I85PREP
⌘ K
ICDL Cyber Security study materials
ICDL Cyber Security study resources

ICDL Cyber Security (ICDL): The Shared Payroll Spreadsheet

ICDL Cyber Security · Put your knowledge to work in context.

All case studies

The Shared Payroll Spreadsheet

Priya works in HR at a 40-person logistics firm. She keeps a spreadsheet on the shared network drive listing every employee's name, home address, national ID number, bank account details and salary. The folder is readable by all staff because 'it's convenient for managers'. Last week a warehouse employee opened it by accident and mentioned the salaries in the break room. Priya's manager asks her to 'just add a password to the file' and move on. Priya is unsure whether that is enough, and she has a deadline to send the payroll file to an external accountant by Friday.

1. Evaluate whether adding a password to the spreadsheet is an adequate response to the incident. What should Priya actually do?

Read the worked answer

A file password alone is not adequate. Reasons:

  • The exposure already happened; the problem is access control at the folder level, not the file.
  • A single shared password gets passed around, written on sticky notes and never rotated - it does not give an audit trail of who opened what.
  • The data includes special-category identifiers (national ID, bank details) that should be restricted to a need-to-know group.

What Priya should do:

  1. Move the file to a restricted folder with permissions granted only to HR and payroll roles.
  2. Remove read access for the 'all staff' group.
  3. Report the incident internally so it can be assessed and, if required, notified.
  4. For the accountant, send it via a secure transfer method (encrypted email or a shared link with expiry and access logging), not a plain attachment.

2. The manager says 'nobody outside the company saw it, so nothing needs to happen'. Is that reasoning sound?

Read the worked answer

No. 'No external leak' is not the same as 'no incident'.

  • Internal unauthorised access is still a confidentiality breach; staff now know colleagues' salaries and ID numbers.
  • There may be a legal duty to record and assess the incident even if notification is not triggered.
  • The root cause (over-broad permissions) is still present and will cause the same problem again.

Sound reasoning separates impact assessment (was data misused?) from root-cause fixing (why was it accessible?). The manager is skipping both.