Information Security, Risk and Business Continuity

Introduction

Human-resource records are among an organisation’s most sensitive information assets. They may contain identity data, compensation, bank details, health information, disciplinary records, immigration documents, biometric identifiers, performance evaluations and legally privileged communications. A compromise can therefore produce financial loss, regulatory penalties, discrimination, identity theft, litigation and lasting damage to employee trust.

HR record management is not limited to storing documents securely. It requires a coordinated system of governance, risk assessment, technical safeguards, controlled processes, trained people, incident response and continuity planning. The central management problem is to make records available to authorised users when needed while preserving confidentiality, integrity, authenticity, accountability and lawful use.

This chapter examines how HR professionals can assess and control information-security risks and maintain essential records during disruption. It integrates access control, encryption, segregation of duties, backup, incident response, disaster recovery and third-party oversight within practical control frameworks.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the confidentiality, integrity, availability, authenticity and accountability requirements of HR records.
2. Distinguish threats, vulnerabilities, risks, controls, incidents and business impacts.
3. Design access-control, encryption and segregation-of-duties arrangements for HR information.
4. Construct and interpret a records-risk register.
5. Apply recognised control frameworks to HR record governance.
6. Explain backup, recovery-point objectives, recovery-time objectives and continuity planning.
7. Analyse insider, cyber, third-party and physical risks.
8. Develop an incident-response and disaster-recovery approach that is ethical, lawful and operationally realistic.

1. The Security Requirements of HR Records

A useful starting point is the information-security triad:

• Confidentiality: information is disclosed only to authorised persons and approved systems.
• Integrity: information remains accurate, complete and protected from unauthorised alteration or destruction.
• Availability: authorised users can access information when required for lawful business purposes.

Three additional properties are especially important in HR administration:

• Authenticity: the organisation can establish who created, approved or amended a record.
• Accountability: actions can be attributed to identifiable users through logs and controls.
• Non-repudiation: reliable evidence exists concerning a transaction or approval, subject to applicable law and system design.

Security objectives can conflict. Restricting access improves confidentiality but may obstruct payroll or emergency response. Extensive data replication can improve availability but increase exposure. A mature programme therefore uses risk-based controls rather than maximum restriction in every situation.

The records life cycle

Security must operate across the entire life cycle:

1. Creation or collection: data is obtained for a defined and lawful purpose.
2. Classification and indexing: records are labelled according to sensitivity, retention and access requirements.
3. Use and sharing: access and disclosure are limited to legitimate purposes.
4. Storage and maintenance: records are protected against loss, alteration and unauthorised access.
5. Retention and review: records are retained only as long as justified by law, policy or operational need.
6. Disposition: records are securely deleted, destroyed or transferred, with evidence of the action.

Security controls that operate only in the storage phase are inadequate. For example, a well-encrypted HR database can still be compromised if an employee exports an unprotected spreadsheet or if a vendor retains data after contract termination.

2. Risk Concepts and Assessment

Risk management begins by identifying what can cause harm and how that harm could occur.

• An asset is something valuable, such as a payroll database, personnel file or employee identity document.
• A threat is a potential cause of harm, such as phishing, fraud, fire or malicious disclosure.
• A vulnerability is a weakness that a threat can exploit, such as excessive privileges or an unpatched server.
• An event is an occurrence, whether or not harmful.
• An incident is an event that actually or potentially compromises confidentiality, integrity or availability.
• A control is a safeguard that prevents, detects, responds to or corrects an unwanted event.
• Residual risk is the risk remaining after controls are applied.

A qualitative risk assessment commonly evaluates likelihood and impact. A simple scoring model is:

Likelihood and impact are ordinal ratings, for example from 1 to 5. This multiplication is a prioritisation device, not a precise probability calculation. It assumes that the rating scales are defined consistently and that multiplication provides a useful approximation for comparison. It should not be interpreted as a monetary loss estimate unless the scales have been designed for that purpose.

A quantitative annualised-loss model may be used when credible data exists:

Here, ALE is annualised loss expectancy, SLE is single-loss expectancy in currency, and ARO is the estimated annual rate of occurrence. The model assumes that the loss per event and event frequency can be estimated and that the events are sufficiently comparable. It can support investment decisions but should not replace judgement about legal, ethical or safety consequences.

The records-risk register

A records-risk register converts assessment into management action. A useful register includes:

Illustrative entries might include unauthorised payroll access caused by excessive permissions, ransomware affecting an HR file share, accidental disclosure through email, vendor failure in a cloud HR platform, or flood damage to paper personnel files.

