Shared Responsibilities between HR and Security
How responsibilities are divided
Neither HR nor the security area can manage the risk associated with people in an organization on their own; they need coordinated processes with clearly divided responsibilities. HR usually handles background checks, signing confidentiality agreements and timely notification of staff hires, changes and departures. Security, for its part, translates that information into concrete technical actions: granting, adjusting or revoking access to systems as appropriate. The most common point of failure is precisely at the boundary between the two areas, when HR handles a departure but doesn't communicate it to security in time, or vice versa. Defining in writing who notifies what, to whom and within what time frame prevents these communication gaps from turning into improper access with nobody responsible for closing it.