--- title: Tips for developing a data security policy description: The key to an effective data security policy, however, is not data but people. No security controls and processes will be effective unless all employees adhere to them. image: https://blog.fordway.com/hubfs/Blog%20images/data%20concept.jpg --- T. 01483 528 200 [How can we help?](https://www.fordway.com/contact-us) [Contact us](https://www.fordway.com/contact-us) [![fordway-logo](https://www.fordway.com/wp-content/uploads/2019/07/fordway-logo.png "fordway-logo")](https://www.fordway.com/) - [Home](https://www.fordway.com) - [Insights](https://www.fordway.com/insights/blog) - [Cloud Services](https://www.fordway.com/services/cloud) # Fordway Blog ## [Tips for developing a data security policy](https://blog.fordway.com/tips-for-developing-a-data-security-policy) \[fa icon="calendar"\] Oct 17, 2017 11:10:59 AM / by [Neville Armstrong](https://blog.fordway.com/author/neville-armstrong) - [Tweet](https://twitter.com/share) ![data concept.jpg](https://blog.fordway.com/hubfs/Blog%20images/data%20concept.jpg)With GDPR on the horizon, now is a good time to review your data security policy. The first step is to take a holistic look at your entire infrastructure, from how data is created or acquired to how it is valued, stored, accessed and disposed of. This includes data coming in from customers, partners and suppliers; data created within the organisation, such as presentations and reports; and data that goes out, such as invoices and proposals. [**You can find our suggested four stage process for developing a comprehensive data security strategy below**](https://blog.fordway.com/tips-for-developing-a-data-security-policy#fourstep) The key to an effective data security policy, however, is not data but people. No security controls and processes will be effective unless all employees adhere to them. This means defining a clear security policy and obtaining employee buy-in and commitment. The policy should be enforceable, realistic, acceptable to users and should not violate personal privacy laws. User education is essential, which means training everyone in your organisation – including senior management – about different types of threats and how to prevent them. You should make sure that they know exactly what to do and who to contact should the worst happen. They need to feel able to ask for help if they think they’ve mistakenly clicked on something malicious, rather than burying their head in the sand and hoping for the best. Some of your policies may be unpopular, such as disabling the use of USBs or other mobile storage devices. To obtain user commitment you need to explain why they’re needed and make sure that secure alternatives are available. It’s also vital to obtain commitment at the top of the organisation. Security policy needs board level commitment and HR support before implementation, executive sponsorship during implementation and HR defined penalties for policy violations. These penalties should be equally applicable at all levels of the organisation. Finally, you need commitment from the various data owners in your organisation, as they should be responsible for managing and keeping their data safe once the security solutions have been implemented. They can use Data Lifecycle Protection (DLP) tools, for example, to enforce policy and reporting requirements appropriate to their needs. Typically the security problems we see occur where users are allowed to store data on their own machines. Data owners should also be given responsibility for ensuring that data is consolidated in a central network location, as DLP works best when data is organised and structured. ### **To develop a comprehensive data security strategy we recommend a four step process:** 1. Work out and define what level of security controls your organisation requires. You will almost certainly need a policy and some controls. You need to ensure that these controls and enforcement are commensurate with the value of the data being protected and the level of risk. 2. Assess the organisation’s data management strategy. Through assessment and gap analysis of current storage infrastructure, data management tools, processes and service delivery objectives, a long term data management strategy can be rationalised with other strategic data centre initiatives. 3. Review IT governance. Examine IT management processes, regulatory culture and best practice in terms of data value and security. 