Although your company may have specific cybersecurity policies, there is no guarantee employees will follow them. Their decision to comply or find a workaround often is based on whether they take potential cyber threats seriously.
According to Harvard Business Review, new research indicates when a company has restrictive cybersecurity policies, employees are less likely to take threats seriously, which makes the company more vulnerable.
Harvard Business Review shares the following tips to help effectively protect company data while increasing employee understanding regarding the seriousness of cyber threats.
- Provide some autonomy. It is important to set clear security boundaries for employees, but you also can offer flexibility within those boundaries. For example, let employees choose from various approved AI tools or decide how and when to complete mandatory training.
- Make secure tools easier to use. Learn why employees decide to use unapproved tools, and work together to develop safe alternatives that truly meet their needs.
- Explain the risk. Ensure employees understand potential threats, how it affects their work and why restrictions are necessary. If you are limiting the use of certain tools, acknowledge the benefits and provide safe alternatives.
- Communicate when policies change. If there is a temporary ban, explain what is needed to lift it. When you remove a restriction, be sure employees understand the underlying security risks remain.
- Measure beliefs—not just compliance. Check in regularly with employees to ask whether they understand cyber threats, trust your policies and know which tools they can use safely.
.jpg){kind=logo}
