Slashdot Mirror
Getting Company Owners To Follow Their Own Rules?
techmage writes "Recently we had an issue at our small company that resulted in the loss of a lot of important data. To prevent it from happening again, we created a company-wide policy that all computers would return to IT to have their contents backed up, and the computers would be formatted and reloaded for the next user. Consistently the owners of the company break this and other policies we set up to prevent data loss, theft, etc. How do I get through to the bosses that when they break with the policies, they are potentially shooting the company in the foot?"
Explain the risks, if they choose to ignore it document that they have not returned the laptop to be backed up so that they can't try and blame you if it goes wrong and data loss does occur.
I'd ask anyone who routinely overrides your authority in the data-protection sphere to sign a form indicating something to the effect that they've been informed of these policies and the potential risks and if it all comes crashing down because they don't listen to you, it's not your fault.
The World Wide Web is dying. Soon, we shall have only the Internet.
If they do -- shut up and work around it.
You've created a policy and don't have the owner-level execs onboard?
That's failure #1 right there. Good policy making for security purposes isn't "And IT saith THUS!". Operating in this kind of vacuum gets your enforcement NO PLACE. Fast!
You have to involve these people pretty much from the get-go. This way they understand why the policy is in place and have less self-provided incentive to circumvent it.
And yes, as others have said, a small amount of "horror story" can go a long way too. But only DURING the policy creation process. Afterwards, they look at it as simple justification of an arbitrary policy.
Right now you guys haven't got a leg to stand on.
Chas - The one, the only.
THANK GOD!!!
1) Thank you for trying to save me money. Your recommendations are welcome as I'm paying you for your expertise and opinions.
2) If you're going to try to have me sign something like that I'm going to have a talk with you about bureaucracy and how we can't afford a BS cover your ass mentality in a small company. You may rest assured that if I don't back up and there's a crash there are two possible results: If I'm a bad manager I'm going to come back at you and no little piece of paper will stop me from firing you (though I'd expect you would receive unemployment as it's not really for cause). If I'm a good manager I'm going to write the check to cover the damages, feel foolish and accept your recommendation going forward.
3) If it's a dumbass relative that thinks they can ignore the rules because they're family working in a family business (and they don't sign the checks) then I expect to see their name (and possibly mine if I'm doing it too) on the report of IT security scofflaws that you periodically (though infrequently) prepare for me.
In a company controlled by a single or few owners it is reasonable to recommend, cajole, suggest or encourage proper owner behavior, but if you dictate it and attempt to threaten (for instance by saying in a confrontational manner 'ok, but I'm not taking responsibility then') you are writing checks that your expertise may not be able to cash. As an owner it's important that my IT works right, but it's absolutely imperative that I don't lose control of the company. Don't make me think that you're trying to take it away from me or lord your technical expertise over me unless you have a VERY secure position.
It put Xerox behind and prevented them from releasing the GUI in 1977, delaying the computer industry and the would-be 2008 CAD design of the first practical flying car. Remember that anal stunt the next time you are stuck in traffic.
Table-ized A.I.
Rubbing their nose in it with a useless disclaimer is not going to end well. Presumably the policy has been written down, meaning the owners have authorised the policy either explicitly or by delegation, therefore his arse is already covered if HE follows it. You can respectfully remind the owners of their own policy but provided no laws are broken they are free to make and break policy as they see fit, employees do not have the same privlages.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I fully agree. Employers don't generally win unemployment compensation hearings, even when they are correct. In many cases, the employer has a policy to appeal ANY unemployment claim, just to set up a few additional hoops for the employee to jump through. Most of the time, the employers don't even show up for the hearing. As a result, the state labor department deals with a LOT of junk appeals. Even when the employer shows up, the burden of proof is upon THEM and most of the time, they aren't up to the task.
I know of a guy who was thrown out during some kind of bizarre purge. The company had a change in management and this guy was clearly not part of the plan. So the company tried to cobble together some sort of justification. However, their schedule for firing him did not allow for collecting enough excuses. The purge worked in such a way that the guy's boss had already been let go, so actual facts of the employee's performance were in short supply. What little they had was wrong.
So of course, the employer appeals the unemployment claim. The hearing is held and the employer is absent. After losing by default, THEN the employer appeals to re-open the case. The employee's witnesses are subpoenaed and the day of the second hearing arrives. By this time, the employer has engaged some kind of unemployment compensation management firm to try and win the case. Upon seeing the employee's counter claim and witness list, the consultant tells the judge, "Upon review, this case does not rise to the standard necessary to establish termination for cause. We withdraw our appeal."
Considering how routine these shenanigans are, is it any wonder the employers usually lose?