Information Security Policy

What’s that password, again?

An information security policy will be necessary for virtually every apostolate. The complexity of the policy will vary greatly based on the types of information and the number of persons who have access to the information. At the very least, there will be donor information which would need to be managed by at least one individual. Even in a seemingly simple case, a well thought-out and instituted policy is a first defense against a breach.

1. What are the risks to the specific organization? Is it just a matter of donor information being managed properly or are there other elements at risk of exposure as well. Possible examples would be material and intellectual property.
2. What is the policy regarding passwords? A general rule is to change the passwords on important gateways about once a month.
3. Who is accountable? Particular person(s) among the personnel will need to decide on the particulars of this policy, review it regularly, and make adjustments when necessary.
4. How will breaches, should they occur, be handled and how will direct violations of the policy be addressed? It is important to not only have plans in place, but also to educate everyone at the apostolate.
5. What sort of virus protection will be used and how often will it be updated and by whom?

Resources

Here’s a slide show made available by Charles Garrett. The policy document outline page is especially useful.

And here’s an article which specifically pertains to nonprofits and their vulnerabilities with regard to hackers and cyber-attacks.