What to Include in Your Employee Handbook

by Sarah Harvey / December 30th, 2019

What’s the purpose of an employee handbook? Why are you required to have a detailed employee handbook to be compliant with information security standards? What should you include in your employee handbook to meet these standards? These are all great questions you might have when you’re preparing for an audit. Let’s start with a quick explanation of the purpose of an employee handbook and how a well-designed handbook can add to your information security policy.

Why Does an Employee Handbook Matter to Your Information Security Policy?

Your employee handbook is the center of your company culture. It answers the questions that your employees have about your policies surrounding employee conduct, benefits, and more. Without it, your organization wouldn’t have a standardized way of addressing these general employment topics and employees wouldn’t know what is expected of them in the workplace. If this baseline isn’t established, how could you expect your employees to follow other, more complex policies?

On the most basic level, your employee handbook should include the following sections:

General Employment
Employment Status and Record Keeping
Working Conditions and Hours
Employee Conduct
Employee Benefits
Timekeeping and Payroll

While this list of policies to include in an employee handbook isn’t exhaustive, it is a great example of where you can start developing information security policies that will help you comply with information security standards.

The purpose of developing strong information security policies is to minimize risks to your organization and protect against vulnerabilities. By giving your employees clear guidelines on security procedures, you’re enabling your organization to be better protected against security risks. Whether you’re completing a HIPAA audit or a SOC 2 audit, you can expect your information security policies to be tested for clarity, detail, and accuracy.

So, what role does your employee handbook have in an information security audit? In any audit, you will be asked to provide your employee handbook and it will be reviewed for clarity, detail, and accuracy. It’s important for your employees to understand your policies comprehensively in order to put proper security procedures in place. If they don’t understand your employee conduct policy, could that lead to malicious activity? If they aren’t away of your Internet usage policy, could that open your organization up to more risks? On the other hand, if you don’t have an employee handbook, how can your auditor gauge the integrity and culture at your organization?

At KirkpatrickPrice, our clients upload their employee handbook and other information security policies into the Online Audit Manager for auditors and audit support staff to review. Instead of sending files back and forth insecurely, you can do it all in a simple action in the Online Audit Manager. This is all part of our streamlining process so that most of the work involved in the audit is done online.

Make sure you’re working with an auditor, like our senior-level Information Security Specialists at KirkpatrickPrice, who will properly review your employee handbook and other information security policies during the audit process. Don’t wait until it’s too late to make sure your policies comply with information security standards, contact us today!