Register to receive a printed copy(For Lexis Practice Advisor® Subscribers Only)
Lexis Practice Advisor®Free Trial
Learn More AboutLexis Practice Advisor®
By: Lindsay Burke and Moriah Daugherty Covington & Burling LLP
Today, among the most critical risks a company can face are the cyber risks associated with its own employees or contractors. Companies are confronting an increasingly complex series of cybersecurity challenges with employees in the workplace, including employees failing to comply with established cybersecurity policies, accidentally downloading an attachment containing malware or providing their credentials in response to a phishing scam, or intentionally stealing company information for the benefit of themselves or the company’s competitors by simply copying information to their email or a thumb drive and leaving the company
CONTRACTORS OR CONSULTANTS WITH ACCESS TO COMPANY systems can pose these same challenges. To guard against these risks, companies can implement various policies and procedures to address an employee’s tenure, from pre-hiring to post-employment, and can implement many of these same precautions with respect to contractors, consultants, or any other third parties with access to company systems.
Before hiring employees or contractors, companies can ensure that they have policies and procedures in place to protect themselves. Particularly important policies include:
Companies should enact enhanced screening and background checks for new hires who will have access to the company’s crown jewels and systems that can connect to or access the same, and companies should require third parties that provide contractors to demonstrate that they are doing the same.
When drafting policies, companies should ensure all important stakeholders are coordinated—including human resources, information technology, and legal—and that all employeerelated policies are aligned with other company policies, particularly the incident response plan, data security, and cybersecurity policies.
When onboarding employees, companies should use procedures including training, policy review, and key acknowledgements and consents to establish a culture of awareness and compliance. It is particularly important for companies to complete the following tasks during employee onboarding:
Employees should be asked to execute a non-disclosure agreement and other documents that protect the company’s information, and the executed copies of these documents should be safely stored in the company’s personnel file or human resources system.
Companies can and should also implement parallel procedures for outside directors, vendors, contractors, and third parties with access to company networks and systems.
After employees begin work, companies should regularly assess indicators of any potential issues, including:
Conducting real-time monitoring of employees has significant privacy implications, particularly outside the United States. As a result, a company will typically want to notify employees of the monitoring and obtain prior consent or acknowledgement that an employee’s use of the system constitutes consent to the interception of their communications and the results of such monitoring may be disclosed to others, including law enforcement.
Companies should conduct regular, required training with employees concerning cyber risks, including the risks associated with phishing attacks and fraudulent email solicitations. In addition, companies should make sure that compliance with security policies is included as a metric in performance evaluations for employees, particularly those employees with access to business critical information.
Contractors & Consultants
These same procedures should be in place for contractors, consultants, or any other third parties who have access to company systems and information. If necessary, companies should review the contracts they have with vendors or staffing agencies to ensure that proper procedures and consents are in place.
If a company believes an employee is potentially disgruntled or an insider threat, the employee’s manager should coordinate with other departments—including legal, human resources, and information technology—to obtain additional information and plan a course of action. Investigations can include forensic computer or network searches, preservation of affected systems, and interviews with employees. While developing the facts, a company should consider when and how to suspend or revoke a suspected insider threat’s access or take additional action against the insider—but beware that taking action against a suspected employee is likely to implicate employment laws in the United States or elsewhere.
When off-boarding employees, companies should take steps to protect themselves. It is imperative for companies to develop policies and procedures for off-boarding employees that are directed at minimizing risks of data leakage. Exit interviews should be conducted wherever possible; they will allow companies to spot potential problems or identify red flags.
When an employee resigns, a company should decide whether to institute a protocol to remove or limit the employee’s access to confidential information even before the employee’s last day at work. Human resources should work with the information technology department to audit the employee’s most recent network access and email activity to ensure the employee has not harvested any confidential information.
When the company is preparing to terminate an employee, the company should implement a protocol to protect company confidential information, including reducing the employee’s access to networks and systems before, or simultaneously with, notifying the employee of the impending dismissal. The same should be done when a contract with a consultant, vendor, or contractor is nearing its end.
All employees who leave the company, and all contractors whose contracts end, should be reminded of ongoing obligations to protect the confidential information of the company and should be asked to return all company information, documents, and electronic equipment before their last day at work.
Employees can present a significant threat to a company’s business critical information, as can contractors or consultants with access to company systems. Companies should ensure that relevant departments within the company, such as the legal, human resources, and information technology departments, are coordinating to take steps to protect the company against such threats, including those set forth above.
Lindsay Burke, a partner at Covington & Burling LLP, is vice chair of the firm’s employment practice group and regularly advises U.S., international, and multinational employers on employee management issues and international human resources compliance. Moriah Daugherty is an associate at the firm advising clients on a broad range of cybersecurity, data privacy, and national security matters. The authors may be contacted at firstname.lastname@example.org and email@example.com.
To find this article in Lexis Practice Advisor, follow this research path:
RESEARCH PATH: : Intellectual Property & Technology > Privacy & Data Security > Privacy Policies > Articles
For a review of recommended cybersecurity measures to be taken by employers, see
> CYBERSECURITY MEASURES TO PROTECT EMPLOYERS’ CONFIDENTIAL INFORMATION AND TRADE SECRETS
RESEARCH PATH: Intellectual Property > Privacy & Data Security > Privacy Policies > Practice Notes
To learn how to craft cybersecurity policies for the workplace, see
> CREATING POLICIES ON COMPUTERS, MOBILE PHONES, AND OTHER ELECTRONIC DEVICES
RESEARCH PATH: Labor and Employment > Privacy, Technology, and Social Media > Policies and Procedures > Practice Notes
For a sample cybersecurity form for employers, see
> MODEL POLICY ON THE USE OF ELECTRONIC COMMUNICATION SYSTEMS
RESEARCH PATH: Intellectual Property & Technology > Privacy & Data Security > Privacy Policies > Forms