![]()
CHAPTER 1:
PUTTING IT INDUCTION IN PERSPECTIVE
Do you find the terms IT Induction and IT Introduction being used interchangeably? If yes, then it is also likely that you will have new employees in your organisation who, being IT competent, are wondering why they need to attend an IT Introduction programme, and are most likely raising objections at such a proposition. Understandably so. If you are not experiencing a conflict of these terms then you are in an enviable position.
To explain:
Introduction is about a first experience of a subject or activity, so you would expect an IT Introduction programme to focus on instruction on how to use IT, a skills-based training event for instance, and unlike induction, an introduction has a conclusion, an end point.
Induction on the other hand is less open and closed because it is educational in nature and focuses on expected behaviour as much as it does on sharing knowledge, and has little relationship to IT competencies. The aim of any induction process is to help new employees make a smooth and informed transition to their new workplace, ensuring all the basic information they need is available to them, so they are in a position to adapt quickly to their new role.
This pocket guide refers therefore to IT Induction as an educational programme or activity that informs staff within an organisation about the IT3 facilities and services available to them, brings their attention to current IT policies and guidelines, and emphasises individual responsibilities through good working practices.
So what is the relationship between IT Induction and Information Security Awareness?
Information Security is fundamentally about safeguarding information, and is based on the CIA principles:
ā¢ Confidentiality: ensuring information can only be accessed by those who are authorised to do so.
ā¢ Integrity: ensuring the information is accurate and can be trusted.
ā¢ Availability: ensuring the information is available when it is needed.
Hence, Information Security Awareness focuses on the userās responsibility, to ensure that good working practices are adopted under these broad principles, thereby reducing the likelihood to the organisation (and to some extent the individual) of legal, financial and reputational risk. Figure 1 shows how Information Security Awareness becomes an integral part of a holistic IT Induction programme.
From Figure 1 it can be deduced that either removing or limiting any of the elements of the IT Induction programme will have the overall effect of reducing the Information Security Awareness impact, which would not only be a missed opportunity, but may also prove to be a costly one.
How does an ICT Code of Conduct fit with IT Induction?
An employee ICT Code of Conduct or Acceptable Use Policy (AUP) is a document that sets out certain rules and guidelines that an employee is expected to follow whilst using the organisationās information systems, and will indicate what would constitute an infringement of these guidelines and the penalties of doing so. Depending on the organisation, the employee may be required to sign the Code of Conduct as part of their employee contract or before being given access to the organisationās information systems. Consequently, the ICT Code of Conduct sits within the IT Policies and Guidelines element of IT Induction, as shown in Figure 1, and is therefore an integral part of the programme. It would thus make logical sense for a new employee to undertake the IT Induction programme prior to signing the Code of Conduct, as this will give the document more significance.
In summary, this chapter has distinguished between IT Introduction and IT Induction. It has indicated three key content areas for the IT Induction programme, and shown how these overlap to bring about integral Information Security Awareness opportunities into the programme.
![]()
CHAPTER 2:
THE TARGET AUDIENCE
Generally, organisations provide an induction for all new employees, and this may be a generic programme or tailored to meet job profiles. As this pocket guide is focusing on IT Induction, does this change the target audience, and should IT Induction be specific to job profiles?
Certainly there is a valid argument that tailoring an induction programme to specific roles is likely to be more effective than a generic stance, although more time-consuming and potentially more expensive to develop and deliver. For instance, there may be a number of specialist IT roles in your organisation, including staff in the IT department, who would benefit from a customised IT Induction; however, it may also be your view that this approach may be too detailed and excessive for your organisational requirements, or could be managed by an alternative route.
Assuming, for practicality purposes, a generic IT Induction programme is planned, it would seem reasonable to assume that the target audience for this programme would be any new employee who requires access to the organisationās information systems, also known as a ānew userā. This compares with an employee induction, where it is unlikely that anyone would be excluded from this knowledge-sharing activity.
Having established the target audience for the IT Induction programme let us now explore the types of new users you may encounter in your organisation.
A new user is generally understood to be an employee who has just taken up an appointment in the organisation. The Human Resources (HR) department will know of this individual as a consequence of recruitment and payroll tasks, and the new employee would have been identified as requiring access to the organisationās information systems resulting from their job role. Alternatively, a new user may be an employee who does not currently have access to the organisationās information systems, but now requires access as a result of a change in their job ro...
