The steps include educating your users to the threats, setting out policies that minimize the infection potential, installing antivirus software, regularly updating the antivirus software, and installing all of the security patches for operating systems, web browsers, email clients, and applications. If your company uses another designation for these, simply replace the terms with the appropriate ones. All users should be provided a copy of the computer policies and required to sign a statement that they have received them, read them, understand them, and agree to abide by them. This applies to all existing employees, contractors, temporary workers, etc., as well as all new personnel. A sample acknowledgement statement is included at the end of the policy guide.
Several policies contain notifications to system users that they have no expectation of privacy.
While they may appear redundant, they serve to reinforce the absolute lack of privacy. Courts have generally ruled in the favor of employers where policies made it clear that the employee had no expectation of privacy. The Courts and federal regulators have generally left employers to regulate personal computer, Internet, and email usage as the employer wishes. While in 1988 the NLRB upheld the firing of an employee that sent an email critical of layoffs, where the email was sent at a busy time of the day and disrupted the companies computer system, in 1998 they ordered a company to rehire an employee that was fired for criticizing a leave policy via email. The difference in the two cases, other than the political time frame, appears to be that the first worker physically disrupted his employer's business.