New hire security training: a first week checklist

In the first week, a new hire should set up multi factor sign in, learn how to report a problem, read the acceptable use rules, and finish a short role specific session. Give access in stages and match it to training completion. Keep a record of each step.

Before day one

• Create accounts with the minimum access the role needs.
• Order a hardware key or prepare passkey enrollment.
• Prepare the security welcome pack: one page, links, and a named contact.

Day one

1. Enroll in multi factor sign in. Walk through it together if you can.
2. Install the password manager and set the vault up.
3. Confirm the laptop is encrypted and updates are on.
4. Show where to report anything odd, and what happens after.

Keep day one short. People are overwhelmed already.

Days two and three

1. A 20 to 30 minute awareness session: phishing signs, verifying requests through known contacts, data handling.
2. Acceptable use and data classification, in plain words with three examples each.
3. Policy acknowledgement, recorded.

Days four and five

1. Role session. For engineers: secrets handling, dependency review, signed commits if you use them, how pull request review works. For finance: payment change verification. For support: identity checks before account changes.
2. A scenario: "You receive a message from your manager asking for gift cards. What do you do?" Ten minutes of discussion beats a quiz.
3. A check in with the manager or a security contact. Ask what was confusing.

Staged access

Tie access to completion. Core systems after day one setup. Production or sensitive data only after the role session. Document any exceptions with a reason and a date.

Records to keep

Date of each step, who ran it, version of content, and the acknowledgement. Auditors for frameworks such as SOC 2 and HIPAA commonly sample new hires against training records, so a missing date on a new hire is a common finding.

Mistakes to avoid

• A 90 minute video on day one that nobody retains.
• Training scheduled weeks after access is given.
• No named person to ask questions.
• Treating contractors differently without a reason.

Follow up

Send a short note at day 30 with one lesson and a reminder of the reporting route. Ask for feedback. Update the pack each quarter.

For developers, a quick hands on step can be to run the free scan at https://gold.safeguard.sh/scan on a sample project and read the findings together.

Quick check

Last reviewed: 19 October 2026.