In the digital age, securing your company's data means getting serious about information security. Protecting sensitive information is protecting your customers from fraud and identity theft, and it safeguards the reputation of your firm. The Federal Trade Commission has published guidelines to steer small businesses in the right direction.
Know what kinds of personal data you have in your files and on your company computers. Social Security numbers, credit card information and any other personal customer information are all data criminals can use. Identify what you have and who has legitimate access to it. The FTC advises that you inventory all laptops, flash drives, disks, cell phones and home computers. Find out who sends personal information to your business (customers, credit card bureaus, banks); how they send it (online, email, surface mail); what kind of info you receive from each entry point and where you keep it (database, laptops, branch offices); and who has or could have access to the info (employees, vendors, contractors).
Identify essential data. If you don't have a legitimate business reason to keep information, don't keep it or collect it. The FTC advises use of Social Security numbers only when absolutely necessary, for example, for payroll taxes. Credit card receipts can only have truncated numbers with no expiration date. Don't keep credit card info for nonessential reasons. Change the default setting on your computer so that you are not storing credit card info automatically. Develop a records retention policy for your business.
Safeguard the information you deem essential. The FTC reports there are four key elements to data security: physical security, electronic security, employee training and security of vendors and contractors. Store paper files in locked cabinets and restrict access to employees who need access. Understand the weaknesses of your computer network and get expert advice regarding how to protect electronic files, e.g., managing passwords, laptop security, firewalls, remote access and detecting attacks. Train staff to spot security problems. Before you outsource, investigate the company's data security and have an agreement regarding how your data is handled.
According to the FTC, businesses should properly dispose of inessential information. Get rid of paper records by shredding or burning before discarding. Use wipe-utility programs when getting rid of computers and portable electronic storage.
Plan for security threats. The FTC advises you create a company response plan to deal with computer breaches. If a computer is compromised, disconnect it immediately. Investigate what happened and block the vulnerability so it cannot happen again. Determine who must be notified of the breach--states and federal bank agencies have laws addressing data breaches.
- Have the same data disposal procedures for employees who work from home.
- Digital security image by Nicemonkey from Fotolia.com