Richard Sheppard

UK

Consultant

First, identify your "precious" data:

Recently I tried to help a medium sized organization to write its "User Policies."

However, although they handled some highly sensitive personal and financial data, they had no concept of giving this data any special classification or "protective marking."

They had no policy about who could access particular data; either on paper or electronically.

Inevitably the organization tried to protect everything, and failed.

Different departments worked to different rules.

People who really needed access to sensitive data were denied it.

With such organizations, it is vital first to decide the overall data policy before worrying about individual potential threats.