Personnel and risk assessment

An employee's access changes through hiring, transfer and departure. Before access, the hiring function applies screening and agreements appropriate to the role and local law. Onboarding gives an individual identity linked to a defined role and explains handling and exception duties. A transfer requires more than adding new privileges: remove old privileges that are no longer needed and review conflicting duties. For departure, the business owner coordinates access cutoff, device and key return, and service credentials the employee knew. Disabling the human account may leave shared tokens and active sessions in place; verify each channel.

Risk assessment identifies the asset and process, threat, vulnerability, existing controls, possible harm and likelihood over a stated horizon. A word such as “critical” should not be the product of arbitrary scores. If a qualitative scale is used, define its anchors: high impact might mean an essential service stops; high likelihood might mean exposed and actively exploited conditions. Record uncertainty and missing evidence. Distinguish inherent risk before controls from residual risk after them. A strong scanning program does not counter an old service identity that can export sensitive data; the control must address the causal path. Treatment options include reduction, avoidance, transfer of some financial consequence through contract or insurance, and authorized acceptance. Transfer of cost does not automatically transfer responsibility for data or trust.

Controls act at different points. Preventing shared-account creation reduces an opportunity; detecting its use in logs helps identify misuse; a revocation and rotation procedure mitigates after discovery. Test each layer with relevant evidence. A business owner might temporarily accept residual risk with a compensating control, but acceptance does not erase a mandatory obligation or justify a misleading compliance statement. Compare control cost with exposure, consequence and available resources, and review the choice when suppliers, roles or threats change. Assessment is an ongoing decision process, not a form completed once.