IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Personnel Remarks
____________________________________________________________________ .........................................
S 3.8 Avoidance of factors impairing the
organisational climate
Initiation responsibility: Agency/company management; Head of
Personnel Section; personnel
committee/works council
Implementation responsibility: Superiors; Personnel Section; personnel
committee/works council
A positive organisational climate motivates staff to observe IT security
safeguards, while at the same time reducing the incidence of negligent or
deliberate acts which can cause disruption to the IT operation. Efforts should
therefore be made, also from an IT security point of view, to achieve a
positive working atmosphere. There are so many ways available for achieving
this that only a selection of measures is given here, the appropriateness of
which must be determined on a case-by-case basis:
- provision of a social centre,
- avoidance of overtime,
- observance of rest breaks,
- regulated division of responsibilities,
- even distribution of workload,
- performance-related pay.
Communications problems in an organisation almost inevitably lead to
security problems as well. In extreme cases, this can result in deliberate
security violations. But even if the users merely find the security measures
"annoying" because they have not been informed of the purpose of the
measures, this can result in their being circumvented.
Being the one to report bad news must not mean that the messenger has to live
in fear of punishment. The organisational climate should be such that every
person concerned is able to report security incidents within his/her own
organisation and to tackle them openly as well.
Financial incentives are not the only way to motivate staff, but it is especially
important that they should feel their work is valued. Wherever possible, staff
should be included in decisions. At the very least, they should be informed of
the reasons for the decisions which have been made so that they become
actively involved in implementing them.
For example, often protests against the choice of certain hardware or software
are couched in arguments on the part of the users that the hardware or
software they have been allocated is not a secure as the one they preferred.
Additional controls:
- How is the organisational climate rated by the staff?
- How do line managers rate the existing organisational climate?
- Which factors having a negative influence on the organisational climate are
most frequently mentioned?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Resolve any
communication
problems
Staff motivation