Personnel Security
The lifecycle
Personnel security runs from before hire to after departure: screening, onboarding, authorization, monitoring, and offboarding. Screening must be job-related and consistently applied. In the U.S., the Fair Credit Reporting Act governs third-party background checks: a standalone disclosure and authorization, a pre-adverse action notice with a copy of the report, then an adverse action notice. Credit checks and criminal history must be justified by the role and comply with state and local rules (such as ban-the-box laws).
Insider threat
Most loss involves people with legitimate access. Controls include least privilege, need to know, separation of duties, rotation of duties, mandatory vacation, two-person rules for sensitive tasks, and monitoring for behavioral indicators (not profiling). Employee awareness programs and clear reporting channels matter more than surveillance.
Access and termination
Access authorization follows role, not seniority. Remove access promptly at termination: badges, keys, system accounts, VPN, and shared passwords, and recover assets. Contractors and vendors need a sponsor, agreements (NDA, background-check clauses), and escorts or scoped access. Non-disclosure and acceptable-use agreements set expectations.
Traps
- One-size-fits-all screening without job relevance.
- Skipping the pre-adverse action notice.
- Terminating an employee without same-day access removal.
- Treating an authorized person as permanently trusted.
Worked example
A departing IT administrator: HR notifies security before the meeting; the badge is deactivated at the start of the exit interview, remote access is revoked, administrator credentials are rotated, devices and keys are collected, and the manager confirms no outstanding projects, all within four hours and documented on an offboarding checklist.