Risk ownership should rest with a person able to allocate resources and accept residual risk. The HR manager may own a personnel-record risk, while information security, procurement, legal and business-continuity specialists provide expertise. A register is ineffective when it is merely an audit document rather than a living management tool.

3. A Control Framework for HR Records

Organisations commonly align controls with recognised frameworks such as ISO/IEC 27001, ISO 31000, the NIST Cybersecurity Framework and the NIST incident-response guidance. These frameworks differ in structure but share recurring principles: governance, asset identification, preventive protection, detection, response, recovery, continual improvement and evidence.

A practical HR control architecture has five layers:

1. Governance: policy, roles, risk appetite, legal obligations and oversight.
2. People and process: training, screening, approvals, retention schedules and documented procedures.
3. Technology: identity management, encryption, logging, endpoint protection and resilient infrastructure.
4. Physical environment: secure rooms, visitor controls, fire protection and environmental monitoring.
5. Assurance: testing, audits, metrics, incident reviews and corrective action.

Controls may also be classified as:

• Preventive: stop an unwanted action, such as multifactor authentication.
• Detective: identify an event, such as an alert for bulk downloads.
• Corrective: restore an acceptable state, such as account recovery.
• Deterrent: discourage misconduct, such as sanctions and visible monitoring notices.
• Compensating: provide alternative protection when the preferred control is unavailable.

The three lines model is useful for governance. Operational HR and system owners manage risks directly; risk, compliance and security functions provide challenge and guidance; internal audit provides independent assurance. The board or executive committee retains accountability for organisational risk appetite.

4. Access Control and Segregation of Duties

Access should be based on least privilege: a user receives only the permissions necessary for assigned duties, for only as long as necessary. Related principles include:

• Need to know: access depends on a legitimate information requirement.
• Role-based access control: permissions are linked to job roles rather than informal requests.
• Attribute-based access control: decisions also use attributes such as location, device, employment status or record sensitivity.
• Default deny: access is denied unless explicitly authorised.
• Privileged-access management: administrative accounts receive stronger controls, monitoring and time limits.
• Joiner–mover–leaver management: access is provisioned, changed and revoked as employment status changes.

A sound access process includes documented approval, identity verification, multifactor authentication for sensitive systems, periodic recertification, prompt termination of access and logging of significant activity. Shared accounts should generally be prohibited because they weaken accountability.

Segregation of duties

Segregation of duties (SoD) prevents one person from controlling incompatible stages of a sensitive process. For example, no single employee should be able to create a worker record, approve a salary change, release payroll and reconcile the resulting payment without independent review.

Typical incompatible duties include:

SoD is not absolute. Small organisations may lack sufficient staff. Compensating controls can include dual approval, automated workflow, retrospective review, exception logs and independent audit. SoD should be designed around actual risk, not applied mechanically.

5. Encryption and Data Protection

Encryption transforms readable data, called plaintext, into ciphertext using an algorithm and a key. Decryption reverses the process for an authorised recipient. Encryption protects confidentiality but does not by itself guarantee correct data, secure endpoints or lawful processing.

• Encryption in transit protects data moving between systems, for example through appropriately configured transport encryption.
• Encryption at rest protects stored databases, backups, laptops and removable media.
• Application-level or field-level encryption can protect especially sensitive fields even from some infrastructure administrators.
• Tokenisation or pseudonymisation reduces exposure by replacing direct identifiers, although re-identifiable data remains personal data in many legal regimes.

Key management is often more important than selecting an algorithm. Keys require controlled generation, storage, rotation, backup, revocation and destruction. If keys are stored beside encrypted data without protection, encryption may provide little practical benefit. If keys are lost, availability and recoverability may fail.

Encryption should be combined with data minimisation, secure configuration, endpoint controls, access logging and secure deletion. HR departments should also define whether employees may store records in personal email, consumer cloud drives or removable devices.

6. Backup, Recovery and Business Continuity

Backup creates a recoverable copy of data. Business continuity maintains critical services during and after disruption. Disaster recovery restores technology, applications and data. These concepts overlap but are not identical.

Two central objectives are:

• Recovery Point Objective (RPO): the maximum tolerable period of data loss measured backward from the disruption. An RPO of four hours means the organisation aims to lose no more than approximately four hours of transactions.
• Recovery Time Objective (RTO): the target time within which a service or process should be restored after disruption.

RPO concerns data currency; RTO concerns restoration speed. They should be agreed with process owners, not assumed by IT alone.

