Q UILLOTE , A LETA E STABILIZADORA O “S KEG ”

Tripulación 6 personas

6 A NÁLISIS DE LAS F ORMAS O BTENIDAS

6.5 Q UILLOTE , A LETA E STABILIZADORA O “S KEG ”

Scenario 2: Tomorrow was going to be a busy day. More than 500 customers were being sent a special mailing to introduce a new service that detailed monthly account activity and suggested personalized marketing strategies. Concerned that they wouldn’t finish on time for tomorrow’s 3 pm mail pick up, Lee decided to get started today. He printed out all the reports and laid them out in a nearby conference room so they would be ready for stuffing and sorting in the morning.

Below are listed the most frequently selected values associated with this policy statement. The most frequently referenced underlying theme was employee responsibility for maintaining information security.

Please rank them according to your values associated with information security. Give each of the three a different ranking.

Most

Honor customer trust over personal convenience

O O O

Respect what has been entrusted to you

O O O

Value 2: Briefly explain the thinking behind your ranking.

____________________________________________________________________

Policy 3: Lending XYZ information resources, including company issued laptops and desktop computers to family members, friends, or non-XYZ employees is prohibited.

Scenario 3: All was in a panic when Petrov came last night. Both boys had papers due for school and were fighting over the use of the family computer. Luckily, Petrov brought his laptop home that night and could lend it to his older son.

Below are listed the most frequently selected values associated with this policy

statement. There was a tie for most frequently referenced underlying theme:

Responsibility for following the rules and Responsibility for sustaining company trust.

Please rank them according to your values associated with information security. Give each of the three a different ranking.

Most

Important In the

middle Least Important Do the right thing

O O O

Promote personal responsibility

O O O

Respect what has been entrusted to you

O O O

Value 3: Briefly explain the thinking behind your ranking.

____________________________________________________________________

Please identify your geographic affiliation.

O North America O International

What is your role as it relates to Information Security policy? If you were recruited for the study through the Privacy Champion Program, please select 1. All others should select 2.

O 1. I am a Privacy Champion

O 2. I am a Security/Compliance Policy Maker

Appendix Q: Empirical Investigation: Round 3 Letter

Dear Privacy Champions and security/compliance policy makers:

You continue to do an amazing job on honing in on our security values and working toward consensus on the values related to specific policies.

In Round 3, for each policy your responses have been blended into a single, proposed security value statement. You are asked how satisfied you are that the proposed statement addresses the security value associated with the policy.

If you are not satisfied, you are also asked comment on what needs to change.

Here is the link: LINK If you have any questions or run into difficulty, please contact me.

NOTE: Round 3 closes Wednesday, 6 PM US Mountain Time.

[Signature]

[Contact information]

Appendix R: Empirical Investigation: Round 3 Survey Instrument

For the past two weeks, we have been working toward consensus on the security values related to specific policies. Your responses have been blended into a single, proposed security value statement for each policy. In Round 3, you are asked how satisfied are you that the proposed statement addresses the security value associated with the policy. If you are not satisfied, please comment on what has to change is needed.

Policy 1: XYZ business can be conducted using XYZ equipment and from non-XYZ equipment in compliance with the Remote Access Standard. The use of computer systems or email accounts not provided by XYZ is prohibited.

Proposed security value: We are honor bound to follow XYZ’s security policies as they are designed to safeguard the sensitive data customers have entrusted to us.

How satisfied are you that the statement addresses the security value associate with the policy?

If you were not satisfied with the value statement for Policy 1, what needs to change?

____________________________________________________________________

Policy 2: Users must not leave XYZ information resources unsecured or visible and unattended outside XYZ's facilities.

Proposed security value: We respect the responsibility entrusted to us by XYZ and by customers by anticipating security problems and looking for ways to avoid them.

How satisfied are you that the statement addresses the security value associate with the policy?

If you were not satisfied with the value statement for Policy 2, what needs to change?

Policy 3: Lending XYZ information resources, including company issued laptops and desktop computers to family members, friends, or non-XYZ employees is prohibited.

Proposed security value: As employees we have a personal responsibility to do what is right for our customers, promoting their security interests and respecting their trust over personal convenience.

How satisfied are you that the statement addresses the security value associate with the policy?

If you were not satisfied with the value statement for Policy 3, what needs to change?

