Organizational and Human Security Measures
People are simultaneously the strongest control and the most exploited weakness. This domain tests the human-resources security lifecycle, segregation of duties and awareness, and how third parties are handled. Scenario questions usually describe a fraud or a leak and ask which organisational control would have prevented it.
The employment lifecycle
- Before employment: screening proportionate to the role and lawful - references, qualifications, criminal-record checks where permitted. Contractors, temporary staff and cleaning crews are screened too, and responsibilities are written into contracts and terms.
- During employment: signed acceptable-use agreement and NDA, induction briefing, role-based awareness, refresher sessions, phishing simulations, a published disciplinary process.
- On change of role: reassess access rights and remove those no longer needed before granting new ones.
- On exit: return assets, badges and keys; revoke accounts, including privileged and remote-access accounts; recover data; restate continuing confidentiality obligations.
Segregation, rotation and privilege
- Segregation of duties: no single person can initiate, approve and record the same transaction.
- Four-eyes principle, job rotation and mandatory vacation - fraud surfaces when the perpetrator cannot take leave.
- Least privilege and need-to-know limit the damage any single account can cause.
- Awareness changes behaviour, training builds skill, education builds expertise; awareness is not a one-off event.
Third parties
- Due diligence before contracting, security requirements and a right to audit in the contract, incident-notification duties, NDA, periodic review and a defined offboarding step.
Worked example
In a finance team, one clerk both creates new suppliers and releases payments. The exposure is fraud through fictitious suppliers. The fix is organisational: split creation, approval, payment and reconciliation across different people, add two weeks of mandatory consecutive leave and rotation, and log changes to payment details. A firewall or antivirus product would not touch this risk, which is why the answer must be a human control.
Traps that cost marks
- Screening permanent employees only and forgetting contractors and facility staff.
- Delivering awareness once at induction and never again.
- Treating exit as an HR formality while the leaver's account stays active.
- Overlooking shared and privileged accounts when revoking access.