Basic things that need to be explained to employees about a security policy and at what point in their employment

Question

I was asked this question:

What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things).

Would the basic things be how sensitive information must be handled, responding to security incidents etc?

Also, I'm not sure on when during their employment these things should be explained?

Answer 1

Policies are not written to stay on a shelf. Every line in every policy should be tied to a risk that the organisation needs to control. As such, each policy needs to be communicated to the people who need to follow the policy.

What should be communicated? Whatever is relevant to that employee.

When should it be communicated? Before the employee starts to access and process the systems and information that they are expected to handle in accordance with policy.

Else what's the point? "We've written this handy guide on the important things you should know about flying a plane. Don't worry about reading it until you have flown passengers around a bit."

The question assumes that there is a set (a set of 4, in this case) of core things in the policy that is a higher priority than the rest. What those things are will be potentially different for each organisation because the risks that an organisation needs to control are different for each organisation.

In short, the question is hyper-specific and wants the answerer to understand what the most important things are in the policy. We cannot know that without understanding the policy.

Answer 2

Every company is different, of course. Some companies that take security seriously will do some or all of the following:

• Specify in their Info Sec policy that all employees need to take annual security awareness training
• Prepare an annual refresher training based on current threats and intel (perhaps a 5-10 minute course on phishing or social engineering, with a little quiz. The quiz should require the employees to make a passing score, or retake the training/test until they pass.)
• The training should include awareness of the security policy and how to access it (include links to it); acknowledgment that they’ve read it (or at least read your official summary); their agreement to abide by it; and how to report incidents
• Require new hires to take that year’s basic training during their onboarding process
• Track training to make sure everyone complies
• Monitor and measure the threat environment to know what to teach people
• Require additional training for people whose jobs have certain responsibilities, such as developers, investigators, managers, leaders
• Have periodic awareness campaigns reminding everyone that they are responsible for security, such as posters at the door. These would be based on the recent threats, such as giving too much information over the phone, or “no tailgating” into secure areas
• Engage a third party to perform periodic phishing campaigns to remind employees not to fall for links in emails
• Executive sponsorship and leadership needs to show the company takes security seriously. No exemptions for the executives.