IAP301 - Lab 2
Lab #2: Develop an Organization-Wide
Policy Framework Implementation Plan
INSTRUCTOR: Hoang Tuan Anh
anhht68@[Link]
Learning Objectives and Outcomes
Upon completing this lab, students will be able to complete the following tasks:
● Identify human nature and behavior patterns of employee types in both hierarchical and
flat organizational structures
● Overcome user apathy with security awareness techniques in both hierarchical and flat
organizational structures
● Identify how security policies can help shape organizational behavior and culture in both
hierarchical and flat organizational structures
● Compare a hierarchical and flat organizational structure to equivalent IT security policy
framework structures
● Create an organizational policy implementation plan for the combined organization
1
Lab #2 – Organization-Wide Policy Framework Implementation
Plan Worksheet
Course Name: IAP301
Student Name: Chử Lê Minh Đăng
Lab Due Date: 18:00 PM; 16/1/2025
Overview
In this lab, you are to create an organization-wide policy framework implementation plan for
two organizations that are merging. The parent organization is a medical clinic under HIPAA
compliance law. They recently acquired a remote medical clinic that provides a specialty
service. This clinic is organized in a flat structure, but the parent organization is organized in a
hierarchical structure with many departments and medical clinics.
Instructions
Using Microsoft Word, create a Policy Framework Implementation Plan according to
the following policy implementation plan outline:
● Publish Your Policies for the Acquired Clinic – {Explain your strategy} ● Communicate
Your Policies to the Acquired Clinic Employees – {How are you going to do this?}
● Involve Human Resources & Executive Management - {How do you do this smoothly?}
● Incorporate Security Awareness and Training for the New Clinic – {How can you make
this fun and engaging?}
● Release a Monthly Organization-Wide Newsletter for All – {How can you make this short
and to the point?}
● Implement Security Reminders on System Login Screens for All – {For access to
sensitive systems only}
● Incorporate On-Going Security Policy Maintenance for All – {Review and obtain feedback
from employees and policy compliance monitoring}
● Obtain Employee Questions or Feedback for Policy Board – {Review and incorporate into
policy edits and changes as needed}
3
Parent Medical Clinic
Acquires Specialty Medical Clinic
Publish Your Policies for the New Clinic
Strategy:
• Centralized Policy Repository: Create a centralized digital platform (e.g., intranet,
document management system) for accessing all policies.
• Policy Summary Documents: Provide concise, plain-language summaries alongside the
full policies to ensure quick understanding.
• Department-Specific Customization: Highlight relevant policies for each department,
focusing on their specific operational needs.
• Launch Announcement: Communicate the availability of the policies through emails,
team meetings, and announcements from leadership.
Communicate Your Policies to the New Clinic Employees
• Town Hall Meetings: Host live sessions to introduce essential policies and answer
questions.
• Welcome Packets: Include policy summaries and access information in onboarding
materials.
• Online Training Modules: Develop interactive modules explaining key policies, with
completion tracking.
• Designated Point of Contact: Establish a dedicated liaison for policy inquiries and
clarifications.
• Peer-to-Peer Support: Encourage experienced employees from the parent organization
to offer informal guidance.
Involve Human Resources & Executive Management
• HR Integration: Involve HR from both clinics in reviewing and adapting policies to ensure
fairness and alignment.
• Executive Sponsorship: Secure commitment from executives in both organizations to
prioritize smooth policy integration.
• Joint Policy Review Committee: Establish a committee with representatives from both
clinics to assess and update policies collaboratively.
Incorporate Security Awareness and Training for the New Clinic
• Interactive Workshops: Conduct engaging workshops that combine theoretical
knowledge with real-world scenarios and simulations.
• Gamification: Utilize gamified elements like badges, leaderboards, and quizzes to
increase engagement and knowledge retention.
Release a Monthly Organization Wide Newsletter for All
• Interactive elements: Include polls, quizzes, or Q&A sections to encourage engagement
and feedback.
• Multiple Formats: Offer email, print, and intranet versions for wider accessibility.
Implement Security Reminders on System Login Screens for All
• Visual impact: Utilize engaging visuals and clear language to capture attention and
reinforce memory.
• Customization: Allow for occasional theme changes and updates to maintain
effectiveness.
