The Quaestor - Volume 6, Issue 3

So what can you do to help mitigate the challenges that accompany employee absence and turnover? Well, the single most effective measure you can take is to have all of your critical operational processes well documented. These are essentially “how to” documents. They need to be adequately detailed to ensure that someone with limited or no knowledge can complete the task satisfactorily. Components of documented procedures should include a calendar or checklist of what needs to be completed and when – daily, weekly, monthly, quarterly, semi-annually and/or annually. Also, if there are specific dates or days when these tasks are to be performed, that information should be included as well. Once the various tasks are identified, the next step is to set about thoroughly documenting how to perform them. These should be step-by-step directions which would also include the computer applications used and the applicable contact information for key contacts involved in the processes.

The best time to create this documentation is when you have an experienced individual performing the tasks; they are best positioned to create a thorough and detailed document. However, that doesn’t mean that this is the only time procedures can be documented. If nothing exists previously, the person learning the job should be tasked with documenting the procedures as they learn them. In both cases, supervisors should review the documents to ensure that the processes are documented accurately and appropriately.

Periodic review (i.e., at least annually) by the key process owners along with their supervisors should occur to ensure the accuracy of the published documents, identify possible gaps between established procedure and practice (either correct the procedure document or amend the practice), and look for efficiencies/redundancies. Upon completion of this exercise, the documents should be amended as necessary and noted as being “updated” as of the review date.

Employee absence and turnover is inevitable and a normal part of business. However, the disruption that accompanies it doesn’t have to be part of the routine. To foster smooth transition periods and to ensure continuity of controls during times of employee vacancies/turnover/absences, document your processes and procedures. Start today – because you never know when you might win the lottery!

What’s happened so far?

PIMI kicked off in January 2011 with the initial deployment of Identity Finder software on Windows computers. The Identity Finder software identifies potential matches for Private Information and presents the information in a report that allows you to remediate the information. The deployment has continued through the calendar year by division and college and the software has been deployed on most Windows computers used by faculty and staff.

As of November 21, 2011, Identity Finder software had conducted more than 27,000 searches on almost 3,200 Windows computers. More than 1,600 of those computers contained probable matches for Private Information. Since January 2011, Identity Finder has identified more than 13  million probable matches.

What’s next?

Windows:
PIMI will be wrapping up Identity Finder deployment to and remediation of the remaining Windows computers. We’re identifying any gaps and working with representatives of the colleges and divisions to eliminate unnecessary Private Information and relocate necessary Private Information to servers.

Mac:
PIMI will deploy the Identity Finder software to Mac computers by division and college beginning in winter quarter. The Mac software will have the same basic functionality as the Windows software, allowing users to shred, scrub, or ignore matches. However, the software will not scan email on Macs, so each user will need to remediate Private Information found there manually.

Document Destruction Days:

Although we usually think of Private Information as being stored digitally, Private Information in other formats can also be used to facilitate identity theft. Non-digital information is also subject to federal and state regulations. Document Destruction Days will be designated by each college and division for employees to ensure that they’re not retaining unneeded Private Information in formats not located on computers and the network. These formats could include “hard-copy” materials, disks, CD/DVDs, video tapes, and any other type of storage media.

For more information about the Private Information Management Initiative or if you have any other questions about Information Security at RIT, visit the RIT Information Security Webpage at http://security.rit.edu, contact us at infosec@rit.edu, or call 585-475-4123.