Current practice in e-mail policies

Abstract

The aim of this paper is to explore the current practice in e-mail policies, considering how the current threat of cyber incursion is affecting the level of control needed and how user acceptance can be enhanced. This paper bridges a gap between early policy research and current practice as there has been little active research in this field within the past 10 years. A number of e-mail policies and user guides were requested from further education colleges for review within this paper and the common themes identified are used to structure the discussion. From the analysis it became clear that tighter controls need to be offset by enhanced levels of detail provided to users. Where organisations wish to claim ownership and reserve the right to search and use evidence from e-mails, great care needs to be taken to ensure that informed consent is obtained and that potential punitive actions are clearly detailed. Consideration is also made for providing some concessions so users can increase acceptance of restrictive policies and, in the case of e-mail, a straightforward concession is to allow users the right to carry out private communication using organisational e-mail systems. Crucially, restrictive e-mail policies designed to protect the organisation can be implemented effectively, but it requires thorough consideration of the needs of the user.