PR.IP-11: Integrating Cybersecurity Into Human Resources Practices
Your workforce is your security perimeter. NIST CSF control PR.IP-11 requires organizations to embed cybersecurity into every stage of the employee lifecycle—from hiring and screening through offboarding and access removal. Without documented HR-security procedures, you risk insider threats, orphaned accounts, and compliance gaps that auditors will flag immediately.
What this means
PR.IP-11 mandates that cybersecurity safeguards be woven into human resources policies and procedures. This includes vetting candidates for security risks before hire, establishing clear security expectations during onboarding, monitoring for insider threats during employment, and systematically revoking access and equipment upon departure. It's about treating HR as a critical control point in your security architecture, not an afterthought.
How to comply
- 1.Develop and document a personnel security policy covering screening, onboarding, and deprovisioning with specific cybersecurity requirements.
- 2.Implement background checks and security clearance verification appropriate to role sensitivity before hiring.
- 3.Create onboarding checklists that include security training, access provisioning, acceptable use policies, and role-based access control assignments.
- 4.Establish monitoring procedures to detect suspicious employee behavior or policy violations during employment.
- 5.Build formal offboarding workflows that automatically revoke system access, retrieve equipment, and disable credentials within 24 hours of departure.
- 6.Document all personnel actions (hiring, role changes, terminations) and correlate them with access logs to catch orphaned accounts.
- 7.Conduct periodic access reviews to ensure current employee rosters match active system accounts.
Evidence auditors look for
- Signed background check reports and security clearance documentation
- Employee onboarding checklist with security training sign-offs and access provisioning records
- Acceptable use policy acknowledgments from all employees
- Offboarding checklists showing dates of access revocation and equipment return
- IT access removal tickets timestamped within 24 hours of HR termination notification
- Quarterly access reviews comparing active employees to active user accounts across systems
- Insider threat monitoring logs showing employee activity flagging procedures
- Role-based access control (RBAC) matrices tied to job titles and linked to HR records
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates HR-to-IT security workflows—link your HR system to GRCWatch to trigger instant access provisioning on hire, automatic deprovisioning on termination, and continuous access reviews that catch orphaned accounts before auditors do.
See how GRCWatch handles this control automatically
Start free trial