WEBINAR: Governance, Risk and Compliance Lessons Learned from a Global Pandemic

Matt: I don’t think so. I think that an information security policy should be wide enough to cover eventualities such as being unable to work from the office. I also believe that having more than one policy means that there is a proportionately greater chance of it not being read and understood. Therefore we should try to keep this as neat as we can with a single policy.

Paul: It does not require its own security policy however, per se, though as a consequence some current policies may need adaptations to reflect the ‘New Normal’.

Also organisations should consider the wider impacts of a pandemic and include it as a ‘scenario’ in their Business Continuity / Business Resilience plans.

Francois: COVID-19 will no doubt lead to some changes in the business continuity plans. I don’t anticipate major changes in security policies. However, the two following considerations should drive improvements:

(1) the long-lasting period of unconnected workstations that have to be specifically checked when back to internal network

(2) review technical configuration standard because workstations are potentially internet exposed

Matt: It is too early to have seen shifts in our supplier audits inbound yet.

Paul: In my opinion it is too early to say, purely because so many organisations are not back up and running yet.

Paul: You should without a doubt be building a contingency plan for the future – if nothing more, consider planning for a second wave!

The current situation was a test of BCP / Resilience plans, hopefully organisations have some record of decisions made, and actions taken – these form part of the ‘Post Event Response Review’ – to inform decisions and contingencies that might be helpful in the future.

Think positives and negatives, what DID work well, what was not so good, and what would you definitely do differently? Take views from across the organisation (departments and staff levels – the perceptions will be very different!). Use the input to enhance your plans for the future – which of course you hopefully will not need.

Francois: We should apply everything we’ve already known for a long time and then add some work from home specific topics. This could include connection sharing, internet box settings, etc. Make sure the user becomes part of the solution and consider everyone as permanent remote worker.