Cybersecurity awareness matters – 5 steps to safer data

Whatever data traverses your organization and beyond, everyone that accesses, creates, uses or shares that information has the responsibility to protect it. But as the cyber age evolves, digital footprints expand and technology advances, data safety and integrity are increasingly under threat, from both external attacks and internal complacency.

If you’re concerned about cybersecurity, you should be. In the AI era, as opportunities to breach, leak, manipulate or misuse information proliferate, there’s never been more cause to assess your company’s approach to data and make sure you’re following these five best practices.

1. Classify data from the start

To protect it from alteration, destruction, disclosure or unauthorized access, your data needs to be classified based on its sensitivity, risk, and legal or regulatory requirements. You should classify data not only at the moment of creation, but also throughout its lifecycle, based on the potential impact to the organization.

As content and context change, so must classification. By consistently sticking to your organization’s classification standard, you’ll be in a stronger position to keep your data safe, whether it’s at rest, in use or in transit.

2. Take responsibility for data

It’s important to make the distinction between owning and being individually responsible for your organization’s data. The data owner has authority for the business function or process that creates or is primarily responsible for the data and is accountable for its classification. Any individuals accessing, modifying, storing or sharing the data are then responsible for complying with the owner’s classification and the corresponding handling and protection requirements.

In short, data owners set the classifications, and individual data handlers must follow them. And ultimately, all of your employees are responsible for applying the right classification and protections based on the standard set within your organization.

3. Apply the correct sensitivity label

Each classification label should clearly represent how sensitive the data is and the protections required. At FIS, we’ve created classification levels to help protect the data we produce or that our clients and partners entrust to us. The levels range from openly shareable to the highest-risk data requiring the strictest protections.

When you combine multiple data elements, the highest classification should apply to the entire set. And if for any reason a document, file or message hasn’t been classified, contact the data owner to clarify and classify accordingly.

4. Store and share sensitive data with care

You should only store or process data in systems and collaboration platforms that your company approves, manages and controls access to – and never in unapproved cloud applications, services or external devices. When sharing data, verify the recipient first. If you’re sure they need access to the data and are authorized to view it, recheck that it’s labelled correctly and that you’re sending it in the right, organization-approved way.

Typically, you won’t be allowed to email sensitive data outside your organization. Instead, use a secure method to transfer the data, and only to approved clients or third parties that have a non-disclosure agreement or similar contract in place with your organization. Keep all of your contractors and vendors informed of your organization’s classification requirements and make sure they are contractually obligated to meet them.

5. Pause, protect and verify

Caution pays when you’re handling company data, so always slow down and take a breath before sending or sharing. Limit access to data as much as possible, follow your company’s data handling rules to the letter and consistently verify the recipients or destination of the data.

Be secure, stay vigilant and remember that as a company employee, you are always the first line of defense for your data. At a time when cybersecurity awareness matters more than ever, it’s up to us all to play our role in keeping data safe from harm.

When in doubt, treat data more cautiously than not.

Handle data the FIS way

As part of our enterprise data governance policy, FIS has an established framework for classifying data based on its level of sensitivity and protection needed. Our data handling standard provides explicit safeguards for the creation, use, storage, transfer, archive and destruction of data.