Inventory (business *) processes through updating job descriptions in the interests of information security

Hello, habrazhitel!

I offer to your attention an article that unites things, at first glance, having nothing in common with each other: official duties of employees, inventory (business - *) processes and information security.

The following topics will be covered:

1. Instead of intro
2. About job descriptions
3. Pro processes and approaches
4. About information security
5. Pro all together
6. Automation example
7. Ways of development of ideas reflected in the article
8. Instead of conclusion

Welcome under the cut!

Hello again under the cut :)

Before continuing to read, the author would like to point out some features of the narration and special blocks in which important, in his opinion, information and / or clarifications are placed in them that will help the reader to better understand the thought he wanted to share:

Important!
Important text

OR

Important!

Important text

Let's start with the formation of a common conceptual series.

Instead of intro

Today, most Companies remain built in a functional way and are a mechanism with a set of functions. These functions are distributed among divisions where they are performed by executing employees. In carrying out their highly specialized tasks, workers no longer see the end results of the work of the entire enterprise and become aware of their place in the common chain. They are no longer focused on the Company's target tasks, since their vision of what is happening most often does not go beyond the framework of their own divisions in which they work. The monopoly position of each service within the Company leads to the fact that the employees of these services consider themselves indispensable, which is why interaction between functional departments and services often becomes destructive for them. By and large, this situation is not good, but not bad; it is none.

About job descriptions

Important!
Unfortunately, in the modern world (especially in the Russian Federation) job descriptions are not at all regarded as a powerful tool contributing to a positive effect on increasing the efficiency of workers' activities. The situation is stalemate initially: the law never stipulates the requirement for a job description, HR specialists do not have time / effort / desire to write (choose 2 out of 3), line managers set aside for later, subordinates are not at all interested in them, because . The courts in most cases make decisions in favor of the employee if they do not exist (based on the judicial practice of the city of Moscow).

The attitude to the question of the presence or absence of job descriptions in general can be expressed in 4 groups:

1. Instructions should be . Such an approach is rare, but some managers and employees of HR services are convinced that the Companies need instructions developed for each position, since Without them, it is extremely difficult to organize the effective work of the staff. However, many do not fully understand what their presence can give, but they strive to make them as high-quality as possible. Up to 15% of Companies.
2. No instructions are needed . There are many more people who believe that the instructions play no role in the management of human resources. Therefore, there is no job description in such Companies, especially since the law does not require it. This approach can be found in about 30% of Companies.
3. Instructions are needed, but their quality does not matter. With this approach, the job description has nothing to do with the actual activities of the Company's employees. You can safely give more than 50% of the total.
4. Instructions - this is a management tool - the most effective approach, but it is used by only a very small number of Companies, up to 5% of the total. It lies in the fact that relevant instructions are not only created, but also regularly reviewed and updated, and are actively used in practice.

In general, we can talk about two approaches to the creation of job descriptions: the Western and the Russian. The western approach is to write very short instructions, where the description of the functional takes literally a few lines. At the same time, a separate regulation is created for each of the functions, where it is described in more detail.
The Russian approach is expressed in the fact that the instruction describes the functionality as fully as possible, without additional references to the regulations.

Regardless of the approach to creation, the goals of the job descriptions can be formulated as follows:

1. Clear regulation of the obligations of the parties to the employment contract (transparency of labor relations), both at the stage of recruitment and in the process of employment.
2. Determination of the employee’s specific work functions, detalization of the procedure for his actions, limitation of his area of ​​responsibility and limits of authority.
3. To be a guide to action, as well as a basis for resolving disputes in the event of disagreement (between an employee and an employer, between employees within a structural unit, between structural divisions, in court).
4. Become a tool for evaluating personnel and, of course, corporate business process management.

Job descriptions are a necessary and effective tool for improving business performance. Their presence allows:

• create a management system that makes the business more transparent and manageable;
• clearly regulate the main obligations that are taken by the employer and the employee applying for a job, which greatly simplifies the relations of both parties;
• streamline the work of each structural unit in particular, and the enterprise as a whole;
• to formulate the labor functions of employees, their areas of responsibility, powers and restrictions in decision making, qualification requirements for the position, functional responsibilities of the person occupying it, the algorithm of actions in standard situations;
• avoid duplication of functions when performing certain types of work and uneven distribution of load;
• ensure effective interaction of employees holding different positions in solving production and management tasks;
• to select high-quality staff: a recruiter, having read the instructions, will be able to competently organize work with the candidates, and the applicant will be able to know in advance what will be required of him in this position;
• create comfortable conditions for the adaptation of a new employee: if the instructions clearly state what the newcomer should do and within what limits, and who his immediate supervisor is, this will make it easier for him the first days of work;
• to attract negligent employees to disciplinary responsibility for non-fulfillment of their job duties.

