Question

Prior to the first meeting of the RWW Enterprise Policy Review Committee, Mike asked Iris to meet him in his office.

“You’ve convinced me that IT and InfoSec policy are tightly integrated,” Mike said, motioning for Iris to sit down. “And you’ve convinced me that InfoSec policy is critical to this enterprise. Since we are each members of the Enterprise Policy Review Committee, I think we may want to coordinate our efforts when we bring issues up in that group. You agree?”

Iris, who knew how important policy was to her program’s success, smiled.

“Sure, no problem,” she said. “I see it the same way you do, I think.”

“Good,” Mike said. “We’ll work together to make sure the EISP you’ve drafted is integrated with the other top-level enterprise policies. What we need to watch out for now is all the cross-references between the top-level policies and the second-tier and third-tier policies. The entire issue of internal consistency between supporting policies is a problem, especially with getting the HR department policies to integrate fully.”

Iris nodded while Mike continued.

“I want you to take the current HR policy document binder and make a wish list of possible changes,” he said. “You should focus on making sure we get the right references in place. If you can send me the change plan by the end of the weekend, I will have time to review it.”

After reading the case presented in the module, write a short response to the following discussion questions and ethical decision making scenario.

1. Discussion Questions

If the Enterprise Policy Review Committee is not open to the approach that Mike and Iris want to use for structuring InfoSec policies into three tiers, how should Mike and Iris proceed?

Should the CISO (Iris) be assessing HR policies? Why or why not?

2. Ethical Decision Making

Suppose that Iris sends Mike her detailed plan for an EISP along with a draft of a fully revised Enterprise IT Policy, with all of the necessary changes in the supporting policies. Suppose further that, during the Enterprise Policy Review Committee meeting, Charlie submits the revised EISP exactly as Iris has revised it but does not include any reference to the work that Iris did. In fact, Charlie presents the enhanced EISP as his own work.

Has Charlie broken any laws in representing Iris’ policy work as his own?

Has Charlie committed an ethical lapse in doing so, or is he just being inconsiderate?

Answer 1

In order to integrate with the top level policies and also the HR policies, it is good to have come up with the thought of having a three - tier polucy system. However, if the Enterprise Policy review Committe is not in alignment with the three tier approach, Mike and Iris can have a second strategy of integrating the procedures in order to draft a common policy including all the top level IT , HR and generic policies in a single framework rather than three distinguished tiers.

Iris should not herself be assessing the HR Policies, instead should have the HOD of the HR be taking care of integrating the HR poilicies for presenting to the review Committee.

If Charlie comes up presenting the exact changes that Iris' work comprises, it is definitely breaching the laws to be [resenting the work claiming it to be his own. However, it is subjected to discussion that whether Charlie himself has derived the clause. It can very well be so, and not necessarily copying over Iris's work.

Having copied Iris's work, it is definiteely non adherence to the ethical standard and that has no acceptance. Since Mike is aware of the initial work of Iris and the subsequent changed made, he should point out to Charlie in order to accept and withdraw his project, with an enclosed surrender not to repeat any such inconsiderate act further.