An organisation's employees require access to information and systems to carry out their assigned job functions. With this access comes the risk that an *employee will, through intentional or accidental action, become the source of a cybersecurity incident*. Organisations that follow personnel management best practices can reduce the likelihood and impact of employee-centred security risks. ### Least Privilege The principle of least privilege says that *individuals should be granted only the minimum set of permissions necessary to carry out their job functions*. Least privilege is simple in concept but sometimes **challenging to implement in practice**. It requires careful attention to the privileges necessary to perform specific jobs and ongoing attention to avoid security issues. **Privilege creep**, one of these issues, occurs when an employee moves from job to job within the organization, accumulating new privileges, but never has the privileges associated with past duties revoked. ### Separation of Duties Organisations may implement separation of duties for *extremely sensitive job functions*. Separation of duties **takes two different tasks that, when combined, have great sensitivity and creates a rule that no single person may have the privileges required to perform both tasks**. The most common example of separation of duties comes in the world of accounting. Individuals working in accounting teams pose a risk to the organization should they decide to steal funds. They might carry out this theft by creating a new vendor in the accounting system with the name of a company that they control and then issuing checks to that vendor through the normal check-writing process. **Two-person control** is a concept that is similar to separation of duties but with an important difference: instead of preventing the same person from holding two different privileges that are sensitive when used together, *two-person control requires the participation of two people to perform a single sensitive action*. ### Job Rotation and Mandatory Vacations Job rotation practices *take employees with sensitive roles* and *move them periodically to other positions* in the organisation. The motivating force behind these efforts is that many types of fraud require ongoing concealment activities. If an individual commits fraud and is then rotated out of their existing assignment, they may not be able to continue those concealment activities due to changes in privileges and their replacement may discover the fraud themselves. Mandatory vacations serve a similar purpose by forcing employees to take annual vacations of a week or more consecutive time and revoking their access privileges during that vacation period. ### Clean Desk Space Clean desk policies are designed to *protect the confidentiality of sensitive information* by limiting the amount of paper left exposed on unattended employee desks. Organisations implementing a clean desk policy require that all papers and other materials be secured before an employee leaves their desk. ### Onboarding and Off-boarding Organisations should have standardised processes for onboarding new employees upon hire and off-boarding employees who are terminated or resign. These processes ensure that the *organization retains control of its assets and handles the granting and revocation* of credentials and privileges in an orderly manner. New hire processes should also include background checks designed to uncover any criminal activity or other past behaviour that may indicate that a potential employee poses an undetected risk to the organization. ### Nondisclosure Agreements Nondisclosure agreements (NDAs) require that employees protect any confidential information that they gain access to in the course of their employment. Organisations normally ask new employees to sign an NDA upon hire and periodically remind employees of their responsibilities under the NDA. Off-boarding processes often involve exit interviews that include a final reminder of the employee's responsibility to abide by the terms of the NDA even after the end of their affiliation with the organization. ### Social Media Organisations may choose to adopt social media policies that constrain the behaviour of employees on social media. Social media analysis performed by the organisation may include assessments of both personal and professional accounts, because that activity may reflect positively or negatively upon the organization. Organisations should make their expectations and practices clear in a social media policy.