Handbook

Handbook

Discipline:
– IT Management

Type of service:
Essay

Spacing:
Double spacing

Paper format:
APA

Number of pages:
7 pages

Number of sources:
6 sources

Paper details:

Company Background & Operating Environment

Home Renovation Company specializes in the renovation and rehabilitation of residential buildings and dwellings. It specializes in “smart home” and “Internet of Things” technologies while maintaining period correct architectural characteristics. Please refer to the company profile (attached) for additional background information and information about the company’s operating environment.

Policy Issue & Plan of Action

The current Employee Handbook is not up to standards and needs to be updated. The CEO has tasked the Chief of Staff to oversee the handbook updates including obtaining all necessary approvals from the Corporate Governance Board. The Chief of Staff met with the full IT Governance Board to discuss the required policy updates. (The IT Governance Board is responsible for providing oversight for all IT matters within the company). The outcome of that meeting was an agreement that the CISO and CISO staff will update and/or create IT related policies for the employee handbook. These policies include:

• Acceptable Use Policy for Information Technology
• Bring Your Own Device Policy
• Digital Media Sanitization, Reuse, & Destruction Policy

Assignment

• Research the three policies to determine what they should contain and construct an approval draft for each policy. (Do not exceed two pages for each individual policy)
• Be concise in your writing and only include the most important elements for each policy.
• The policies are to be written for EMPLOYEES and must explain employee obligations and responsibilities.
• Each policy must also include the penalties for violations of the policy and identify who is responsible for compliance enforcement.

Include in your draft:

–         Executive Summary

–          Acceptable Use Policy for Information Technology (limit to 2 pages)

–         Bring Your Own Device Policy (limit to 2 pages)

–         Digital Media Sanitization, Reuse, & Destruction Policy (limit to 2 pages)

1. Use a professional format for your policy documents and briefing package.
2. Common phrases do not require citations. If there is doubt as to whether or not information requires attribution, provide a footnote with publication information or use APA format citations and references.
3. Make sure that you address security issues using standard cybersecurity terminology (e.g. 5 Pillars of IA, 5 Pillars of Information Security).

The company collects, maintains, and stores personal information from and about customers over the normal course of doing business. This includes credit checks, building plans and drawings for homes, and information about a customer’s family members which needs to be taken into consideration during the design and construction phases of a project (e.g. medical issues / disabilities, hobbies, etc.).

When renovations are required due to a medical condition or disability, the company works with health insurance companies, Medicare/Medicaid, and medical doctors to plan appropriate modifications to the home and to obtain reimbursement from insurers. This sometimes requires that the company receive, process, store, and transmit Protected Health Information (PHI) generated by medical practitioners or as provided by the customer. The company’s legal counsel has advised it to be prepared to show compliance with the HIPAA Security Rule for PHI for information stored on computer systems in its field offices and in the operations center.

The company collects, maintains, and stores personal information from and about customers over the normal course of doing business. This includes credit checks, building plans and drawings for homes, and information about a customer’s family members which needs to be taken into consideration during the design and construction phases of a project (e.g. medical issues / disabilities, hobbies, etc.).

The company allows employees to bring and use their own personal digital devices (laptops, cell phones, cameras, etc.) provided that these devices are required to perform their duties. Contract employees are not allowed to “bring your own device” (BYOD) and will be terminated if they are found to be using cell phones or personal computers on the company’s premises. Employees carry an RFID enabled “proximity access” card which they use to access offices and other restricted areas. BYOD devices are NOT allowed to connect directly to the company’s VPN. These devices are restricted to WiFi access to the Internet using the company’s wireless access points.