 |
This month's Q&A
Question: Will an e-mail policy safeguard me from the actions of my employees?
Answer by Tim Robinson, Director of CentryOne.com:
In short no, but a policy is the essential starting point. An e-mail usage policy - preferably part of a corporate communication policy that encompasses all communication tools - promotes responsible use in order to achieve two main goals: (1) Minimize legal risk; and (2) Maximize employee productivity.
Employer Liability
In most legal systems the first goal - reducing the employer's liability
for the employee's actions - cannot be achieved by simply getting users
to sign acceptance of the terms and conditions of use of an e-mail system
for example. Let's say an employee uses company e-mail to discriminate
against or harass another person and that person sues the employer for
damages. The employer will need to show that the employee had been told
not to behave in this way, but on its own this will not be sufficient
defense. The employer should also be able to show that all reasonable
steps were taken to reduce the chances that the employee might do wrong.
Such steps include:
- Ensuring that users have easy access to the acceptable usage policy (e.g. paper copy given to them, electronic copy on the company's Intranet)
- Reminding users of the policy through a 'click to accept conditions of use' screen when logging on to the e-mail system for example;
- Communicating all updates to the policy to users and confirming that they understand and accept these changes;
- Training users in the broad context of information security so that they are aware of the risks;
- Consistently enforcing the policy so that all users are treated equally and all cases of misuse are addressed.
Maximizing Employee Productivity
It is important to remember that the policy is essentially a reactive
tool that is brought out when something goes wrong. The policy itself
won't help employees use e-mail efficiently and effectively. The policy
states what you can't do but is usually silent on what you are supposed
to use e-mail for. Gone are the days when one could simply answer "Use
it for work!"
A proactive approach is required if a company wants to make the most of its resources and reduce the risk of wasted time and bandwidth. Employees should be given training on how to get the most out of e-mail and other communication tools.
Which tasks are done best by e-mail? In which cases should employees rather use the phone? How does one handle the avalanche of incoming e-mail that competes with a stack of phone messages and back-to-back meetings? Each company will have its own solution to this type of question. There are no quick fixes: the solution is to instill, and just as importantly maintain, a culture of information security and responsible use among all employees. Alternatively, just pull the plug.
CentryOne
CentryOne provides organizations
with comprehensive solutions that address issues of risk and productivity
relating to employee communication.
