CSO

Vendor contracts are increasingly including provisions that could lead to breaches of security. At first glance, these types of provisions may appear innocuous, but they create the circumstances under which compromises of security may occur. A few examples:

Following up on my last posting, this week I talk about the basic elements of a document retention policy. While a review of the broad range of applicable laws cannot be addressed here, there are certain general guidelines for the establishment and implementation of a retention program that should be considered in developing a policy:

Most businesses have retention policies governing how long documents are to be retained before being destroyed or discarded. A growing number of businesses are extending their existing retention policies to include electronic documents, particularly e-mail. For example, a common retention policy for e-mail would require deletion after 60 days. In many instances, the deletion is accomplished automatically by programming the business’ computers to review the dates on e-mail and to delete those messages having dates beyond the allowed limit. If an employee desires to retain a message past the automatic deletion date, she must take affirmative action to preserve the e-mail (for example, contact the MIS department or copy the e-mail to a special directory).