Small Business Corner

Lapses in physical security can expose sensitive company data to identity theft, with potentially serious consequences. For example: An employee accidentally leaves a flash drive on a coffeehouse table. When he returns hours later to get it, the drive — with hundreds of Social Security numbers saved on it — is gone. Another employee throws stacks of old company bank records into a trash can, where a criminal finds them after business hours. A burglar steals files and computers from your office after entering through an unlocked window.

HOW TO PROTECT EQUIPMENT AND PAPER FILES. The starting point for any business is an up-to-date inventory of computers, flash drives, point-of-sale devices, files, etc. If they contain sensitive information, they belong in a secure part of your facility or in a locked file or cabinet. Make it office policy to log out of your network and applications when not in use. Never leave sensitive data unattended and limit access to employees who need the data to do their jobs.

HOW TO PROTECT DATA ON YOUR DEVICES. The second step is to protect the data on those devices. Require passwords that are long, complex, and unique. To access parts of your network where sensitive information is kept, use multi-factor authentication. In other words, in addition to logging on with a password, require something extra like a temporary code on a smartphone or a key inserted into a computer. To stymie hackers, block access after several unsuccessful login attempts. Use encryption on laptops, flash drives, etc., that store sensitive data. Also encrypt confidential information you send outside of your company.

TRAIN YOUR EMPLOYEES. Talk about physical security at an upcoming staff meeting. There’s no need to start from scratch, the FTC’s resources make it easier to enlist your staff in your cybersecurity efforts. Use their factsheet to guide the discussion. Train your staff to maintain effective physical security even if working remotely from home or on business travel. And every employee should know what to do if a device or confidential file goes missing.All staff should know what to do if equipment or paper files are lost or stolen, including whom to notify and what to do next. Use Data Breach Response: A Guide for Business for help creating a response plan. You can find it at FTC.gov/DataBreach.

This information originally appeared on the website of the Federal Trade Commission. Visit the Federal Trade Commission Business Center for more small business resources.