News Opinion Practical Security
Practical Security: installers have an obligation to treat customer data with care

Working in the security systems world is unique in many ways.

We have the privilege of being allowed inside people’s businesses and homes throughout the country, and trusted with their personal and business information.

It is something we do on a daily basis and most of us rarely give a thought to the level of privacy with which we are entrusted. I have frequently seen service vans parked with installation details, completed monitoring agreements or other documentation on the dash, seat or other visible surface.

This applies to everyone from the newest employees at independent security installers right up to the corporate folks at the national integrator level. Everyone in your company is equal in this responsibility, from your administration staff to the person dispatched to perform the work. We need to think about the level of trust that is assigned to us and respond accordingly.

First and foremost, everyone who has access to personal or confidential information must be required to sign an acknowledgement of confidentiality. While this alone cannot prevent someone from breaching confidential information, it does convey the responsibility of your company and the employees to protect client information. While it may transfer the onus to the employee to a degree, your company also bears a level of responsibility.

Depending on the nature of your contractual obligations, you may opt to seek legal advice to compile an appropriate confidentiality agreement. It should be noted that a confidentiality agreement is different than an NDA (non disclosure agreement) which is traditionally used to protect companies from employees sharing information specific to business for competitive purposes.

Next, we have to consider that the work we do is in sync with protecting the confidentiality of our clients at all levels. Depending on the nature of the client, their security levels may increase. An individual homeowner deserves the same protection as a corporate or government entity, although corporate and government organizations typically have established security protocols which your company is required to follow. The absolute basics you need to consider would be:

• Determine confidentiality or security requirements prior to the installation
• Establish and program passwords, not using manufacturer defaults
• Advise clients of any inherent security issues you are aware of
• Protect your client account information within your company
• Recommend installation of security updates or patches for software and hardware
• Ensure devices are compliant, based on client requirements
• Provide solutions based on the needs of your client from both an operational and a functional security position

As I stated above, these are very basic considerations. Keeping security in mind is the objective in the services we provide.

Many companies provide their client with a service agreement, or SLA. This is a useful tool in clarifying the expectations from both parties. SLAs also provide the opportunity to fix security flaws or bugs that may lead to a breach. With many commercial security products on the market today you have to purchase an SLA to access tech support from the manufacturer. I encourage the use of an SLA where it benefits both the client and service provider.

Much like organizations that have daily safety talks, we need to have security talks. Do employees know how to protect their clients? Do they know what is to be protected? Do they know what to do if there is a breach? Are they trained in your security protocols? The answer to all of these questions needs to be yes.

Technical hardware or software might be what we do but security is what we provide. The installation of a security system should enhance your client’s security, not compromise it.

Roger Miller is the president of Northeastern Protection Service Inc. (www.protectionpartner.ca).