CYA

The weekend is almost here! We hope your work week was fun, challenging, and drama-free. We read a wheelbarrow full of articles to find the best HR and policy management content for your reading pleasure. Enjoy and have an awesome Saturday (and Sunday)!

Want The Bugle emailed to you every week? Sign up for our newsletter.

✦ ✦ ✦

Article of the Week: This week’s highlighted piece (look for the ✦ below) takes a “Moneyball” approach to hiring. We like it because (a) we like baseball and (b) finding creative ways to grow your company gives you a competitive advantage. What other under-valued objects have you discovered and utilized to your advantage?

Friday Friday Friday. Another week in the books. You deserve a break. How’s 2 days off sound? Until then, we’ve gathered the best HR and policy management resources to help you get ever so closer to the weekend.

Want The Bugle emailed to you every week? Sign up for our newsletter.

✦ ✦ ✦

Article of the Week: This week’s highlighted piece (look for the ✦ below) takes a deep look at the unspoken things that make some people great at their job and others… not so much. There are also 5 lists that would be great inspiration for someone creating content around core values.

The importance of safeguarding your company’s and your company’s customers’ data is obvious. Since I wrote about data breaches a year ago in regards to how to place a security freeze to prevent identity theft, the list of prominent organizations who’ve suffered from data breaches is long. Disney, Hillary Clinton’s campaign, the Democratic National Committee, the University of Connecticut, hotel(s)… the list goes on – and that’s just in the last 45 days!

Your company can reduce the risk of a data breach by having strong data safeguards in place. A great way to disseminate these data safeguards with an Information and Data Security Policy in your employee handbook. This article covers an overview of all the different information that you may want to include in your data security policy, which is essential for protecting sensitive data.

Passwords

Most data breaches do not happen as depicted in the movies. They typically start with access to one person’s account via social engineering and spread from there. That’s why it’s important that every employee puts in the effort to keep their accounts secure.

Your IT staff should decide how passwords are created, stored, shared, and communicated. Many companies use services like 1Password, Dashlane, or LastPass to accomplish these tasks. If you do use those services, make sure employees know how to set them up and use them.

Other Secret Information

Provide guidance on how employees can securely communicate sensitive information, such as credit card numbers, social security numbers, license keys, and so on. This information should never be written down on paper that can be misplaced or stolen, and it should not be recorded in any software that stores it forever (like email).

IT Infrastructure

There are many things to consider for how to handle security for your IT infrastructure. Your IT staff will likely have a list of things to communicate. In general, here’s what should be covered.

General Info

How to use IT infrastructure. You probably want to mention things like:

• No malevolent hacking.
• No illegal activity.
• Keep confidential information safe.
• Respect copyright laws.
• Keep your web browsing PG-13.

Privacy

Be clear that your company owns all IT infrastructure (hardware and software) distributed to employees and that you have the right to access and/or monitor it at any time.

Personal Use

Most company devices are used for some amount of non-work related activity. Employees should be informed of any requirements around this use. If there’s a lot to say, consider creating a separate “Communication Systems and Acceptable Use” policy. Stand-alone BYOD (Bring Your Own Device) policies are fairly common nowadays as well.

Operational Security

If your company, like ours, stores confidential information on software or hardware you’ve created, you should outline how that data is secured. Describe rules/guidelines around:

• Password management for your servers and databases
• Software updates (how and when)
• Database backups
• Application security best practices
• API keys
• Access control to the databases, code, servers, and physical hardware
• How activity is logged and who can access that data
• Intrusion detection

Network Security

Tell employees about a VPN, the company’s WiFi, or any requirements when using public WiFi.

—-

That about wraps it up. A good Data Security Policy will go a long way towards helping your employees keep confidential information secure. Every employee handbook should have one! For that reason, we’ve added a basic one to the starter handbook that every new Blissbook customer gets when they sign up.

If you want to see a specific example policy, take a look at our Information and Data Security Policy, which serves as a practical example of an effective data security policy.

This week we released some exciting changes to the Blissbook platform. Although many of the changes are under the surface, there are a couple of new features that you can take advantage of right now.

Documentation Center

The main update is the conversion of the Dashboard page to the Document Center. The Documentation Center puts all the documentation you would ever need for an employee in one place, easily accessible and printable with just a couple clicks.

You’ll notice a new column: Communications! Blissbook now keeps track of all the communications you’ve sent to your users.

You can click any of the dates within these columns to see a detailed report for any user. You can even print that report to a PDF.

Users Tracked By ID

In order to implement this change, we changed the way Blissbook keeps track of users. It’s now done by ID, rather than email address. That means you can now change someone’s email address and we’ll track them as the same person and keep their documentation in order.