Like any other toolkit, job description with proper formation and maintenance can be:

Business Performance Tool

The formal approach to the development of job descriptions, when they are drawn up according to templates, do not correspond to the business objectives, does not reflect the main tasks of the employee in this position, does not aim at achieving the main goal of the Company, leads to the result that useless, inoperative documents are obtained. In this matter, the attitude to the job descriptions of the employer plays a big role. If he views them as an effective tool for personnel management, most likely it will be so. But if the instructions are developed by employees who are far from understanding the real functionality of specialists, their creation will be of no use to anyone.

Many Companies, having developed job descriptions once, no longer correct them, although business processes periodically undergo certain changes, which should be reflected in the instructions. In the conditions of strict requirements of modern business, it makes no sense to use job descriptions that do not reveal the specifics of the Company and do not contain strictly fixed tasks, functional responsibilities of staff, a description of the desired result of work and transfer of those responsible for its effectiveness.

Motivation management tool

In the face of fierce competition, more and more managers began to realize that the main resource that allows them to achieve strategic goals is personnel who need to be given due attention, primarily stimulated, both materially and non-materially. One of the most effective HR-tools that can help the Company to solve these problems is the system of grades / bands, in the development of which an important role is played by a verified and transparent organizational structure and well-described job descriptions / competencies that avoid many problems and reduce the cost of this procedure .

Employee Performance Assessment Tool

At any stage of the Company's development, errors and deviations from planned business results are possible. To minimize such risks, clear planning and control are needed. The presence in the Company of such an effective management tool that performs an organizational, regulatory and regulatory role, as a job description, simplifies control over employee performance.

Carried out with the help of job descriptions control over the activity is part of the personnel management system. The data contained in job descriptions make it possible to quickly assess what an employee needs to do in order to achieve the goals he has set, what measures should be taken to improve the efficiency of his activities. Detailed job descriptions set the standards and technologies for performing the tasks, which can be supported by both the employee and his manager. With their help, it is possible to assess how much an employee corresponds to his position, and to apply certain measures of influence to him.

Training needs assessment tool

Instructions are a great career planning tool if they include a clause on the required knowledge and qualifications. Using the information from this point, it is very easy to understand what skills one or another employee needs in order to take one or another position.

Pro processes and approaches

Thanks for the section

The author wants to thank Orphan V.E. for assistance in preparing the section

The author does not seek to impose a process approach, as the only true one. However, it wants to remind that each functional division of the Company optimizes the activities in its area of ​​responsibility, which, ultimately, may lead to the substitution of the strategic goal of the Company with the target functions of a separate division, which, in turn, leads to inhibition of development of both a separate division and and Companies.

Before proceeding you should classify the processes. In general, it makes sense to classify something only when the groups identified in the classification will be used in the future, and their presence will “simplify” life. While it is always necessary to remember that any objects can be classified in different ways, but always retain their common characteristics.

By classification we mean the grouping of objects of study in accordance with their common features, called the basis of classification.

Reasons for classifying processes:

Here is a comparison of the characteristics of the Function / Process / Project:

Management - actions of a particular subject, aimed at changing and manipulating objects and subjects to achieve predetermined goals.

• Functional control is the establishment (determination) of parameters for the execution of functions, including establishing the execution plan, the input and output requirements (result), the definition of the algorithm for converting the input to the output, and the requirements for the resources performing the function.
• Process management is a technology based on the recognition and application of the fact that the perception and management of the Company's activities, as interrelated processes, contributes to the enhancement of its (Company) performance and efficiency.
• Project management - the application of knowledge, skills, tools and technologies in project activities to meet the requirements and achieve the expectations of project participants.

Example:

About information security

At the very beginning of the article, the author gave a list of terms and definitions, in which the definition of information security was given. We give it again:

Information security - preservation of confidentiality, integrity and possibility of application (availability) of information.

Often, other properties, such as authenticity, controllability, irrefutable authorship and reliability, belong to information security.
ISO / IEC 27000: 2014

The employee, following his official duties, enshrined in job descriptions, performs the Functions that lead either to the implementation of the Project or are included in the Processes, uses in its activities information stored in different information systems and resources.

