Information security plans and policies are vital to a business andits operations. They are used to raise awareness of known or possibleissues or vulnerabilities and provide managers and employees thenecessary information to reduce or avoid the threats through thoroughlylaid out do’s and don’ts for each to follow. Unfortunately, these plansand policies are only effective when they are communicated to managersand employees outlining the nature of each policy and why it exists orinforming of any updates or changes made to existing policies. The bestway for companies to ensure this is through the implementation of aneffective communication strategy. A communication strategy (in the caseof RCR) is a strategic and effective method of communicating polices,plans, or changes/updates to current policies or plans in the form ofdocuments or presentations to managers and employees through one ofseveral different distribution methods such as:

• Distribution of printed copies
• Email distribution
• Web links to an internal website or company forums
• Face-to-face briefing (with or without Question & Answer session)
• Company Newsletter
• Manager/Employee Handbooks
• Company Noticeboard
• Training sessions
• Skype, Facetime, or Webinar briefings

The Five Best Communication Strategies and Why

Even though there are several communication strategies which can beemployed, here are the top five best options for RCR to use. These areto be used once a thoroughly written policy, plan, or updatedocument/presentation has been completed. The importance of making itclear why the policy is necessary and giving a brief but informativesummary of what it holds cannot be understated.

1. EmailDistribution – Email distribution is an effective way to keep managersand employees informed of important information, meetings, events, etc.Through the attachment of read receipts, recipients who have read theemails can be tracked. Through distribution lists, it is easy toseparate departments and reach multiple recipients in one easy mailing.
2. Face-to-facebriefings/training sessions – These are each organized meetings orsessions where one briefer or trainer communicates information tomultiple personal. As long as the briefings do not become toocomplicated or time consuming, this is an effective way to communicateinformation to managers and employees while often providing theopportunity for questions or feedback. By having attendees sign into thebriefing or session, tracking of who has received the updates is easyto do.
3. Skype, Facetime, or Webinar briefings – Skype, Facetime,and Webinars are electronic communication methods used for one to one orconferences. By using this method, attendees can receive an emailedversion of the briefing outline and attend while at their desks at theircomputers. These forms are normally live, but they can also be madeinto versions which can be watched at the manger or employees convenientvia a link or company website. Each method is effect, but the liveversions can allow for questions and feedback.
4. Distribution ofprinted copies via Company Newsletter or Members Handbook – This is atried and true form of distribution all be it in a form which workstowards conservation. Printed copies can be added to a CompanyNewsletter (which could also be electronic) to be distributed tomanagers/employees or posted on Company Noticeboards. The printed copiescan also be placed in manager/employee handbooks for review.Manager/Employee Handbooks should contain any important informationdirectly relating to their jobs or the performance of their jobs.
5. CompanyNoticeboards – Company noticeboards are an effective way to distributeinformation to managers and employees. This consists of posting adocument which clearly and concisely conveys the information beingpassed along. This method is only effective if the boards are read andif information is clear, readable, and easy to understand. Noticeboardscan be placed in as many locations as necessary but are generally inhigh traffic or congregating areas of the workplace.

Examples of Policies Which Need to be Communicated to the Workforce

Although an effective information security program can be made up of anumber of different policies, there are a few which are extremelyimportant to managers and employees. Some examples are:

1. AcceptableUse Policy for Information Technology – This policy provides rules andguidelines for managers and employees as to what can and cannot be doneon or with company IT property such as computers, networks, etc. IT isvital employees review and understand this policy to be able toeffectively use company technology in the course of performing theirjobs. The receipt of updates is equally important in order to continueto meet policy objectives.
2. Bring Your Own Device Policy – Thispolicy establishes guidance for the use of personal electronic devicesat work and on the company network. It outlines what steps must be takenand security measures met to be allowed access as well as what is andis not allowed in regard to its use. Having a BYOD policy can be of agreat benefit to the company, but managers and employees must have aclear understanding of it along with any updates that occur over time.
3. DataBreach Response Policy – The data breach response policy can make orbreak a company these days. Not only does the policy need to becomprehensive and effective, but it must be easy for managers andemployees to understand and follow. The policy will “outline responsemeasures should a data breach take place which will attempt to mitigatefurther damage, retrieve lost or stolen information, investigate thecause, and notify those affected” (Skyberg, T., 2020, pg. 3). Thispolicy is critical to a company and they must ensure all updates make itto managers and employees to enable all up to date steps to be takenshould a break occur.

Summary and Conclusion

The above briefing has described the communication strategies and why

they are vital to companies. Five communication methods were outlined

(Email distribution, Face-to-face briefings/training sessions, Skype,

Facetime, or Webinar briefings, Distribution of printed copies via

Company Newsletter or Members Handbook, and Company Noticeboards) as

well as why they are important. Finally, three examples of policies

which would be important for managers and employees to be aware of,

understand, and be kept updated on. As stated in the introduction,

information security policies and plans are critical to the success and

security of a company, but an effective communication strategy will make

or break managers and employees awareness and comprehension of them.