Cybersecurity is included in human resources practices

Implementation steps

1. 1

   Add security checks to hiring and onboarding

   Include background checks appropriate to role sensitivity during the hiring process. On day one, provision access based on role (not a copy of a senior colleague's permissions). Deliver security awareness training before granting access to production systems. Document that these steps were completed for each new hire.

   ripplingworkdaybamboohrcheckr
2. 2

   Define role-change access procedures

   When an employee changes roles, trigger a review of their existing access permissions. Remove access that no longer applies and provision new access for the new role. This prevents privilege accumulation over time, where employees collect permissions from every role they have ever held.

   oktamicrosoft-entrasailpoint
3. 3

   Enforce an offboarding checklist that covers access revocation

   On the employee's last day, revoke all system access within 24 hours: IdP account, email, cloud consoles, SaaS tools, VPN, and any physical access credentials. Assign a named HR or IT person responsible for completing this checklist and documenting completion.

   ripplingoktagoogle-workspacemicrosoft-entra

Evidence required