Incorporate On-Going Security Policy Maintenance for All
Review and Feedback Strategy:
• Regular Feedback Cycles: Conduct semi-annual reviews of policies with employee input.
• Anonymous Surveys: Use anonymous forms to encourage honest feedback on policy
effectiveness and clarity.
• Policy Monitoring Metrics: Track incidents, compliance rates, and feedback trends to
identify areas needing updates.
• Policy Champions: Appoint department-level champions to gather insights and act as
liaisons during reviews.
Obtain Employee Questions or Feedback for Policy Board
How to Review and Incorporate Input:
• Dedicated Feedback Portal: Create an online platform where employees can submit
questions or suggestions.
• Policy Board Meetings: Schedule regular meetings to review employee feedback and
prioritize changes.
• Transparent Updates: Publish a “What We Heard” section in the monthly newsletter to
show how feedback is being acted upon.
• Focus Groups: Organize small focus groups to discuss proposed changes and gather
additional insights.
Note: Your policy framework implementation plan should be no more than three pages long.
4
Lab Assessment Questions & Answers
1. What are the differences between a Flat and Hierarchical organizations?
• Flat Organization:
o Few or no levels of middle management.
o Promotes open communication and collaboration.
o Employees often have more autonomy.
o Decisions are made quickly due to fewer layers of approval.
• Hierarchical Organization:
o Clearly defined levels of authority and responsibility.
o Structured reporting relationships.
o Decisions take longer due to formal approval processes.
o Clear chain of command, but less flexibility.
2. Do employees behave differently in a flat versus hierarchical organizational
structure?
• Flat Organizations:
o Employees are more self-directed and collaborative.
o Open communication encourages innovation and idea sharing.
o May experience ambiguity in roles and responsibilities.
• Hierarchical Organizations:
o Employees tend to follow defined roles and processes.
o Clear authority can create stability and order.
o Communication is often top-down, limiting innovation.
3. Do employee personality types differ between these organizations?
• Flat Organizations:
o Attract individuals who are independent, adaptable, and thrive in collaborative
settings.
o Suited for creative, entrepreneurial, or risk-tolerant personalities.
• Hierarchical Organizations:
o Attract individuals who prefer structure, stability, and clear expectations.
o Suited for methodical, detail-oriented, and authority-respecting personalities.
4. What makes it difficult for implementation in flat organizations?
• Difficulty in managing larger teams due to lack of middle management.
• Role ambiguity can lead to confusion and inefficiency.
• Decision-making can become chaotic without clear leadership.
• Employees unaccustomed to autonomy may struggle.
5. What makes it difficult for implementation in hierarchical organizations?
• Slower decision-making due to bureaucracy.
• Employees may feel disconnected from leadership.
• Creativity and innovation may be stifled by rigid structures.
• Resistance to change due to entrenched processes.
6. How do you overcome employee apathy towards policy compliance?
• Engage Employees: Involve them in policy creation and revisions.
• Education and Awareness: Provide clear training on the importance of
policies.
• Positive Reinforcement: Recognize and reward compliance.
• Make It Relevant: Show how policies impact their roles and the organization’s
success.
• Simplify Policies: Ensure they are easy to understand and implement.
7. What solution makes sense for the merging of policy frameworks from both a flat
and hierarchical organizational structure?
• Common Principles: Identify shared goals and core values.
• Flexibility: Design adaptable policies that cater to both structures.
• Stakeholder Input: Involve representatives from both organizational types.
• Pilot Programs: Test combined policies on smaller teams before organization-
wide implementation.
• Unified Communication: Ensure transparency and consistency in messaging.
8. What type of disciplinary action should organizations take for information systems
security violations?
• Tiered Approach Based on Severity:
1. Minor Violations: Verbal or written warnings.
2. Moderate Violations: Mandatory retraining and probation.
3. Severe Violations: Suspension, termination, or legal action.
• Documentation: Ensure actions are clearly documented and
communicated.
• Consistency: Apply policies uniformly to all employees.
9. What is the most important element to have in policy implementation?
• Leadership Commitment: Strong support and involvement
from top management to set the tone for compliance and
importance.
10. What is the most important element to have in policy enforcement?
• Consistency: Uniform and impartial enforcement across all
levels of the organization to maintain credibility and
effectiveness.
