Ely, England, March 31, 2008 – Sixty-eight percent of employees admit to bypassing their employers’ information security controls in order to do their jobs, according to new research from IT Governance Limited <http://www.itgovernance.co.uk/> .  This finding suggests that, even in some of the most sophisticated and security-conscious organisations, managers are failing to understand the correct balance between the confidentiality and availability of information.  By implementing the wrong policies and procedures, they are potentially putting their organisations at risk and may be undermining the legitimacy of information security in employees’ eyes.

IT Governance Limited is the one-stop-shop for books, tools, training and consultancy on Governance, Risk and Compliance.  In February 2008, it polled 130 technology and compliance professionals on issues concerning the UK Data Protection Act (‘DPA’).  The respondents included some of the best informed professionals in this area, as evidenced by the high proportion of organisations with independently certified data security measures.  The full findings of this survey will be published next month in Data Breaches: Trends, Costs and Best Practices <http://www.itgovernance.co.uk/products/1615> , the first of IT Governance’s new series of Best Practice Reports <http://www.itgovernance.co.uk/best-practice-reports.aspx> .  

The research found that most organisations appeared aware of their responsibilities under the DPA, with over 80 percent having a data controller or someone responsible for maintaining privacy.  Eighty-two percent of organisations had clear policies and procedures for protecting personal data, including documented procedures (68 percent of organisations), formal procedures (57 percent) and informal procedures (24 percent).  Twenty-one percent had policies and procedures certified to best practice standards, such as ISO27001 <http://www.itgovernance.co.uk/iso27001.aspx> , indicating that respondents represented organisations that are particularly well managed in the field of information security.  Nevertheless, the high incidence of employees deliberately circumventing policies and procedures indicates that many of the measures introduced by management are unduly obstructive, either in design or implementation. 

Organisations also differ in the comprehensiveness of their data security regimes.  While 89 percent cover access to personal data, only 56 percent govern detecting and reporting data losses, while just 39 percent extend to correcting data loss incidents.

The need for DPA compliance is clear, with 96 percent of the organisations represented holding personal information about customers, patients or other individuals.  Of these, 56 percent hold payment card or other financial information; 39 percent hold sensitive personal information, such as ethnicity, religion or political affiliation; and 36 percent hold medical information. However, only 55 percent of employees handling personal data have been trained in their legal responsibilities in respect of this information.  

Alan Calder, Chief Executive of IT Governance, said, “Under the Data Protection Act, it is a legal requirement for organisations to safeguard personal information, but this can only be achieved with the support of employees.  By imposing ill-considered procedures, many organisations leave people little option but to break the rules if they are to do their jobs.  This not only leaves businesses vulnerable to data breaches and fines, but also does lasting damage to the way employees regard infosecurity.  If more organisations followed best practice standards like ISO27001, they would be doing a service to their customers, employees and themselves by making data security workable and readily adopted.”

Priced at £195.00/$386.10/€253.50, Data Breaches: Trends, Costs and Best Practices will be published by IT Governance on 15 April 2008 and can be pre-ordered from http://www.itgovernance.co.uk/products/1615 - there’s also a pre-launch discount!

- Ends -

FOR FURTHER INFORMATION OR REVIEW COPIES

Marc Cornelius, 80:20 PR, This e-mail address is being protected from spambots. You need JavaScript enabled to view it