____________________________________________________________________

Please identify your geographic affiliation.

O North America O International

What is your role as it relates to Information Security policy? If you were recruited for the study through the Privacy Champion Program, please select 1. All others should select 2.

O 1. I am a Privacy Champion

O 2. I am a Security/Compliance Policy Maker

Appendix S: Technical Investigation: Round 4 Letter Dear Privacy Champions and security/compliance policy makers:

You have reached the turning point of the study. The empirical investigation (where security values are fleshed out) has ended. The technical investigation (where the values are blended into a new kind of policy statement) begins. Now you know why you – policy makers and policy communicators – were specifically selected for this

study. You know how to write security policy and you know how to communicate it in ways users can understand.

Your goal this week is to rewrite the three XYZ policies, changing them from traditional policy statements –“Users must.. “ or “It is prohibited to…” to value sensitive

policies.

When you open the survey you will see the XYZ security policy followed by the security value you have collectively defined. Blend the two together, creating a new, value sensitive security policy.

Example: If the traditional policy states: Employees must wear red on rainy days and the value states: As employees we have a responsibility to look cheerful your value sensitive policy statement will incorporate both the action that the employees must take (wear red on Mondays) AND the value (to look cheerful).

When you have written the policy, briefly describe your thinking.

Here is the LINK. If you have any questions or run into difficulty, please contact me.

IMPORTANT NOTE: Round 4 closes Wednesday, 6 PM US Mountain Time [Signature]

[Contact information]

Appendix T: Technical Investigation: Round 4 Survey Instrument

When you open the survey you will see both the XYZ policy and the agreed upon security value associated with it. Please draft a value sensitive policy statement that incorporates the value statement into the text of the policy. Then, briefly explain your thinking.

Policy 1: XYZ business can be conducted using XYZ equipment and from non-XYZ equipment in compliance with the Remote Access Standard. The use of computer systems or email accounts not provided by XYZ is prohibited.

Security value: We must honor our commitment to our customers to follow XYZ’s security policies as they are designed to safeguard the sensitive data customers have entrusted to us.

Please draft a value sensitive policy statement that incorporates the security value into the text of the policy.

____________________________________________________________________

Value sensitive policy 1: Briefly explain your thinking.

____________________________________________________________________

Policy 2: Users must not leave XYZ information resources unsecured or visible and unattended outside XYZ's facilities.

Security value: We respect the responsibility entrusted to us by XYZ and our customers by anticipating security problems and proactively looking for ways to avoid them.

Please draft a value sensitive policy statement that incorporates the security value into the text of the policy.

____________________________________________________________________

Value sensitive policy 2: Briefly explain your thinking.

____________________________________________________________________

Policy 3: Lending XYZ information resources, including company issued laptops and desktop computers to family members, friends, or non-XYZ employees is prohibited.

Proposed security value: As employees we have a personal responsibility to do what is right for XYZ and our customers, respecting their trust over personal convenience and promoting customer security interests.

Please draft a value sensitive policy statement that incorporates the security value into the text of the policy.

____________________________________________________________________

Value sensitive policy 3: Briefly explain your thinking.

____________________________________________________________________

Please identify your geographic affiliation.

O North America O International

What is your role as it relates to Information Security policy? If you were recruited for the study through the Privacy Champion Program, please select 1. All others should select 2.

O 1. I am a Privacy Champion

O 2. I am a Security/Compliance Policy Maker

Appendix U: Technical Investigation: Round 5 Letter

Dear Privacy Champions and security/compliance policy makers:

Round 5 brings us close to accomplishing the task of creating value sensitive security policy statements. In this survey you will be given the same three policies and associated value statements, along with the five Round 4 value sensitive policy statements that best met the criteria below:

· A strong, logical connection between the value and the policy

· Easily understood

·Clear direction to employees

For each policy/value pair, you will be asked to select the statement that best connects the value to the policy while also providing clear direction to employees. If you think the best is not good enough, space is provided to explain the improvement you think is needed.

Here is the link: LINK. If you have any questions or run into difficulty, please contact me.

IMPORTANT NOTE: Round 3 closes Wednesday, 6 PM US Mountain Time [Signature]

[Contact information]

In document Remolcador tractor puerto y altura 60 TFP (página 178-184)