Ensuring Secure Communication

Decide on questions rather than on products, then apply the questions. ENISA publishes a list along these lines for choosing communication tools and it maps well onto guidance work.

The questions worth asking about anything before it goes on the approved list: is the content encrypted in transit and, where it matters, end to end; who can read what is stored, and where is it stored; what does the provider do with the data; can people join a session without installing anything and without an account; can you delete a conversation and does deleting actually remove it; and can it be used properly on an old phone.

Answer those once per tool, write the answers down, and the arguments mostly stop. What you get is not a single winner, it is a short approved list with a note about what each one is for.

That is more useful than the list we were writing. Does the mentee get any say, or does the policy just apply?

The policy should set the outer edge and leave the choice inside it to her. Your side of it is that certain things never happen: case notes are not sent through a consumer messaging app, documents with her identity details are not posted to a group, nothing sensitive goes in a subject line.

Inside that, she picks. She knows which app she checks, which one is safe on her device, and which one someone else can see. A policy that names a single mandatory channel will be quietly broken within a month, and the version that gets used instead will be the one nobody reviewed.

One thing to build into the policy that teams often leave out: what to do when it goes wrong. If something is sent to the wrong person, people need to know who to tell and how quickly, and they need to know they will not be punished for reporting it. Without that, the first thing that happens after a mistake is silence.