“Necessary” Noncompliance

A second set of findings from the same Cisco study revealed that most businesses have security policies and acceptable use guidelines in place today—yet employees often defy or ignore them. What prompts their noncompliance? Two things: Employees don’t know the policies exist, or they have to circumvent rules in order to do their jobs well.

According to the report “Data Leakage Worldwide: The Effectiveness of Security Policies,” which was based on the Cisco global data leakage study, “Fifty-six percent of IT professionals report that security policies are communicated to new hires during orientation, yet only 32 percent of employees say they were educated. This statistic reveals a significant disconnect between the beliefs of IT professionals and newly hired employees regarding the communication of security policies.”^[1] (See Figure 11-2.)