There are some fundamental questions you can ask as a starting point when assessing your organisation's level of protection. If you have a database which contains any personal information you should register with the Office of the Data Protection Registrar. Failure to comply with the act can result in substantial financial penalties for organisations. The act requires a nominated individual to take responsibility for adhering to the legislation. The DTI can assist with enquiries regarding the Data Protection Act 1984.
Some organisations now demand evidence that suppliers comply with the standard.
Many organisations have one single password across the company for access to multiple systems. The opportunity for former employees to gain sensitive information, especially when disgruntled or moving between companies within the same industry, is often underestimated. These are either hardware or software, designed to prevent unauthorised access to systems. As IT systems evolve, so do the security needs for these systems. Any sub-contractor or temporary employee could gain access to and duplicate this information freely.