, , .

.

, ( ) — , , , "" ( — ) ( / ), "" ( , ).
:

• — "", , — ;
• — .
• "" / , — , , — .

, 5 () :

• — ;
• — / - . ( , );
• — , — PCI DSS;
• (/ ) ;
• , ( ///).

, 3 :

1. — , , — , - .
   – – , .. , .
2. — , , . . - , , ..
   – , ;
   , , ,
   .
3. .
   — .

: " ?". " ?". " ?" - " - "?

, , !

-?
— . .

(, , ) , , . , , «-» — . , , . .

, . , , . , . «-» .

" ".

( ) , — () () ().

. , ( ), ( ), .

.

. .

, :

• ?
• ?
• ?

. , -. , , , . — .

, , « » . , , . . .

:

• - ;
• , , , ;
• , , , - ();
• - ;
• , .

, :

1. ;
2. ;
3. ;
4. ;
5. ;
6. ;
7. ;
8. ;
9. ;
10. ( ).

. (- ) ( ).

, , . .

– -. , - ( 146%) , - .

. . , .
, . , «» , .

:

1. — ;
2. , (-). , , ( );
3. , : , , , , .

, :

1. ;
2. ;
3. ;
4. ;
5. ;
6. ;
7. ;
8. ;
9. ;
10. ;
11. ;
12. ( ).

— . , .
– , . , , – , «».
, , , . .

: , .
– . , , , , . – , , ..
! , , .

. ( ) , . – .
.
( / ) 2 : .

"", "" "" , , . .. .

*

Important!
— , , .

, - — , , . , , , / / / .
, , ( ), .

.

, :

Important!
(, , 2 ), . . — , : .

, , , / / .

( ), .
? -, ; . -, . -, . -, .

, .

:
(KPI) — , ;
— , , ( — , — ).

Important!
, .

1. 08 - the name of the organization - The name of the organization that is the author of the document should correspond to the name enshrined in its constituent documents. The abbreviated name of the organization is given in cases where it is enshrined in the constituent documents of the organization;
2. 10 - name of the type of document - The name of the type of document compiled or published by the organization must be determined by the charter (organization regulation) and must correspond to the types of documents stipulated by the OKUD;
3. 11 - document date - The date of the document is the date of its signing or approval;
4. 12 - the registration number of the document - the number assigned to it according to the rules of registration of documents in the organization. The registration number of the job description may include an index of the case (as part of which it is supposed to store a control copy of the job description) according to the organization’s nomenclature of affairs, the letter designation of the name of the document type (for example, “d / i”), information about the document executor, etc .;
5. 14 - the place of compilation or publication of the document - The place of compilation or publication of the document is indicated if its definition is difficult by the details of “Name of the organization” and “Reference data about the organization”. The place of compilation or publication is indicated taking into account the accepted administrative-territorial division, it includes only generally accepted abbreviations .;
6. 16 - the stamp of approval of the document - props, giving the regulatory or legal nature of its content. In general, the stamp of approval of the job description includes the word “approve” (in capital letters, without quotation marks), the position of the person authorized to approve the job description, signature and decryption of the signature (initials, last name, and date of approval, verbal digitally) ;
7. 18 - heading to the text - The heading to the text includes a summary of the document;
8. 20 - text of the document - Texts of documents are drawn up in the form of a questionnaire, a table, a coherent text or in the form of a combination of these structures;
9. 21 - mark on the presence of the application - mark on the presence of an annex to the document;
10. 22 - signature - The Signature requisite includes: the title of the person who signed the document (full, if the document was not drawn up on the form of the document, and abbreviated form - on the document drawn up on the form); personal signature; Signature transcript (initials, surname);
11. 23 - document approval stamp — a requisite expressing the consent of an organization that is not the author (developer) of a document with the content of the latter. This requisite is applied only in cases where the draft job description is subject to external agreement with interested parties;
12. 24 - document approval visas - Document approval is drawn up with a document approval visa (hereinafter referred to as a visa), which includes the signature and position of the document endorsing the document, the decryption of the signature (initials, last name) and the date of signature;
13. 26 - mark of the certification of the copy - When certifying the compliance of the copy of the document with the original below the "Signature" requisite, they affix a witness inscription: "True"; the position of the person who certified the copy; personal signature; Signature transcript (initials, surname); certification date;
14. 27 - mark on the performer - Mark on the performer includes the initials and surname of the performer of the document and its phone number. A mark about the artist is placed on the front or back side of the last sheet of the document in the lower left corner;
15. 30 - document electronic copy identifier - The identifier of the electronic copy of the document is a mark (footer) affixed in the lower left corner of each page of the document and contains the name of the file on the machine carrier, the date and other search data set in the organization.