Backup design should address frequency, retention, geographic separation, immutability, encryption, access control and testing. A commonly used resilience principle is to maintain multiple copies on different media, with at least one copy isolated from ordinary administrative access. The exact arrangement must reflect organisational risk and service requirements.

A backup that has never been restored is only an expectation. Testing should verify that files are complete, applications function, permissions remain appropriate, records retain authenticity and the recovery time is realistic. Recovery procedures should include manual workarounds for payroll, employee communications and statutory reporting.

Continuity planning begins with a business impact analysis (BIA). The BIA identifies critical activities, dependencies, maximum tolerable disruption, resource requirements and consequences of failure. HR may classify payroll processing, absence administration, emergency contact information and legally required employee records as priority services, while lower-priority reporting may be deferred.

7. Incident Response and Disaster Recovery

An incident-response capability should define authority before a crisis occurs. A practical cycle includes:

1. Preparation: policies, contacts, tools, training, exercises and decision thresholds.
2. Detection and analysis: validate alerts, determine scope, preserve evidence and classify severity.
3. Containment: limit spread while avoiding unnecessary destruction of evidence.
4. Eradication: remove malicious access, correct vulnerabilities and address root causes.
5. Recovery: restore systems carefully, monitor for recurrence and validate records.
6. Lessons learned: document causes, decisions, notifications, control improvements and residual risk.

HR-specific response issues include protecting employee dignity, limiting disclosure of suspected misconduct, preserving disciplinary fairness, coordinating with legal counsel and meeting privacy-breach notification requirements. Notifications should be accurate, timely and proportionate. Organisations should not conceal an incident merely to avoid reputational discomfort.

Disaster recovery procedures should identify system owners, restoration order, dependencies, alternate work locations, communication channels, vendor contacts and approval to resume operations. Recovery must preserve chain of custody and record integrity. Restoring an outdated or corrupted personnel database can create a second incident even if systems become available.

8. Major Risk Categories

Insider risk

Insider risk includes deliberate theft, unauthorised curiosity, fraud, retaliation and accidental disclosure. Controls include background screening where lawful, acceptable-use rules, least privilege, behavioural training, monitoring with appropriate notice, data-loss prevention, whistleblowing channels and rapid access removal. Monitoring must be proportionate and governed; excessive surveillance can damage trust and create legal risk.

Cyber risk

Common threats include phishing, credential theft, ransomware, exploitation of unpatched systems, social engineering and unauthorised application programming interfaces. Controls include multifactor authentication, secure configuration, patch management, network segmentation, endpoint detection, tested backups, awareness training and vulnerability management. Cybersecurity is not solely an IT responsibility: HR controls identity life-cycle events and often handles the consequences of an attack.

Third-party risk

Cloud HR systems, payroll processors, background-check agencies and benefits providers may process sensitive records. Due diligence should assess security capability, subcontractors, data location, breach notification, audit rights, retention, deletion, portability, resilience and exit arrangements. Contracts should specify responsibilities rather than relying on general assurances. Vendor certification is useful evidence but does not eliminate the customer’s oversight duty.

Physical and environmental risk

Paper files, servers, laptops and backup media may be affected by theft, fire, flood, power failure, temperature, unauthorised visitors or poor disposal. Controls include locked storage, clean-desk procedures, visitor management, secure shredding, fire detection and suppression, environmental monitoring, power protection and geographically separated recovery facilities. Physical controls should cover home offices and temporary work locations where remote work is permitted.

9. Applied Case: Meridian Health Services

The following is an illustrative case.

Background

Meridian Health Services employs 4,500 people across hospitals and clinics. Its HR department uses a cloud human-capital platform, a payroll provider and paper files for certain occupational-health records. The organisation has recently expanded through acquisition, and former employees’ accounts are not always disabled promptly.

Problem

An HR analyst receives a convincing email requesting a bulk export of employee bank details. The analyst downloads the file and stores it in a personal cloud folder to work from home. Two days later, the account is compromised. At the same time, a payroll vendor reports a ransomware outage. Meridian discovers that its last successful payroll restoration test occurred eighteen months earlier.

Analysis

The records-risk register identifies several connected risks:

Approach and solution

Meridian activates its incident team, disables the compromised account, preserves relevant logs and contacts legal counsel and the privacy officer. It determines what data was accessed rather than assuming that every employee record was exposed. The organisation notifies affected parties where required by law and provides advice against fraud.

For continuity, payroll leadership invokes a manual procedure based on the last verified payroll file, reconciles changes through department managers and documents each exception. The vendor is required to provide an incident report, recovery evidence and assurance concerning subcontractors. Meridian then implements multifactor authentication for all privileged and remote access, creates a formal export-approval workflow, introduces quarterly access recertification and conducts restoration exercises twice each year.

