Privacy through Security: Policy and Practice in a Small-Medium Enterprise

Abstract

The chapter discusses how one small business planned for, and implemented, the security of its data in a new enterprise-wide system. The company’s data was perceived as sensitive, and any breach of privacy as commercially critical. From this perspective, the chapter outlines the organizational and technical facets of the policies and practices evidenced. Lessons for other businesses can be drawn from the case by recognizing the need for investments to be made that will address threats in business critical areas. By highlighting the need for organizations to understand the nature of the risk and the probability of an event occurring, the security approaches highlight the need to address both the threats and actions in the event of an incident to reduce the risk to privacy.