From a business standpoint, what is the most productive way to view employee use of personal equipment for work-related tasks?

SCENARIO

Please use the following to answer the next QUESTION:

It’s just what you were afraid of. Without consulting you, the information technology director at your organization launched a new initiative to encourage employees to use personal devices for conducting business. The initiative made purchasing a new, high-specification laptop computer an attractive option, with discounted laptops paid for as a payroll deduction spread over a year of paychecks. The organization is also paying the sales taxes. It’s a great deal, and after a month, more than half the organization’s employees have signed on and acquired new laptops. Walking through the facility, you see them happily customizing and comparing notes on their new computers, and at the end of the day, most take their laptops with them, potentially carrying personal data to their homes or other unknown locations. It’s enough to give you data- protection nightmares, and you’ve pointed out to the information technology Director and many others in the organization the potential hazards of this new practice, including the inevitability of eventual data loss or theft.

Today you have in your office a representative of the organization’s marketing department who shares with you, reluctantly, a story with potentially serious consequences. The night before, straight from work, with laptop in hand, he went to the Bull and Horn Pub to play billiards with his friends. A fine night of sport and socializing began, with the laptop "safely" tucked on a bench, beneath his jacket. Later that night, when it was time to depart, he retrieved the jacket, but the laptop was gone. It was not beneath the bench or on another bench nearby. The waitstaff had not seen it. His friends were not playing a joke on him. After a sleepless night, he confirmed it this morning, stopping by the pub to talk to the cleanup crew. They had not found it. The laptop was missing. Stolen, it seems. He looks at you, embarrassed and upset.

You ask him if the laptop contains any personal data from clients, and, sadly, he nods his head, yes. He believes it contains files on about 100 clients, including names, addresses and governmental identification numbers. He sighs and places his head in his hands in despair.

From a business standpoint, what is the most productive way to view employee use of personal equipment for work-related tasks?
A . The use of personal equipment is a cost-effective measure that leads to no greater security risks than are always present in a modern organization.
B . Any computer or other equipment is company property whenever it is used for company business.
C . While the company may not own the equipment, it is required to protect the business-related data on any equipment used by its employees.
D . The use of personal equipment must be reduced as it leads to inevitable security risks.

View Answer

Answer: C

Explanation:

This answer reflects the principle of accountability, which states that the company is responsible for ensuring that personal data is processed in compliance with applicable laws and regulations, regardless of who owns or controls the equipment that stores or processes the data. The company should establish policies and procedures for managing the use of personal equipment for work-related tasks, such as requiring encryption, authentication, remote wipe, backup and reporting of incidents. The company should also provide training and awareness to the employees on how to protect the data on their personal equipment and what are their obligations and liabilities.

Reference: IAPP CIPM Study Guide, page 841; ISO/IEC 27002:2013, section 6.2.1