Location of details and boundaries of zones on the A4 format

Location of details and border areas on the A4 format of the angular form

Location of details and border areas on the A4 format longitudinal form

In his activities, the author met with a situation when it was necessary to update the job descriptions of all employees of the Company.

Important!
The author knows how the audience Habra likes to automate everything and apply the latest technology! However, the audience of this material can be not only technically savvy specialists, but also people with “You” equipment. Therefore, there will be no databases, fashionable frameworks and other things that will certainly make life easier, but it will be a simple Microsoft Office, in a function accessible to all.

For automation, we need 3 files.
2 Microsoft Excel files and
1 Microsoft Word file.

The first Microsoft Excel file we need to fill it. The second Microsoft Excel file for "transport". As mentioned earlier, the solution is as simplified as possible for the masses. The Microsoft Word file will contain a template and fields for auto-filling from the "transport" document.

The second Microsoft Excel file is nothing more than a transposed table. This is a natural limitation, because The data to be used in the Microsoft Word file must be in plain text format. At the same time, it is inconvenient to fill in the initially transposed table - it becomes unreadable, especially if there are more than 7 participants in the family.

Ways of development of ideas reflected in the article

The approach described in the article aims to meet the needs of the following interest groups:

Human Resources Department - the formation of a family of positions for the rapid formation of requirements for candidates, depending on the needs of the processes;
Project / process office - formation of a set of competencies available for the implementation of new projects / processes;
Information security - the formation of a role model formed around a role in the process, and, therefore, around the level of confidentiality of information;
Information technologies - formation of configuration sets (server / user / AWS), licensing and budget expenditure management during the implementation of process automation;
The decision maker is the generation of relevant data for making management / strategic decisions.

1. Families combine the roles and competencies on which the Company's processes are based. Understanding the place of the role in the process, you can determine the level of confidentiality of information to which the role will have access - based on the competence of the role and the ability to effectively apply the information;
2. Easily implement a listing of processes - roles - competencies. With the help of task tracking systems and their execution - it is easy to determine the value of each role and the comparison of the value of this role and its value;
3. based on the task tracking and execution, you can get an idea of ​​the number of process instance launches, the need for the superprocess to start the process multiple times, the number of process launches leading to payment by the Consumer, and, consequently, profit;
4. Key performance indicators of roles / performers (function indicators) are directly related to process performance indicators (business indicators - level of profitability, profitability, capitalization) in which the role / performer is involved;
5. Determine the level of confidentiality of information involved in the (business) process, and therefore in information systems / information resources, which directly affects the composition and cost of IS / IR, role-based access model, users' AWP and workplace configuration.

Instead of conclusion

Structured and documented processes in the Company, job descriptions described and maintained, ensuring information security are all factors that indicate the Company's maturity. Following the picture above - level 0 is overcome and left far behind.
From three different sides - processes, organizational management, ensuring information security - only one driver becomes - achieving customer satisfaction, which in turn is characterized by repeatability of functions, the desire to achieve results not only in time (with the motivation “who is faster?”), But also with a given quality (with the motivation "who is better?").

Inventory of (business) processes through updating job descriptions in the interests of information security is an attempt to describe one of the options in which a change in the provision of information security may require routine work, which in turn may affect the overall level of the Company. thus, indirectly, but achieved, the integration of measures to ensure information security in the processes of the Company.

Bibliography

1. Process approach to management. Business process modeling / V.V. Repin
   V.G. Eliferov; "Mann, Ivanov and Ferber", M.2012
2. Business Process Models / LAP Lambert Academic
   Publishing ", 2012
3. Business processes. Basic concepts. Theory. Methods / AB. Scheer; "News-
   MetaTechnology ", M. 1999
4. Modern business process reengineering / M.V. Firsov; "Palmarium Academic
   Publishing ", M. 2014
5. Management Encyclopedia / PF. Dryuker; Williams, M. 2006
6. 149- "On Information, Information Technologies and Protection of Information"
7. ISO / IEC 27001: 2013 "Information technology - Security techniques - Information
   security management systems - Requirements »
8. ISO 9001: 2015 Quality management systems - Requirements
9. The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)
10. COBIT 5 for Information Security

Thank you for your time.
I am happy to answer comments.