Outcome

Payroll is completed with a short delay, and the investigation identifies 312 potentially exposed records. Meridian improves its risk register, assigns executive ownership and measures control performance through access-removal time, restoration-test success, unresolved high-risk findings and unauthorised export alerts.

Learning points

The case demonstrates that security failures are usually systemic rather than attributable to one employee. Identity governance, user experience, vendor oversight, monitoring and tested recovery must operate together. A policy prohibiting personal cloud storage would have been insufficient without a practical secure alternative and technical enforcement.

10. Governance, Ethics and Regulation

HR security must comply with applicable privacy, employment, records, cybersecurity, breach-notification and sector-specific requirements. Legal duties vary by jurisdiction, so organisations must obtain competent local advice rather than assume that one global policy is sufficient.

Core governance principles include purpose limitation, data minimisation, accuracy, retention control, transparency, access rights, correction mechanisms and appropriate security. Sensitive records require stronger justification and safeguards. Access for investigations should be narrowly scoped, documented and reviewed.

Ethical practice extends beyond legal compliance. Employees should not be treated as data sources without meaningful respect for autonomy and dignity. Automated monitoring can reproduce bias, misclassify legitimate behaviour or chill lawful workplace activity. AI tools used to classify, summarise or detect anomalies in HR records should have defined purposes, human oversight, validation, access restrictions and retention controls. Confidential personnel records should not be entered into public generative-AI services without explicit authorisation and appropriate contractual and technical safeguards.

11. Measuring Effectiveness and Continuous Improvement

Useful measures should reveal control performance rather than simply count policies. Examples include:

• percentage of privileged accounts using multifactor authentication;
• median time to disable leaver access;
• percentage of quarterly access reviews completed on time;
• number and age of high-risk unresolved findings;
• backup success rate and restore-test success rate;
• actual versus target RTO and RPO;
• time from incident detection to containment;
• percentage of critical vendors with tested continuity evidence;
• number of unauthorised or anomalous bulk exports.

Metrics require interpretation. A low incident count may indicate effective prevention—or poor detection. A high training-completion rate does not prove that employees can identify phishing. Boards and managers should combine metrics with scenario exercises, audits, interviews, technical testing and lessons learned.

Challenges and Limitations

Security controls can be expensive, difficult to integrate with legacy systems and burdensome for employees. Excessive controls may encourage workarounds, while weak controls create unacceptable exposure. Risk scores can create false precision, particularly when likelihood data is limited. Encryption does not prevent authorised misuse, and backups do not guarantee usable recovery. Vendor contracts may promise security without providing transparent evidence. Finally, legal requirements and technology change, requiring periodic review rather than one-time compliance.

Effective governance therefore depends on proportionality, documented judgement, independent challenge and continuous improvement. The most mature organisations treat information security and continuity as operational capabilities embedded in HR work, not as technical projects delegated to another department.

Chapter Summary

HR records require protection across their full life cycle. Confidentiality, integrity and availability must be balanced with authenticity, accountability and lawful access. A records-risk register links assets, threats, vulnerabilities, controls, owners and treatment decisions. Recognised frameworks support governance through identification, protection, detection, response, recovery and assurance.

Least privilege, role-based access, multifactor authentication and joiner–mover–leaver controls reduce unauthorised access. Segregation of duties limits fraud and error, while encryption protects data when properly supported by key management. Backups, RPOs, RTOs, business-impact analysis and tested recovery procedures support continuity. Incident response requires preparation, analysis, containment, eradication, recovery and learning.

Insider, cyber, third-party and physical risks require different but coordinated controls. Ethical governance demands proportional monitoring, privacy protection, human oversight of AI and respect for employee dignity. Security effectiveness is demonstrated through testing, evidence and improvement—not through policies alone.

Key Terms

Access control: Rules and mechanisms that determine who or what may use information resources.

Annualised loss expectancy (ALE): Estimated annual loss calculated from single-loss expectancy and annual rate of occurrence.

Asset: Information, system, process or resource with organisational value.

Availability: Accessibility of information and systems when authorised users require them.

Business continuity: Capability to continue critical activities during disruption.

Business impact analysis: Structured assessment of disruption consequences, priorities and dependencies.

Confidentiality: Protection against unauthorised disclosure.

Control: Safeguard that prevents, detects, responds to or corrects risk.

Disaster recovery: Restoration of technology, systems and data after disruption.

