NEVER NEVER NEVER! (Adjusting my Information Security hat and badge.)

It is extremely bad practice to allow employees to use their personal
accounts to do anything work-related. You open the door to people
exfiltrating data and going around your internal controls. You're also
something of a quasi-government agency, so there may be other rules in play
with regard to open records and so forth.

If people need cloud storage, then the organization should work out a
contract with Google or Microsoft (and honestly, it isn't that expensive to
do it right). Both Google and Microsoft will package office productivity
tools, email, IM, and cloud storage. You lose some records management
capabilities, but gain collaboration and access. The biggest plus is
actually that you can sell people on keeping everything in the
organization's cloud -- which makes oversight and legal discovery a lot
easier.

Once you open the door to personal accounts, you lose control over the
information. People will "forget" they downloaded documents. They will use
a personal email account because it is "easier". If you have anyone who is
trying to prevent data leakage (and keep in mind the kind of information
you have), they will lose visibility to what's leaving the organization.
You're asking for a data breach, whether intentional or not. It's simply a
bad idea.

Patrick Cunningham, CISM, FAI

On Wed, Mar 29, 2017 at 8:49 AM, Teresa A. Matlock <[log in to unmask]> wrote:

> Introduction: Greetings from Houston Texas.  I worked in oil and gas for
> several decades and moved to the public sector when I joined Houston
> Firefighters' Relief and Retirement Fund.  I was a subscriber to the
> RECMGMT-L many moons ago.  I dropped out for a while.  Well - I am back and
> hope to share what I can when I can.
>
> Please accept my apologies if this subject has been part of an earlier
> discussion.  If this is the case, I would appreciate it if you will point
> me to where I can find it in the archives.
>
> We (HFRRF) are in discussion for establishing policy for employees that
> use their personal cloud space for temporary storage/transfer of work
> documents while working at home or while traveling.
> I have been asked to find out how other enterprises deal with the use of
> personal cloud space for business work documents.
>
> *         If it is permitted, what measures are in place to assure that
> convenient copies are not maintained and that the entire work product is
> transferred the enterprises' repositories.
>
> *         If it is not permitted, what is the alternative offered.
>
> *         Does anyone have a policy that they can share with us? (This can
> be sent to my direct email address that is provided below.)
>
> Thank you in advance.
>
> Teresa Matlock
> Records Manager
> Houston Firefighters Relief and Retirement Fund
> 4225 Interwood N. Parkway
> Houston, TX 77032
> 281-372-5126
> [log in to unmask]<mailto:[log in to unmask]>
>
>
> List archives at http://lists.ufl.edu/archives/recmgmt-l.html
> Contact [log in to unmask] for assistance
> To unsubscribe from this list, click the below link. If not already
> present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the
> message.
> mailto:[log in to unmask]
>

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]