I am an IT Auditor and the lead for the team. Our team has access to very sensitive data such as:
- Audit findings
- Pen testing results / vulnerability scans
- Audit committee correspondence
If some of these items are not kept confidential prior to being remediated, (e.g: pen test report), then security vulnerabilities of the company may be exploited by insiders. Other items such as audit committee correspondence contain sensitive corporate governance information meant only for a few select teams / individuals to know.
Today, a team member started to discuss information classified as sensitive at lunch where colleagues from multiple outside teams were present. I cut the person off and reminded him not to discuss sensitive issues outside of the select individuals who needs to be privy to this information. This has been the second instance in about 3 months when this team member made the judgment lapse.
All employees take security awareness training annually in which data protection / disclosure is covered. I can be very prescriptive by setting and enforcing rules but want to take a more personable approach to solve this issue. In my profession, (InfoSec and IT GRC), discretion and restraint are necessary traits for an employee to have. In my previous question here, I encouraged team members to rely more on their professional judgement. By taking a prescriptive approach through strict enforcement of rules, I feel I would send a mixed message to the team. Listing exactly what information should / should not be shared with whom is not feasible because the decision depends on circumstances of the situation.
How can I encourage team members to be more discreet and show better restraint when discussing issues without relying solely on enforcement of rules?**