Title: Security Considerations for Nonemployees
Course: IN 2001 Principle of Information Assurance > Section: Module 11: Chapter 11

Security Considerations for Nonemployees
1. A number of individuals who are not subject to rigorous screening, contractual obligations and eventual secured termination often have access to sensitive organizational information.
2. Relationships with individuals in this category should be carefully managed to prevent a possible information leak or theft.

Temporary Employees
1. Temporary employees are hired by the organization to serve in a temporary position or to supplement the existing workforce.
2. These employees may be paid employees of a “temp agency” or a similar organization.
3. As they are not employed by the host organization, they are often not subject to the contractual obligations or general policies of other employees.
4. If these individuals breach a policy or cause a problem, the strongest action the host organization can take is to terminate their relationships with the individuals and request that they be censured.
5. From a security standpoint, access to information for these individuals should be limited to that which is necessary for them to perform their duties.
6. The organization can attempt to have temporary employees sign nondisclosure agreements and fair use policies, but a temp agency may refuse, forcing the organization to either dismiss the temp worker or allow him or her to work without the agreement.
7. Ensure that the temp worker’s supervisor restricts the information to which the temp has access and makes sure all employees follow good security practices, especially those practices relating to clean desk policies and the security of classified data.

Contract Employees
1. Contract employees are typically hired to perform specific services for the organization.  The host company often makes a contract with a parent organization rather than with an individual for a particular task.
2. Although some individuals may require access to virtually all areas of the organization to do their jobs, they seldom need access to information or information resources.  Contract employees may need access to various facilities; however, this does not mean they should be allowed to wander freely in and out of buildings.
3. In a secure facility, all contract employees are escorted from room to room, as well as into and out of the facility.  Certain restrictions or requirements should also be negotiated into the contract agreements when they are activated.

Consultants
1. Consultants should be handled like contract employees, with special requirements for information or facility access integrated into the contract before they are allowed outside the conference room.
2. Security and technology consultants especially must be prescreened, escorted, and subjected to nondisclosure agreements to protect the organization from possible intentional or accidental breaches of confidentiality. Just because you pay a security consultant, doesn’t make the protection of your information his or her number one priority.

Business Partners
1. On occasion, businesses find themselves in strategic alliances with other organizations that want to exchange information, integrate systems or simply discuss operations for mutual advantage.  There must be a meticulous, deliberate process of determining what information is to be exchanged, in what format, and to whom.
2. Nondisclosure agreements must be in place and the level of security of both systems must be examined before any physical integration takes place, because when systems are connected, the vulnerability of one system becomes the vulnerability of all.