Personnel Security
The employee lifecycle
Personnel security is continuous, not a single pre-hire check. It runs from job analysis and screening through onboarding, awareness training, periodic revalidation, and separation. Each stage exists to reduce the chance that someone with access becomes someone who misuses it.
Screening
Screening must be job-related, consistent, and documented. Two candidates for the same role get the same checks. In the United States, the Fair Credit Reporting Act requires written consent before a third-party background report and a pre-adverse-action notice giving the candidate a chance to dispute errors. The EEOC polices disparate impact, so blanket criminal-history exclusions are risky. The Employee Polygraph Protection Act sharply limits private-employer polygraph use. Credit checks belong only where financial responsibility is truly part of the job.
During employment
Build an insider-threat program: behavioral indicators, a non-punitive reporting channel, least privilege, separation of duties, and two-person rules for sensitive transactions. Awareness training is the cheapest control you own. Access should be reviewed on role change, not just at hire.
Separation
Termination is a security event. Plan the timing, reclaim badges and devices, revoke logical access before the person leaves the building, escort when warranted, and debrief on confidentiality obligations. Offboarding checklists prevent the "former employee still on the VPN" finding that auditors love.
Traps
- Believing Miranda or a "clearance" applies in a private company.
- Treating a background check as a one-time event.
- Applying stricter standards to one candidate because of a hunch.
Rule of thumb: same job, same check, documented decision - and revoke access before you announce the departure.