A register of data assets. A designated owner for each data asset. A set of access permissions for each data asset. Management processes to ensure that access permissions are maintained and enforced. It is commonplace to note that people are the biggest security risk in any organisation.
People can be careless, error-prone and, tragically, downright dishonest at times.
Any effective security policy must therefore deal adequately with personnel issues. Companies will need to encourage the development of an inforamtion security culture. Such changes must be introduced gradually with a view to ensuring individuals adopt the new codes of behaviour as a positive response to a real threat to their livelihood and not as a bureaucratic imposition. Staff presentations on the security policy, its implementation, and their behaviour in a security culture. The presentations would include training on how to recognise and respond to a security incident.