Ashok, the Managing Director (MD) of XYZ Ltd., has observed that some confidential information has leaked in the company. MD has called the Company Secretary and asked him to prepare Standard Operating Procedure (SOP) fo

For every business/organization it is important to have a written confidentiality procedure describing both the type of information considered confidential and the procedures employees must follow for protecting confidential information and dealing with the confidential information. However, the company may adopt the following standard operating procedure for protecting confidential information: All confidential documents should be stored in locked file cabinets or rooms accessible only to those who are authorized. All electronic confidential information should be protected via firewalls, encryption and passwords. Employees should clear their desks of any confidential information before going home at the end of the day. Employees should refrain from leaving confidential information visible on their computer monitors when they leave their work stations. All confidential information, whether contained on written documents or electronically, should be marked as "confidential." All confidential information should be disposed of properly (e.g., employees should not print out a confidential document and then throw it away without shredding it first.) Employees should refrain from discussing confidential information in public places. Employees should avoid using e-mail to transmit certain sensitive or controversial information. Limit the acquisition of confidential client data (e.g., social security numbers, bank accounts, or driver's license numbers) unless it is integral to the business transaction and restrict access on a 'need-to-know' basis. Before disposing of an old computer, use software programs to wipe out the data contained in the computer or have the hard drive destroyed.