
270 ◾ Information Security Management Handbook
that can and cannot be used or posted when at the office, when away from the office, and when
using personally owned computing devices. e key is to make the policy about the information.
Generally, businesses cannot control how people conduct their personal lives away from the office,
or how they use their own computers, but they can specify how patient information, business
information, customer information, employee information, and other company information assets
can and cannot be used or shared, no matter the location or device ownership.
Business policies should describe the appropriate use of ...