Ethical and Legal Assumptions, Capstone Project Example

Information security planning has many ethical and legal assumptions because it is essential for the information technology professional to ensure that their client remains secure. Since the IT specialist has access to their client’s sensitive documents and information, they must first and foremost protect against security breaches. Security breaches can include a number of activities that range from purposeful to accidental distribution of the private information. Potential situations to be aware of in this situation is that it is unethical to distribute a client’s business information for monetary gain and it is inappropriate to leave the information in easily accessible places as to prevent employees, outsiders, or hackers from gaining access to unauthorized data.

It is important for IT personnel to understand that in a situation of neglect, they cannot be charged for committing a criminal offense. However, they will remain liable for their error. Liability is defined as the “the legal obligation of an entity that extends beyond criminal or contract law” and necessitates financial compensation for wrongs committed. The responsibility for this compensation may fall either to the IT employee or their employer depending upon their incorporation, limited liability status, and whether due care standards are met. Ultimately however, the IT company is responsible for educating its workers about the code of ethics that must be followed throughout their work in addition to providing maximal effort to ensure that these ethics are not breached (Whitman et al., 2009).

A useful way for the IT company to protect against ethical and legal breaches is to provide a well-defined policy to their employees that demonstrate acceptable and unacceptable behaviors in the workplace. Although this is an excellent first step in allowing the employees to understand what is expected from them on top of their regular job functions, the IT company would benefit from ensuring that their employees actually read the document. To do so, the employee should sign the policy stating that they have read the document and be given a test to verify that its contents are understood. Employee actions should then be monitored to determine whether or not they are compliant. Finally, these policies need to be enforced uniformly across employee status or job function.

In order to remain in ethical compliance, an IT professional should always ensure the privacy of their client’s information. Federal laws such as the Health Insurance Portability and Accountability Act Of 1996 (HIPAA) define legal requirements of client privacy protection (Wilson, 2006). Although this specific act pertains specifically to the healthcare setting in the protection of patient information and doctor-patient confidentiality, its principles can be applied to a broad range of situations that the IT professional may encounter. Essentially, all of the client’s private information should have restricted access. Data should be password protected and the IT professional should never leave a computer containing company information without ensuring the password protection screen reappears. Furthermore, company data that it stored on portable devices should be limited because this increases the opportunity for it to be accessed by unauthorized individuals. If the information is stored on a flash drive, it should not only be protected, but it would be useful to de-identify the names of individuals associated with financial or other personal information.

If all of the above principles are followed, it is likely that there will not be any safety and privacy concerns during the IT planning sessions.

References

Whitman ME, Mattord HJ. (2009). Principles of Information Security, 3rd Edition. Cengage Learning, pp. 90 – 113.

Wilson J. (2006). Health Insurance Portability and Accountability Act Privacy rule causes ongoing concerns among clinicians and researchers. Ann Intern Med 145 (4): 313–6.