Encryption: Transformation of readable information into protected ciphertext using an algorithm and key.

Incident: Event that actually or potentially compromises information security.

Integrity: Accuracy, completeness and protection from unauthorised alteration.

Least privilege: Granting only the minimum access necessary for a defined task.

Recovery-point objective (RPO): Maximum acceptable period of data loss measured backward from disruption.

Recovery-time objective (RTO): Target time for restoring a service or process.

Residual risk: Risk remaining after controls are implemented.

Risk register: Structured record of identified risks, controls, owners and treatments.

Segregation of duties: Separation of incompatible responsibilities to reduce error or abuse.

Single-loss expectancy (SLE): Estimated loss from one occurrence of a risk event.

Threat: Potential cause of harm to an asset or process.

Review Questions

Short Answer Questions

1. What are the three elements of the information-security triad, and why must HR records satisfy all three?
2. Distinguish a threat, vulnerability, incident and control.
3. Explain the difference between RPO and RTO.
4. Why is segregation of duties important in payroll administration?
5. Identify two controls that reduce third-party risk.

Long Answer Questions

1. Explain how a records-risk register can support managerial decision-making, using an HR example.
2. Discuss the advantages and limitations of encryption as a protection for HR records.
3. Design an access-control model for a graduate recruitment process, including approvals, monitoring and leaver controls.
4. Compare incident response, disaster recovery and business continuity.
5. Evaluate the ethical and governance issues associated with monitoring employee activity for insider-risk detection.

Analytical / Application Questions

1. An organisation rates the likelihood of a payroll-data breach as 4 and its impact as 5 on five-point ordinal scales. Calculate the risk score using the chapter’s qualitative model, explain what the score does and does not mean, and propose three treatments.
2. A payroll service has an RTO of two hours but the latest restore test required six hours. Analyse the governance implications and recommend a corrective plan.
3. Construct five entries for a records-risk register for an organisation that uses a cloud HR platform, paper files and remote work. Rank the risks qualitatively and justify the owners and treatments.

Multiple Choice Questions with Answers

Question 1

Which property ensures that an HR record has not been altered without authorisation?

A. Availability

B. Integrity

C. Confidentiality

D. Portability

Correct Answer: B. Integrity

Question 2

What is the primary purpose of least-privilege access?

A. To give all employees identical permissions

B. To maximise data replication

C. To limit users to access necessary for their duties

D. To eliminate the need for authentication

Correct Answer: C. To limit users to access necessary for their duties

Question 3

Which activity is an example of segregation of duties?

A. Allowing one person to create and approve a salary change

B. Separating payroll approval from payment release

C. Giving contractors permanent administrator access

D. Using a shared account for payroll staff

Correct Answer: B. Separating payroll approval from payment release

Question 4

An RPO of four hours primarily defines:

A. The maximum target time to restore a service

B. The maximum acceptable period of data loss

C. The number of recovery copies required

D. The duration of employee training

Correct Answer: B. The maximum acceptable period of data loss

Question 5

Which control is primarily detective?

A. Multifactor authentication

B. A retention schedule

C. An alert for unusual bulk downloads

D. A locked records room

Correct Answer: C. An alert for unusual bulk downloads

Question 6

Using ALE = SLE × ARO, what is the ALE when SLE is $20,000 and ARO is 0.25?

A. $5,000

B. $20,250

C. $80,000

D. $800

Correct Answer: A. $5,000

Question 7

Which action should normally occur first after confirming a serious HR-data incident?

A. Delete all system logs

B. Contain the incident while preserving evidence

C. Publicly identify the suspected employee

D. Restore every system from the oldest backup

Correct Answer: B. Contain the incident while preserving evidence

Question 8

Why should backup restoration be tested?

A. To prove that policies are unnecessary

B. To ensure copies are usable and recovery targets are realistic

C. To increase the number of shared accounts

D. To replace access reviews

Correct Answer: B. To ensure copies are usable and recovery targets are realistic

Question 9

Which issue is most directly associated with third-party risk?

A. A vendor’s subcontractor and data-deletion practices

B. An employee’s desk arrangement

C. The colour of a records label

D. The length of a staff meeting

Correct Answer: A. A vendor’s subcontractor and data-deletion practices

Question 10

Which statement about encryption is most accurate?

A. Encryption eliminates all insider risk

B. Encryption is effective without key management

C. Encryption protects confidentiality but does not replace access control and recovery planning

D. Encryption guarantees that records are accurate

Correct Answer: C. Encryption protects confidentiality but does not replace access control and recovery planning