Human Resource Security and Awareness
What this domain tests
Human resource security and awareness tests controls across the employment lifecycle, from screening and contracts through onboarding, training, role changes, and termination.
Core rules
- Screening must be proportional to role risk and lawful; higher-risk roles need stronger checks.
- Contracts include confidentiality, acceptable use, and return-of-asset obligations.
- Access is granted after onboarding and only to required systems.
- Awareness builds security culture; training builds role-specific skills. Both need measurement.
- Phishing simulations should be learning-focused, not punitive.
- Offboarding must revoke access, recover assets, and remove physical access promptly.
- The disciplinary process should be documented and applied consistently.
Worked example
A database administrator resigns. HR triggers the leaver process on day one. Security disables privileged accounts, revokes VPN and badge access, and collects the laptop. The team reviews recent administrator activity and rotates shared secrets the administrator knew. The exit interview reminds the employee of confidentiality obligations. Reasoning: the privileged role raises risk, so access removal and secret rotation happen before departure, not after.
Traps
- Relying on awareness training as the only control.
- Measuring awareness only by course completion rates.
- Leaving offboarding entirely to HR.
- Screening every role identically regardless of risk.
- Leaving shared passwords unchanged after a privileged user leaves.