Is your mobility policy worth the paper it’s printed on?

If you think your employees know the true cost of that stolen laptop or smart phone, you'd better think again.

“Employees don’t think about data in the same way that an IT or security person thinks about it,” said Mark Tauschek, senior research analyst at Info-Tech Research Group. For example, the average user will simply look at the direct cost of a lost laptop – maybe a couple thousand dollars on the high-end – instead of the extremely costly or sensitive data it held.

“That is, until somebody makes them aware that the laptop they just lost the 10,000 customer names or social insurance numbers on the hard drive,” he added.

When it comes to mobile devices, the best way to foster well-informed and responsible employees is to spend about an hour educating them, according to the London, Ont.-based mobility consultant. While many companies have begun enacting mobile device acceptable use policies, Tauschek said that those same organizations are not taking the time to explain why the policy is important and how it works.

“If there’s a mobility policy in place at all, most of the training I’ve seen consists of, ‘Here’s the policy, read it and sign it,’” he said.

The right way to do things is to accompany a policy rollout with a brief training session, outlining the main components of the policy and what responsibilities the user will have to be concerned about, Tauschek explained. He added that nothing in the policy should be left to interpretation or chance.

“For instance, if users have their own devices and pick their own plans, you need to clearly tell them how much the company will pay for,” said Tauschek. Also, if a laptop or smart phone is lost or stolen, employees should understand that the faster it is reported to IT, the faster it can be remotely wiped and secured.

Outlining the technical controls that are in place to ensure mobile device security, identifying the elements that fall under the responsibility of the user and clearly laying out the consequences of non-compliance should also be part of any policy rollout, he said.

Tauschek added that a short training session will have virtually no impact on staff productivity and does not come with any direct capital costs.

“For 2009, it’s something that every company should be doing,” he said.