|
What is a “Failure to Implement”?
April 30, 2010
Katie Weaver, Awareity
Recently, Awareity’s CEO, Rick Shaw, was asked to present at the Infotec conference in Omaha. During his presentation, “The Truths (and Myths) About Assessments, Planning and Implementing”, Rick discussed the three-legged stool each organization is sitting on, and the importance of all three legs (Assessments, Planning/Developing and Implementing).
Most organizations understand the importance of assessments and planning, but where many fail to deliver is in the implementation phase. As we have seen with numerous headlines and lessons learned, a failure to implement can lead to expensive fines, lawsuits, breaches and losses. Rick used a case study for CVS Caremark. Due to employees carelessly tossing old pill bottles into a store’s dumpster, CVS now has the FTC coming to audit their information security program for the next 20 years and was forced to pay a HIPAA violation fine of $2.25 M.
The FTC Complaint Docket No. C-4259 read:
“Among other things, respondent failed to: 1) implement policies and procedures to dispose securely of such information, including, but not limited to, policies and procedures to render the information unreadable in the course of disposal.”
During the presentation, one woman raised her hand and asked, “What do you mean by “implement”? How do you “implement” your policies and procedures once they are created?”
I thought this was a great question and one that should be expanded upon.
An organization can have the best security policy (or plan, program, etc.) in the world, but if the policy is not implemented down to the individual-level, how will individuals be able to help the organization achieve better results?
If your organization is just blasting your security policies out to your people in e-mails and memos…how do you know if anyone received the email or is reading the policies and understands them? Or perhaps you are sending out updated pages for the employee handbooks or manuals…how can you ensure your employees are actually reading these policies? Are the binders just sitting on a shelf untouched?
Implementing policies, procedures, plans and processes means organizations have documentation and proof that individuals have read, understood and acknowledged their roles and responsibilities. Regulations require proof of implementation. Legal due diligence requires proof of implementation. Lessons Learned continue to prove that organizations that lack implementation will continue to experience expensive and embarrassing results.
Organizations must ensure all appropriate individuals (employees, third-parties, etc.) are receiving updated policies and guidelines, reading the policies, understanding the policies, and acknowledging their individual roles and responsibilities. Providing employees with a once-a-year general training session is not good enough as we know risks, threats, best practices, etc. are constantly changing. The bad guys are not taking 364 days off, is your organization?
About Awareity
Awareity is a privately held organization founded in 2002. Awareity's innovative e-Management solutions empower organizations to 'connect the dots' and offer a unique focus on implementing lessons learned across several critical areas of business – compliance, information assurance, public safety, emergency management, enterprise risk management and reputation management.
Awareity’s solutions are helping organizations across multiple industries - education, financial, government, healthcare and other critical industries – to achieve better results by ensuring lessons learned become lessons implemented and the right information is shared with the right people in the right place at the right time with accountability and auditability at the individual-level. Awareity's solutions simplify complex challenges, reduce current and ongoing costs and improve efficiencies as obligations continue to mount and budgets and resources are limited.
Better Awareness. Better Decisions. Better Results.
www.awareity.com
|
