Corporate Policy - Security vs Usability

I'm taking a break from my series on net neutrality to discuss IT policy at the company level (as opposed to the national/international level). Recently my firm was acquired by a much larger company and over the last week or so we acquired employees have been working through the elements of the transition. While both companies have been excellent in communicating changes and keeping a positive attitude throughout, there have definitely been some "hiccups".

As a consultants our primary concern is always client service. The merger, to the say the least, has been a distraction in serving our clients. We push through, but there is a noticeable impact to our clients as our time and effort is divided between their work and our own transition. This impact has been exacerbated by a slew of technology changes we must handle. We've gone from using Microsoft Outlook, a simple, easy to use and functional email program to Lotus Notes, a program without a major overhaul in 20 years. Our corporate IT policy does not allow Outlook and has stifled our creative efforts to use it (DAMO and other tools). Additionally, corporate policy mandates the use of Microsoft Internet Explorer and actively scans for installs of other browsers to delete them. Anyone who has used Chrome knows how much faster, easier and more intuitive it is. Lastly, we have an auto-backup program that backs up our machines on a daily basis. This is a great idea. However, the backup can not be scheduled person by person, it is randomized to efficiently utilize network resources. This can be a really big hassle when a consultant is using his/her machine to deliver a PowerPoint presentation and suddenly the backup utility kicks on and zaps the CPU/memory of the machine.

Each of these policies was set up with noble intentions. Outlook is not as secure as Lotus Notes and Notes has phenomenal back-end DB capabilities. IE is the corporate standard for browsers and minimizes compatibility risks. Regular backups are an essential part of any corporate risk mitigation/disaster recovery plan. However, the consequences of these policies have, perhaps, not been fully explored. Moving 600 consultants used to Outlook, Chrome, and on-demand backups to these new policies has severely impacted our ability to help our clients. We spend more time re-booting, more time fighting with our email and more time waiting for web pages to load. All this means we have less time (or less sleep) to help our clients. (This doesn't even include the consultants who were forced to give up their Macs for ThinkPads.

When designing IT policy (or integrating a new company with conflicting IT policies), it's important to keep the ultimate goal in mind. When policy or process impedes progress, a company must seriously re-evaluate. Now, it's been less than 2 weeks and I'm sure the learning curve is steep, but this a good example of the impact IT Policy can have on a business and it's customers.

Good Talk,
Tom