Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
HR: Hiring, Training, Termination
People are part of security
Many IT controls quietly depend on HR processes. You can’t remove a leaver’s access if nobody tells IT they’ve left. You can’t trust someone with payroll data if nobody checked their background. The exam follows an employee from hiring to leaving.
Hiring
- Background checks proportional to how sensitive the role is: identity, work history, qualifications, and criminal or credit checks where lawful and relevant.
- Reference checks.
- Signed agreements: employment terms, confidentiality (NDA), acceptable use, code of conduct, and acknowledgement of security policies.
While they work
- Security awareness training at joining, and regularly after.
- Job descriptions that include security responsibilities.
- Job rotation: someone else sees the work, which reduces reliance on one person and can uncover fraud.
- Mandatory leave: frauds that need constant attention, like hiding stolen money by juggling accounts, tend to unravel when the person is away. It’s a detective control, not a perk.
- Cross-training and succession planning for critical roles.
Changing roles
When someone moves to a new role, the access they needed for the old one should be removed. Otherwise people collect rights over time (access creep) and end up with segregation of duties conflicts.
Leaving
| Control | Detail |
|---|---|
| Timely notification | HR tells IT and security about every leaver on a fixed timeline, ideally automatically |
| Access removal | All logical access (network, apps, VPN, cloud, email) and physical access (badges, keys) |
| Dismissals | Access removed at or before the moment the person is told |
| Asset return | Laptops, phones, tokens, documents |
| Shared secrets | Change any passwords the person knew |
| Exit interview | Remind them of their ongoing confidentiality duties |
| Reconciliation | Regularly match HR’s leaver list to active accounts |
Example. An auditor matches HR’s leaver list to VPN accounts and finds 14 people who left more than a month ago still active, including a systems administrator who was dismissed for misconduct. IT learns about leavers by email, which is often missed. The recommendation: an automatic feed from HR to the identity system.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| The most important control when an employee leaves | Prompt removal of all access |
| Timing for an involuntary termination | Remove access at the time the person is told |
| Control that detects fraud needing constant concealment | Mandatory leave or job rotation |
| Best test of leaver controls | Reconcile HR termination records to active accounts |
| Risk when employees change roles | Access creep; review and remove old access |
In short
- Hiring controls: background checks suited to the role, references, and signed confidentiality and acceptable use agreements.
- Staff get security awareness training when they join and regularly after.
- Job rotation and mandatory leave help uncover fraud and reduce reliance on one person.
- When people leave, all access must be removed promptly; for dismissals, at the moment they're told.
- Leaving also means collecting laptops, badges and tokens, and removing physical and remote access.
- When people change roles, old access must be removed so it doesn't pile up.
Exam traps
- For an involuntary termination, access is removed when the person is told, not at the end of their notice.
- HR telling IT is the trigger. Without a reliable HR-to-IT process, leavers stay active.
- Contractors and temps need the same leaver process.
- Access creep happens when people move roles, not just when they leave.
- Mandatory leave is a detective control, not a perk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
People are part of security
Many IT controls quietly depend on HR. You can't remove a leaver's access if nobody tells IT they've left. You can't trust someone with payroll data if nobody checked their background.
The exam follows the employee from hiring to leaving.