Another huge problem is those longtime employees who move around the company and retain access to data associated with their previous jobs even though it’s unrelated to their new position, says Jeffrey Margolies, lead for Accenture’s security services and identity management practice. "They accumulate access over time, and they are an audit nightmare."

A solution is to set up one place (whether it’s a website or paper form) where employees can request access to applications, Margolies says. CIOs need a policy that states who has access to what systems and why, with IT, HR and security getting to make the decisions. "Over the last 10 years, we have built hundreds of applications, and every single application has its own way of [determining] access and managing that access," he says. "But just [giving people] one place to go and [saying] just fill out this form—even if it’s paper—the level of confusion is reduced."

IM Not OK

The Hole | One of your top sales guys is a huge believer in instant messaging. In fact, he’s been using a consumer-grade IM client (probably AOL Instant Messenger) to communicate with his customers for years. And this hypothetical salesman’s IM name fits his personality perfectly: Big Bad Texan.

The Problem | There are three, says Osterman of Osterman Research. First, security: A consumer-grade IM client used on a corporate system will bypass all antivirus and spam software. Second, compliance: Consumer-grade IM clients don’t have auditing and logging capabilities for regulatory compliance. And third, name-space control: If Big Bad Texan takes a job at your competitor, rest assured he’s taking his IM name—and your key customers—with him. "There’s no clue to the outside world that he left," Osterman says.

The Solution | The first step is for CIOs to admit to themselves that consumer-grade IM could be running rampant in their organizations. Osterman estimates that 30 percent of all e-mail users are instant messaging these days. Like e-mail, CIOs need to develop an acceptable-use policy and make sure everyone understands it. Then CIOs have two options: Allow consumer-grade IM to remain in place and deploy a system that will provide any number of security functions, such as blocking file transfers or mapping IM screen names to corporate identities, says Osterman. Alternatively, CIOs can replace consumer-grade IM tools with an enterprise-grade system. "This can be a more expensive and disruptive option, but it’s one that many organizations are choosing," Osterman says.