4. Develop a business continuity and disaster recovery strategy. Review the existing business continuance and disaster recovery strategies and update them as appropriate to ensure that ensure true data protection and security are maintained. ### Find out more about [Fordway's Cloud Services](https://www.fordway.com/cloud-services/) Topics: [GDPR](https://blog.fordway.com/topic/gdpr), [Security](https://blog.fordway.com/topic/security), [Governance](https://blog.fordway.com/topic/governance) ![Neville Armstrong](https://blog.fordway.com/hs-fs/hubfs/Blog%20images/bloggers/86_NevilleA.jpg?width=100&height=100&name=86_NevilleA.jpg) #### Written by [Neville Armstrong](https://blog.fordway.com/author/neville-armstrong) ### Get updates directly to your inbox  Submitting your information tells us you are okay recieveing blog updates and you are agreeing to our [privacy policy](http://www.fordway.com/privacy-policy) and [cookie policy](http://www.fordway.com/use-of-cookies). You can of course, opt out of these communications at any time! - Recent - Popular - Categories ### Lists by Topic - [Cloud (16)](https://blog.fordway.com/topic/cloud) - [IT Strategy (13)](https://blog.fordway.com/topic/it-strategy) - [Security (13)](https://blog.fordway.com/topic/security) - [IT Transformation (10)](https://blog.fordway.com/topic/it-transformation) - [Technology (10)](https://blog.fordway.com/topic/technology) - [cloud intermediation (10)](https://blog.fordway.com/topic/cloud-intermediation) - [Cloud migration (9)](https://blog.fordway.com/topic/cloud-migration) - [Cloud Security (8)](https://blog.fordway.com/topic/cloud-security) - [enterprise cloud (8)](https://blog.fordway.com/topic/enterprise-cloud) - [Insider (7)](https://blog.fordway.com/topic/insider) - [Strategy (7)](https://blog.fordway.com/topic/strategy) - [Cloud Shock (6)](https://blog.fordway.com/topic/cloud-shock) - [Fordway Managed Services (6)](https://blog.fordway.com/topic/fordway-managed-services) - [GDPR (6)](https://blog.fordway.com/topic/gdpr) - [managed cloud (6)](https://blog.fordway.com/topic/managed-cloud) - [Azure (5)](https://blog.fordway.com/topic/azure) - [Disaster Recovery (5)](https://blog.fordway.com/topic/disaster-recovery) - [New Technology (5)](https://blog.fordway.com/topic/new-technology) - [legacy (4)](https://blog.fordway.com/topic/legacy) - [tactical (4)](https://blog.fordway.com/topic/tactical) - [#ChooseToChallenge (3)](https://blog.fordway.com/topic/choosetochallenge) - [#IWD2021 (3)](https://blog.fordway.com/topic/iwd2021) - [Cloud Monitoring (3)](https://blog.fordway.com/topic/cloud-monitoring) - [Data Protection (3)](https://blog.fordway.com/topic/data-protection) - [Fordway (3)](https://blog.fordway.com/topic/fordway) - [Governance (3)](https://blog.fordway.com/topic/governance) - [ITIL (3)](https://blog.fordway.com/topic/itil) - [Risk Management (3)](https://blog.fordway.com/topic/risk-management) - [cloud first (3)](https://blog.fordway.com/topic/cloud-first) - [remote working (3)](https://blog.fordway.com/topic/remote-working) - [trends (3)](https://blog.fordway.com/topic/trends) - [Cyber Security (2)](https://blog.fordway.com/topic/cyber-security) - [Meet the team (2)](https://blog.fordway.com/topic/meet-the-team) - [Ransomeware, incident response, CISO, Security (2)](https://blog.fordway.com/topic/ransomeware-incident-response-ciso-security) - [Ransomware (2)](https://blog.fordway.com/topic/ransomware) - [case study (2)](https://blog.fordway.com/topic/case-study) - [compliance (2)](https://blog.fordway.com/topic/compliance) - [technical debt (2)](https://blog.fordway.com/topic/technical-debt) - [Cloud Paging (1)](https://blog.fordway.com/topic/cloud-paging) - [Connectivity (1)](https://blog.fordway.com/topic/connectivity) - [DaaS (1)](https://blog.fordway.com/topic/daas) - [DraaS (1)](https://blog.fordway.com/topic/draas) - [Incident Response (1)](https://blog.fordway.com/topic/incident-response) - [Managed Services (1)](https://blog.fordway.com/topic/managed-services) - [Microsoft Sentinel (1)](https://blog.fordway.com/topic/microsoft-sentinel) - [Networking (1)](https://blog.fordway.com/topic/networking) - [Optimised Infrastructure (1)](https://blog.fordway.com/topic/optimised-infrastructure) - [Patch Management (1)](https://blog.fordway.com/topic/patch-management) - [Patching (1)](https://blog.fordway.com/topic/patching) - [Project Management (1)](https://blog.fordway.com/topic/project-management) - [Technology Services 2 (1)](https://blog.fordway.com/topic/technology-services-2) - [Web hosting (1)](https://blog.fordway.com/topic/web-hosting) - [hyperconvergence (1)](https://blog.fordway.com/topic/hyperconvergence) - [information security (1)](https://blog.fordway.com/topic/information-security) - [shared services (1)](https://blog.fordway.com/topic/shared-services) - [vdi (1)](https://blog.fordway.com/topic/vdi) - [virtual desktop (1)](https://blog.fordway.com/topic/virtual-desktop) see all ## [Older Fordway Posts](http://www.fordway.com/blog/archive)   [Tweets by @Fordway](https://twitter.com/Fordway) ### CONTACT 01483 528 200 [Privacy Policy](https://www.fordway.com/privacy-policy) [Anti-Slavery Policy](https://www.fordway.com/anti-slavery-policy)   ### This is Ermincloud the Fordway cow [Find out why she matters to us!](https://www.fordway.com/ermincloud) [![](https://fw-dev-neu-webasp-001.azurewebsites.net/wp-content/uploads/2019/07/twitter-footer-icon.png)](https://twitter.com/Fordway) [![](https://fw-dev-neu-webasp-001.azurewebsites.net/wp-content/uploads/2019/07/facebook-footer-icon.png)](https://www.facebook.com/Fordway-358130410947628/) [![](https://fw-dev-neu-webasp-001.azurewebsites.net/wp-content/uploads/2019/07/youtube-footer-icon.png)](https://youtube.com) [![](https://fw-dev-neu-webasp-001.azurewebsites.net/wp-content/uploads/2019/07/linkedin-footer-icon.png)](https://www.linkedin.com/company/fordway-solutions) Copyright © 2020 Fordway Solutions \[fa icon="chevron-up"\]Back to top ![](https://dc.ads.linkedin.com/collect/?pid=94312&fmt=gif)