We need fewer policies. I’ve thought this for some time and was reminded of my views at the Society of ICT Managers meeting last Friday. We had a presentation on cyber security. It is a hot issue for us. The threat from cyber-crime becomes bigger every day.
One of the speakers said that overly restrictive security policies can lead to a less secure organisation as people are forced to find other ways of sorting their issues. My ears pricked up. I even tweeted it.
Over governance leads to creativity and you end up with the opposite of what you set out to achieve. So you need to get the balance right. There is negative reinforcement. You can only add security up to a certain point otherwise it becomes counterproductive. Of course the trick is to work out how much you need and to not provide any more than that. Remember the most secure system is one that is switched off.
If this is true of security, is it not true of other things? Does too much legislation lead to a lawless society? Can you have too much of a good thing?Once you’ve put three sugars in your coffee you can’t make it any sweeter.
I’m of the view that most of us are adults and can behave like one. Not all the time but most of the time. The trouble is though that when we are faced with a problem our default position, our knee jerk reaction, is to pile on rules and regulations, policies and procedures.
Now everyone needs some form of guidance yet it needs to reflect the problem and it needs to respect that fact that the people who work for us are adults. We should treat them so and expect a certain level of maturity in their levels of responsibility. Policies should be written as guidance, reminding us of the kinds of behaviour that is acceptable and that which is not.
By simply layering on more and more policies we will end up with an organisation that cannot think for itself and a group of people who always look outside themselves for answers to the problems in front of them. This is the opposite of what we want to achieve.
As Nordstrom put it, ‘Use good judgement in all situations.’
Will everyone behave? Of course not. We are human after all but we will get the balance right between enabling the business and killing it.