Information security sounds technical, but most of it is everyday habits: locking screens, checking who an email is really from, and not pasting customer details into an AI tool that has not been approved. This guidance explains all of it in plain terms.
This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Guidance number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents
developed over 25 years through practical use in the real world.
Further guidance on information security awareness:
If you'd like hands-on help putting your information security policies and staff awareness in place, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
General Information Security Guidance
A general guidance document on information security, for all employees who handle company information. It explains what information security means, everyone's responsibilities and the day-to-day habits that protect information, from passwords and suspicious emails to working on the move, personal devices, AI tools and reporting something that has gone wrong.
Topics Covered
- What information security means - confidentiality, integrity and availability, whatever form information takes, and what counts as information, from laptops to AI tools
- Your responsibilities - why information security is everyone's job, not only management's or IT's, and what everyone handling information is responsible for
- Day-to-day handling - locking screens, putting confidential paperwork away, collecting printing and challenging people you do not recognise
- Passwords and suspicious emails - keeping logins private, multi-factor authentication, and checking who a message is really from before acting on it
- Sharing and working on the move - what to consider before sharing, and keeping laptops, papers and screens secure away from the workplace
- Personal devices and AI tools - using personal devices only where agreed, avoiding unknown USB sticks, and the questions to ask before using an AI tool
- Common risks and reporting - the everyday risks seen most often, and reporting losses, suspicious messages and possible personal data breaches straight away
Who Is It For?
All employees and anyone else who handles company information, whatever their role, as information security is not only a job for management or IT.
Included in the GDPR / Data Protection Toolkit
This guidance document is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download. The TT-8-01 Information Security - General training talk that carries it is also part of the ISO 27001 and ISO 22301 toolkits.
Using the Guidance
Issue it at induction, go through it with the matching training talk, and keep it as an everyday reference for staff. Record who has received it, for example on the training matrix.
Using AI Tools Safely
The guidance treats AI tools as part of everyday information handling. Before using one with company information, staff ask whether the tool is approved for that information, whether they are on a company account, what they can leave out, and whether they will check the output. It also covers recording meetings with AI and reporting anything entered into an unapproved tool.
Adapting the Guidance
Edit the guidance to match your own arrangements - who staff report to, your approved AI tools, whether personal devices are allowed for work, and the secure connection used for working away from the office.
Related Documents
Other documents that work alongside this guidance:
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation