Security policies

After their risk assessment, Samuel’s team in Addis Ababa compares notes on the shared email password. Two colleagues keep it in their phones’ notes, one sends it to herself on WhatsApp, and the newest member of staff didn’t know there was one. Nobody broke a rule. There wasn’t one to break.

What a policy is for

A security policy is what your team has agreed to do, written down so it doesn’t depend on anyone’s memory (NDI). It covers the ordinary things: how passwords are kept, who can see what, what happens when someone leaves.

Many smaller organizations do not have formal policies around information security. This is not inherently a good or bad thing, as in their place are often informal agreements and practices.

SAFETAG, Internews

So you rarely start from nothing. Your team already has habits. The work is to find them, notice where people assume different things (SAFETAG), and agree what you’ll all do (Access Now). A policy can be a formal document or a short list of shared agreements, whichever suits your team (Holistic Security).

The first agreements

Every team starts from different habits, so there’s no fixed order. Most small organisations need to agree these:

• Accounts: passwords in a password manager, two-factor authentication on every account that offers it and no logins passed around in chat (Shared accounts).
• Joining and leaving: what a new colleague gets on their first day, and what’s switched off on their last (Who has access).
• Devices: screen locks, encryption and updates, and which phones and laptops can hold work information, personal ones included (Phones and laptops).
• Information: what counts as sensitive, where it’s kept, who can see it and how long you keep it (Who has access; Backups; Deleting data safely).
• Which channel for what: where sensitive conversations happen, and where everyday ones can (Secure messaging).
• Travel: what goes on a trip and what stays behind (Travel and border crossings).
• The office: keys and codes, locking up, papers and visitors.
• Reporting problems: how to report a suspicious message or a mistake, and to whom, with no blame (Your incident response plan).

These come from the areas SAFETAG and Access Now’s policy templates cover (SAFETAG; Access Now). They reach into people’s homes too: a personal email account or a family laptop can be the way into the organisation’s work (Access Now).

Writing them with your team

1. Find the habits you already have. Walk the team through a few “what if” moments: a lost phone, someone leaving, a cloud account breached, and, if your work is high risk, a raid or an arrest. Ask what each person would do now (SAFETAG).
2. Agree a few things that are easy to adopt. Try them for a while, then write down the ones that work (SAFETAG).
3. Write them together. People resist rules decided without them, so get input from as many colleagues as you can while it’s still a draft (Holistic Security).
4. Say why each rule exists. Link it to a risk from your risk assessment, so new colleagues understand it.
5. Keep it short. A long document can put people off, so add one section at a time (Access Now).
6. Give people somewhere to ask. A team chat for questions about the rules, or anything else about security, keeps small doubts from turning into workarounds.

Introduce it calmly: give people the facts and room for questions, not frightening stories (Holistic Security). Leaders need to follow the agreements too, where everyone can see (Security champions).

Keep passwords, and the names of sources and at-risk partners, out of the policy itself. If it’s lost or taken, it should give nothing away.

Starting points

• Access Now’s organisational security policy template, and one for grassroots and volunteer groups. Both were last updated in 2019, so check their tool advice against the guides here before you copy it. Adapt them a section at a time.
• NDI’s Security Plan Starter Kit, with questions to discuss for each part of a plan.
• SIIRF’s Readiness Assessment, which shows which agreements you’re missing.

Keeping them alive

A policy is only useful while it matches what people do. Treat it as live: put fixed review dates in the calendar, and look at it again whenever someone joins (Holistic Security). Do the same when someone leaves or your situation changes. A yearly review is a good minimum, with the lighter checks in Checklists and audits in between.

At each review, check what’s written against what people actually do, and change whichever is wrong (SAFETAG). Make security part of your planning, so it isn’t an afterthought (Holistic Security).

Where to go next

• Training your team: help everyone learn the agreements.
• Your incident response plan: what you’ll do when something goes wrong.
• Checklists and audits: check the agreements still hold.
• Who has access: sort information by how sensitive it is.