The Balancing Act: Education vs Enforcement

Reading Time: 3 minutes

Let’s face it – there are very few people in this world who like being told what to do. We often find that suddenly enforcing strict rules and big changes, in both social and working environments, is met with resistance. Questions arise: Why are things changing? Why should I care? What benefit does this have to me? The list goes on…

A good deal of human interaction is based around getting other people to do what we want, but it is the way we propose these changes that will reap the rewards in time, and make that interaction a positive one. Positioning a new process, rule, or system into your organisation needs to clearly highlight the benefits to the new users in order to get their buy in and cooperation. It’s a difficult balance to strike; knowing that a change is going to be made, and there might be confusion and resistance, yet needing to get that buy in from users in order for the new process to work as it should. You often find that once you have educated your peers on the reasoning and benefit behind a change, getting support should be much less of a challenge, and that you have enforced a new “rule” without any users even realising it.

Implementing a data classification solution into your organisation treads that thin line of the requirement for education and enforcement all at the same time. Users who have not yet been familiar with data classification, and the how’s and why’s, will have plenty of questions surrounding the process. There are plenty of ways this can be handled from an organisational point of view, pre-roll out educational campaigns to warn the dangers of not classifying data, and mandatory learning modules (tactics used by Classifier customers Ofgem and Maersk Oil), but the education doesn’t have to stop there.

Boldon James Classifier enables user education to continue after the implementation of the data classification solution throughout your organisation. Simply, where a user has selected a label that may contravene the organisation’s classification policy, Classifier allows for a warning message to be displayed (tailored to the organisation’s own style) that can describe what may be wrong, and offer a means to correct.  However, if the user wishes to continue with the current classification and selected action, that option is also provided, avoiding the risk of blocking the user from completing a standard (and perhaps valid) work activity.

This approach lets users feel their own way through the data classification process, and get an understanding of the labelling requirements on their own; eliminating the strict enforcement of the “right or wrong” culture – where normal working processes are interrupted. Users can make up their own mind as to whether they are correctly classifying the documents; therefore, boosting the security culture within the organisation, as users feel in control of their own work, and can see the positive impact their actions have on the business. Once users have become accustomed to the requirements for document classification, organisations can consider moving towards an enforced approach, if that is seen to be an objective of introducing the classification controls provided by Classifier.

For organisations who already have the makings of a security culture, and users who understand the process of data classification, taking an educational approach is not always necessary. Instead the solution can be implemented with an enforced style, where the option to “Prevent” the creation of documents, or sending of emails, with certain labels can be selected.  In this case, users are not provided with the option to continue with an action, and are forced to address the issue described in the accompanying message, before the requested action can be completed.

Of course, with both approaches there is always more to think about than simply what is easiest for your users to understand. We see organisations concerned that when they implement a data classification solution that after a while, users might get used to seeing warning signs relating to wrongful classification, and simply ignore them for ease of carrying on with their work. This, however, is something that can be monitored using our Classifier Reporting tool, and easily rectified from a management perspective, via further education and/or appropriate changes to the Classifier configuration.

The real message here is – help others to help you. By educating your users to the benefits of data classification, implementing a new solution doesn’t have to be daunting or cumbersome, rather helping them become part of the bigger picture, and each carrying an important responsibility. Speak to us now for a demo at your convenience to show you just how easy it can be.