Skip to content

11 — HR Security Policy
Owner HR (with Security)
Review cadence Annual
Approver CTO
Last reviewed 2026-04
Mapped controls CC1.1, CC1.4, CC1.5, CC6.3

1. Pre-employment

  • Background checks for all roles with production access. Scope: identity, employment history, criminal record (local jurisdiction), where legally permitted. Adverse findings reviewed by CTO + Legal before hire.
  • References for senior or security-sensitive roles.
  • Offer & contract include confidentiality obligations and acknowledgement of policies.

2. Onboarding

Within 5 business days of start date:

  • Code of conduct signed.
  • Acceptable Use annex acknowledged.
  • Security awareness training completed.
  • Account provisioning (workforce IdP, Cognito group, AWS SSO, GitHub team, Slack workspace, PagerDuty rotation if applicable).
  • Hardware delivered with disk encryption + MDM.

3. During employment

  • Annual security training — KnowBe4 (or equivalent) phishing + secure-coding for engineers.
  • Performance reviews include security-aligned objectives where role-relevant.
  • Awareness campaigns — quarterly Slack post on a current threat (phishing, credential reuse, etc.).

4. Role changes

When an employee changes role:

  • Manager files request to revoke old privileges and grant new.
  • Security lead approves elevated access (admin, prod, etc.).
  • Update logged in evidence/hr/role-changes/.

5. Offboarding

Within 1 business day of termination effective time:

  • All system access revoked (workforce IdP, AWS, GitHub, Slack, PagerDuty, etc.).
  • Hardware returned (or remote wipe via MDM).
  • Outstanding code-review responsibilities transferred.
  • Exit interview by HR; security-relevant feedback captured.

Evidence: evidence/hr/offboarding/<user>.json with timestamps for each revocation step.

6. Disciplinary process

  • Suspected violations of 01-information-security.md trigger HR + Security review.
  • Confirmed violations may result in retraining, written warning, suspension, termination, or referral to law enforcement.

7. Contractors & temps

  • Same controls as employees: BG check (proportional to access), training, offboarding.
  • Default access is read-only and time-bounded; renewals require manager + Security approval.