Cybercriminals have realized that smaller organizations are much less likely to have well-designed cybersecurity policies in place than large enterprises with dedicated security teams, making it easier for them to breach their networks and obtain access to sensitive data.
The good news is that implementing the essential policies described in detail in our eBook, titled 6 Critical Cybersecurity Policies Every Organization Must Have, is neither difficult nor expensive. This article provides a brief overview and list of cybersecurity policies small and medium-sized businesses should have, and we encourage you to read our eBook for more information and cybersecurity policy examples.
1. Acceptable Use Policy
An acceptable use policy addresses the fact that human error is the main cause of 95 percent (or 19 out of 20) of cybersecurity breaches by describing what employees can and can’t do when using the organization’s IT equipment or accessing its network over the internet.
Because acceptable use policies are intended to be read in full by each employee, they should be as concise as possible, only a few pages long at most. For increased readability, it’s a good idea to take advantage of bullet points and numbered lists to stress the most important information.
Some of the key elements that no acceptable use policy should leave out are basic data security practices, such as the prohibition of sharing passwords via email and general restrictions covering various illegal activities.
2. Security Awareness Training
With increasingly more organizations actively encouraging employees to bring their own personal devices to the workplace and continue using them for work-related purposes at home, security is now everyone’s responsibility.
A security awareness training policy establishes the requirements for employees to complete security training programs in order to learn how to protect important data and systems against cyber threats. Cybercrime surveys, such as the one published in 2014 by Carnegie Mellon University, confirm that organizations with a security awareness training policy in place lose considerably less money to cybercrime than organizations without one.
To deliver the biggest positive impact possible, security awareness training should encompass not just new hires but also existing employees who have been with the organization for some time. Simulated cyber attacks can then be used to reveal security gaps and provide employees with valuable practical experience.
Download
DoD Contractor’s Guide to CMMC 2.0 Compliance
3. Identity Management Policy
The recent remote working explosion has highlighted the importance of having a strong identity management policy. The purpose of this policy is to grant the right users access to the right information and systems in the right context. When employees are authorized to access only the information and systems they actually need, their cybersecurity mistakes have much less serious consequences.
An identity management policy should cover not only authentication mechanisms but also password provisioning and employee offboarding. An entire section is typically dedicated to password requirements to ensure that all passwords are adequately strong and unique.
For example, an organization may require its employees to create passwords that are at least eight characters long and contain at least one uppercase, one lowercase letter, and one numeric character. The use of multi-factor authentication is another common requirement found in many identity management policies.
4. Disaster Recovery & Business Continuity
Disaster recovery and business continuity are two closely linked practices whose purpose is to prepare an organization for disruptive events, helping it resume operation as quickly and painlessly as possible. Besides cyber attacks, disruptive events also include internal emergencies such as loss of power and external emergencies such as floods and storms.
This policy is critically important because most organizations that fail to quickly recover from a disaster never open their doors again. That’s because downtime can cost an SMB $8,000 to $74,000 per hour, according to Ponemon Institute.
The content of a disaster recovery and business continuity policy should always reflect the unique business processes and IT resources of each organization, which is why performing a disaster recovery business impact analysis is a good first step. Once created, the policy should be thoroughly tested to verify that it fulfills its intended purpose.
5. Incident Response
Knowing that it’s only a matter of time before a small business gets in the crosshairs of cybercriminals, it’s paramount to establish an incident response policy and describe the processes and procedures necessary to detect, respond to, and recover from cybersecurity incidents.
Because all organizations deal with different cyber threats, their incident response policies must be created to reflect their unique needs while addressing the six key phases of an incident, as defined by the SANS Institute: preparation, identification, containment, eradication, recovery, and lessons learned.
An incident response policy should always be flexible enough to reflect the fact that cybercriminals are constantly evolving their tactics and coming up with increasingly sophisticated ways of breaching defenses. Last but not least, an incident response policy can be relied on only if it’s tested beforehand by simulating common types of security incidents.
6. Patch & Maintenance
According to data published by the Ponemon Institute, 57 percent of all data breaches can be directly attributed to attackers exploiting an unpatched vulnerability. The number is so high because many organizations have yet to create a patch & maintenance policy.
A patch & maintenance policy specifies who is responsible for the discovery, installation, and testing of software patches and describes the conditions under which they are applied. It ensures that the right patches are applied at the right time by the right people.
For a patch & maintenance policy to be effective, it needs to encompass all IT assets that cybercriminals could exploit to infiltrate the target organization, including laptops, desktop computers, mobile devices, point-of-sale systems, servers, networking equipment, and all software running on these and other devices.
Conclusion
Small and medium-sized organizations can no longer expect to fly under the radar of cybercriminals. To avoid costly data breaches, they must implement essential cybersecurity policies and adhere to them at all times.
To learn more about the six policies described in this article, download our eBook, which describes each policy in much greater detail, explaining their importance and providing practical advice on their creation and implementation. And for more information, contact the professionals at OSIbeyond in Washington D.C., Maryland, and Virginia to discuss your business’s cyber security.