Signing a Security Policy

[craig1]

On this subject, a recent client's IT Security Manager insisted that I was a fixed-term employee therefore didn't need to go through the hurdles she normally insists on for third party suppliers. Even when I gave her my business card, told her that my contract was with the agency and I hadn't signed a single piece of paper holding me to confidentiality, she said that it was irrelevant as I was a fixed-term employee. She then denied my request for a long-term trusted supplier to be given a guest wifi log-in as it was a security risk in case they copied and sent confidential information!

I gave up at that point and talked to my direct client manager who got me to sign a confidentiality agreement the same day.

[Spikeh]

Heh. I noticed an email going around about appraisals... it'll be interesting to see if what they consider my "line manager" books me in for one or not

[Fred Bloggs]

Well, the upshot of this is that they replied to me and said "thank you" for pointing it out, and they'd create a contractor / 3rd party version

Good result, you have a client who obviously realises it is not in their interest either to make contractors look like employees. In current gig, a staff type assessment form was mailed to all the contractors, "please fill this in and pass on to your line manager" was the request. All the contractors of my aquaintance ignored it and it has been quietly forgotten about.

[Clippy]

You've sent it now, but I'd have been tempted to cross out the word "employee" and try and substitute the appropriate phrasing.

Might have worked.

WHS. Bet no one would have noticed either.

BTW, did you keep a copy for your records.

[Spikeh]

Well, the upshot of this is that they replied to me and said "thank you" for pointing it out, and they'd create a contractor / 3rd party version

[Spikeh]

In an investigation, would/have HMRC gone to the effort to dig up this kind of thing to prove their case?

I really wouldn't like to hazard a guess, hence why I tend to err on the side of caution, rather than wait until the inevitable happens. The problem with this is that it can piss clients off :\

[JamJarST]

In an investigation, would/have HMRC gone to the effort to dig up this kind of thing to prove their case?

[jmo21]

You've sent it now, but I'd have been tempted to cross out the word "employee" and try and substitute the appropriate phrasing.

Might have worked.

[Spikeh]

Well, usually a security policy is for "anyone" who has access to a building... whereas this specifically states that this policy applies to employees.

I've signed countless security / internet policies in the past, but they've all been generic. The way I'm looking at it is that if I sign this document, I'm signing a piece of paper that says I am an employee and I agree to the policy.

Tbh, it's done now... I should probably ask advice before I reply to these things...

[northernladuk]

You have to apply some common sense here. If you are going to be on site you come under the scrutiny of their security and you also have to observe their policies keeping them safe. The same goes for H&S. The fact it isn't worded to the level that includes you is neither here nor there. They don't have time to be re-wording it for every group of people.

Just because you are not named on it it does not mean you are absolved or any responsibility or can be held to account for security on site.

It is a policy and they are checking you have read and agreed. It isn't a contract or legal document that needs to be worded so tightly.

[Spikeh]

Hi there,

A recent client has asked me to sign a security policy for access to the building. Whilst this is not usually a problem, the wording in this particular policy is aimed strongly towards "Employees" and "Line managers / supervisors". I've emailed the "facilities" team back outlining that the policy does not apply to me as an outside contractor... but I would be happy to sign a 3rd party version of it.

I'm starting to think I'm being a bit unreasonable / paranoid. Am I doing the right thing by requesting a contractor / 3rd party version, or am I being too anal about it all? I make sure all of the contracts I take on are service provision contracts, and try my best to maintain a B2B relationship with all of my clients, I'm just not sure that little things like this make a big difference in the long run? I even went down the route of refusing to give them my next of kin details initially, though I ended up giving in with that one as I'm working in their office, at the end of the day.