson Sandra,

You are absolutely right, accountability is critical and organizations must ensure policies are being followed and hold employees accountable for non-compliance by disabling access rights, witholding pay, penalties, etc. Once employees understand there are serious consequences for failing to comply with organizational policies and procedures, awareness and accountability will follow.

The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.