Siren's Song
There's a lot of interest in buying policy and procedure software, even outsourcing policy development. Tools such as IDS' PowerDMS or Policy Technology's Policy and Procedure Manager are essentially document-management and workflow products--good stuff, and relatively inexpensive to test out; licenses for Policy Tech's product, which provides structured management of documents, start at $1,095 per user plus $197 annually. But again, definitely no silver bullets.
Whether you choose purpose-built document management software for policies and procedures, you'll still need to do an assessment of your organization's potential risks and benefits, and then generate and edit the policy. Sure, policy and procedure software can do a good job of centralizing document approvals, but so can a free Wiki. Be suspicious of software that claims to have lots of templates "perfect" for your organization.
"Like politics, all policies are local," says Jim Kennedy, vice president of IT at United First Federal Credit Union. "They are a guideline at best. I use [policy and procedure apps] as a background briefing before I write the real policy." When we spoke with Kennedy, he had just finished revising the latest version of the financial institution's disaster-recovery policy set, and he pointed to the example of how the risks of his mid-state branches are different from the coastal areas, saying, "Not everyone needs to do tsunami planning."
For broad-brush compliance, a hosting service provider can step in. "A lot of midsize companies can't do their own buildout of a security or compliance organization--they don't have the financial or human resources to deal with it, so they look to third parties," says RackSpace's Engates.
If you do go with a provider, be clear about parameters. Even RackSpace, the hosting provider we spoke to for this article, admits its services are no panacea.
"From the perspective of the security interface, it's important that we establish where hosting company versus customer responsibility stops and starts," Filer says. "This is one of the hardest things because you have to look at the overall business." Translation: You have ultimate responsibility for your organization's compliance.
If you decide to bring in outside help, choose a consultant with deep experience in your industry. This is not the time for on-the-job training as someone tries to become expert in your business' policy requirements.