It also means we can handle archived users much better. You now have self-serve access to reporting for archived users.

These two changes set us up for some big improvements this summer. Custom notifications! Repeat signatures! Self-service to old versions of your handbook! We’re also working on increased video support and a new editor to make customizing your handbook even easier.

Other Changes

• Support for two new SSO options: Office 365 and Okta. If your company uses either of these services, you can enable them on your Integrations tab to make it easy for users to sign in to their Blissbook.
• Searching your published handbook is better – you can now see what chapter or section text belongs to within the search results.
• Using our variable content feature? You should now see tags for the sections or chapters for which it’s enabled. You no longer need to open the access control modal to see what your settings are.
• Is Blissbook down? Probably not… our uptime is over 99.9%. See for yourself on our new status page: https://status.blissbook.com
• Lots of minor bug fixes and upgrades to the Blissbook technology.

We’re looking forward to a fun summer here at Blissbook. Stay cool out there!

It seems like every month there’s a new story of a company being hacked. Earlier this year it was Anthem / Blue Cross Blue Shield and last year it was Target (who recently settled for $10mm) and Home Depot. The most recent incident was a couple weeks ago when the US Government’s Office of Personnel Management was hacked.

This one hit home for me. Many years ago, I passed all the necessary tests to be a Foreign Service Officer. This included a thorough background check, which includes where I’ve lived, where I’ve traveled, any drugs I’ve ever taken, and extensive personal information of my friends and family. It’s all now in the hands of the Chinese government and whoever else they sell/give it to. Oops.

Think this problem is going away? Not a chance.

Now, although it’s up to IT/IS departments to keep information safe, there is something HR can do to help their employees prevent identity theft.

Have them place a security freeze on their credit report.

Pace Salsa seemed to have had a pretty epic social media failure over the weekend, which the Huffington Post covers pretty well. The twitter conversation contains a ton of intrigue, including:

• Robots
• Salsa blackmail
• Fake Twitter accounts
• Employees trying to get others fired

Pretty great, huh? Too bad it was totally fake! But for training purposes, let’s pretend it was real. The obvious lesson is not to automate your Twitter account. Twitter is simply another communication channel and you wouldn’t automate your responses to support emails, would you? Didn’t think so.

Josh, a new dad, is suing his employer, Time Warner, for discrimination because they won’t give him the same 10 weeks paid leave that they give new moms and new adoptive parents (dads included). His claim is discrimination. If these other classes of people get that benefit, why not him?

What’s the Law Say?

The Family Medical Leave Act requires an employer to allow 12 weeks of unpaid leave to care for a new child. If both parents work at the same company, those 12 weeks can be split any way the parents choose (but they’re still capped at 12 weeks). Employers may also require employees to exhaust paid leave options first before unpaid leave kicks in. Employees can elect to do this anyway if they so desire.

There is no law that says employers must provide paid leave to employees. That makes this case purely about discrimination. Or is it?

Since we launched Blissbook, we’ve done a lot of talking with customers about the content that goes into one. We classify this information into three categories: culture, onboarding / general information, and case-specific. Although no Blissbook is the same, they will all contain one or more of these types of information.

Culture

Defining company culture is hard. Is it chemistry? Fun things people like to do together? How employees or customers are treated? It could be all of those things, but we agree with Rand Fishkin in that company culture can be boiled down to the following:

• What you believe in and why your company exists (your mission and guiding principles).
• Who you collectively are deep down inside (your core values).
• Whether or not you respect these things (how you hire, reward and release people).

These are not shallow questions and they require deep thought. There should also be collaboration with all employees within a company so that everyone is bought in and the culture reflects everyone’s belief of what the company is, not just leadership’s view of it.

We wrote a guest article on Zen Payroll’s blog about the new Employee Handbooks that companies are putting out these days, how they differ from the handbooks of old, and when companies should think about getting either one of them.

Here’s how the article starts…

Traditionally, employee handbooks have been snooze-inducing legal documents crafted or at least reviewed by a lawyer with the goal of protecting an employer from lawsuits and fines. But the definition of an employee handbook is expanding. Recently, companies have begun using employee handbooks in a different way: to define and publish their company culture for employees and recruits alike. These culture handbooks set the tone for interactions throughout a company and paint a picture of what new employees can expect upon joining. So when do handbooks matter to you, and which kind should you have? Depending on your company’s size, you may have one, both, or none.

Check out the full article on Zen Payroll’s blog.

Photo credit: This is Zappo’s 2011 Culture Book.