IT Processes & Policies Creation

A: While it is possible to buy pre-packaged IT Policies and Procedures (P&P), or templates used to create them, it would be foolish to do so, as such products are generic and take advantage of famed circus P.T. Barnum’s old saying, “There’s a sucker born every minute” – which is not to say that at least a template might not be useful. Just ask any member in good standing of the IT Support Los Angeles Community about pre-packaged ‘plans’ – and not just for IT Services P&P, but for any department within a company, and they will laugh. Buying a ‘paint by numbers’ set of P&P rules is the same as buying the book ‘P&P for Idiots’. Your company is unique – approach everything you do, every policy and procedure you set up, to reflect your company and what sets you apart from the fold.

A: IT P&P represent the governing set of rules for all workers accessing an organizations IT network infrastructure. The policies predict the procedures that must be followed in order to ensure an unbreakable security defense that allows uninterrupted Confidentiality, Integrity, and Availability of IT resources for the company.

The IT P&P is a fluid, living document subject to ongoing modification in order to stay abreast of changes in the business environment and the evolution of IT-related technologies. This is why close collaboration with your Managed Services Provider is crucial - they are watching the evolution of technology and will be the first to know what will affect your system and what updates need to be added to your existing P&P.

A: The fundamentals should include, but not be necessarily limited to, policies governing the following:

Acceptable Use: All business, no frivolity.
Remote Access: What are accepted devices and what protocols must be used.
Network Security: Everyone is accountable to maintain the security of the network.
Password Creation & Management: Standardized rules for control of passwords.
Incident Response: Steps to take in a data breach.
Vendor Management: Establishes methodology for adopting and using strategic vendors.
Security Awareness & Training: Must be ongoing. Users let in over 80% of cyber-attacks.
Change Management: Terminations, new hires, or relocations

A: This depends on the type and size of the business. The guy who runs the little appliance repair shop may have simple, verbal policies such as ‘Turn off the computer when you go home.’ The same for many small home-based businesses – gardeners, or small home repair, but as a company grows, so does the need for formalized IT P&P.

There is no set number of employees that determines when a company needs IT P&P – a mid-size construction company may have 50 employees, but only 2 or 3 computer users – they still should at least have a list of Dos and Don’ts for computer use – even if they’re only jotted down on Post-A-Notes and stuck to the monitor.

A decent rule of thumb is that once your business graduates to the point where you are connecting company computers for file sharing and/or hiring a qualified IT Service, you need to get serious about well thought-out and written IT P&P.

A: As the end user, utilize your greatest asset in setting up your IT P&P: your IT Support and Services provider. Depending on who you hire for your IT, changes may be in order.

For our purposes, there are two basic situational types of IT Support: In-house and outsourced. Given the wide range of core competencies inherent in both types, let’s refine that to include only highly reputable and competent in-house or outsourced providers of IT support and services.

1) Time and Materials: In the IT Support industry, this outdated model is known as ‘Break & Fix’ (B&F). This is basically ‘emergency IT services’. Something on the network breaks unexpectedly - with this model, network disruptions will always be a surprise – and your ‘IT Services Guy’ drives over, troubleshoots the system, locates the problem, and fixes it. All the while, you are waiting and he is on the hourly clock – not a great motivation to fix things quickly. Purveyors of this model will typically have little or no involvement either setting up responsible IT P&P OR working with the client to do so.

2) Managed IT Services providers: This is the IT Support model that will not only work with the client to establish responsible and ‘bulletproof’ IT Policies and Procedures, but any top-notch Managed Services Provider will absolutely insist on either writing the IT P&P or having a substantial voice in the client’s development of them.

Why? Because it doesn’t matter what business you’re in: A manufacturer knows how to produce product, a doctor knows how to alleviate suffering, an attorney knows how to win court cases, but your Managed IT services people know IT. Their entire existence is based on taking full responsibility for all aspects of your network - through proactive 24/7 IT HelpDesk and onsite technical support.

A: This is where a template can be a very handy tool. Your IT P&P should a part of, and be stylistically consistent with, your basic employee handbook. This is not complicated – in fact, the common sense approach is best: make sure your policies and procedures are easy to read and comprehend - not in fancy ‘legalese’ (or in IT support – ‘Geek Speak’). If your employees have to decipher what your policies mean, you can bet Dollars to Donuts that they won’t be faithfully following them.

There are a number of excellent sites, such as ComplianceBridge which can lead a novice through the formatting process, but consistency is the number one keyword, regardless of the style used. Once IT P&P are distributed in writing, a formal training session should be set. This will give employees a chance to ask questions and may indicate where ambiguous or unclear wording should be changed.