Security isn't just about technology, it's about human resources. There's no point having a great security policy in place if people ignore it, and the technology won't be any help if you've left an important server and the data it contains in an unsecured ground floor room, not monitored by a security guard or a CCTV camera. Furthermore, does your organisation properly vet prospective employees or contractors? Your network perimeter security may be robust, but will it protect your information assets from rogue cleaning staff with physical access to systems?

Unless you're relaxed about people wandering in and out of your offices as they please, there's a need to formalise procedures for chaperoning visitors to your premises, especially if they are anywhere near desktop computers that might be used to access electronic data, or paper storage facilities. One company called us in to help after a week's worth of unencrypted data back-up tapes were stolen from an open plan office, where they had been left unattended. We were able to show them how to encrypt the tapes in future, and advised them on changing their back-up tape storage procedures, including keeping the tapes off-site.