NIST CSF 2.0 GV.RR-04: Build Security Into HR

GV.RR-04 says cybersecurity is included in human resources practices. People are both your biggest control and your biggest exposure, and the moments when they join, change roles and leave are when access mistakes happen. HR and security need a shared process.

What good looks like

Screening matches the sensitivity of the role. Onboarding gives access based on the job and includes security policy acknowledgment and training. Role changes trigger an access update. Offboarding removes access the same day. Hiring and promotion decisions treat security knowledge as a plus. Staff know they are obliged to follow policy, and that obligation is enforced.

NIST's examples list integrating security into screening, onboarding, change notification and offboarding, treating cybersecurity knowledge as a positive factor in hiring, training and retention, background checks before onboarding for sensitive roles and repeated periodically, and defining and enforcing obligations to uphold security policies.

How to implement it

1. Map the employee lifecycle: recruit, screen, onboard, change role, leave. Write the security step at each stage.
2. Screening. Decide which roles are sensitive, such as production access or finance, and run proportionate background checks, within local law. Repeat them periodically for those roles.
3. Onboarding. Provide role based access from a template, require policy acknowledgment and schedule training in the first weeks.
4. Role change. Make HR notify IT when someone moves, and have IT remove access that no longer applies, not only add new access.
5. Offboarding. Trigger account removal from the HR system. Collect devices, rotate shared secrets and review recent access.
6. Include security in job descriptions, interview questions and performance conversations.
7. State consequences for policy violations in the handbook and apply them consistently.

Evidence to collect

• The lifecycle checklist with owners.
• Sample onboarding and offboarding tickets with timestamps.
• Background check records or the screening policy.
• Training and acknowledgment records.
• Access review results showing no leavers with live accounts.

Common gaps

• Offboarding is a manual email, and accounts survive for weeks.
• Role changes add access but never remove old access, so privileges accumulate.
• Contractors are handled outside the HR process.
• Background checks are done once and never repeated for sensitive roles.
• Security training is optional or untracked.

Catching leftover access

The offboarding and role change steps fail quietly. The only way to see the leftovers is a regular access review that compares the people list against accounts in each system. The demo shows how a review flags accounts that should have been removed or reduced.

A simple lifecycle checklist

For each hire, the checklist has five lines. Screening completed to the level the role needs. Access granted from the role template and nothing extra. Policy acknowledged and training scheduled. Equipment recorded. For a leaver: all accounts disabled on the last day, devices returned, shared secrets rotated, manager confirms. Store the completed checklist in the personnel file or the ticket system. A year of completed checklists is simple, convincing evidence.

Contractors and temporary staff

Contractors often hold real privileges and sit outside the HR system. Give them the same lifecycle with a fixed end date on their accounts, a named sponsor who is responsible for removing access, and the same policy acknowledgment. Expiring accounts by default is the cheapest control for this gap.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST Cybersecurity Framework 2.0 Reference Tool, subcategory GV.RR-04: https://csrc.nist.gov/projects/cybersecurity-framework/filters
• NIST Cybersecurity Framework overview: https://www.nist.gov/cyberframework

The CSF is voluntary guidance. There is no CSF certification, so this post describes how to work toward the outcome, not how to pass an audit.