Risk Assessment When Hiring for Critical Roles

Not all roles represent the same level of cyber risk, and the hiring process should reflect that difference: a systems administrator, a finance lead or someone with access to customer data requires deeper verification than a role with no access to sensitive information. This risk assessment can include more thorough validation of employment references, review of specific background relevant to the role, and a clear prior definition of the exact scope of access that person will have before they even start. Applying the same level of scrutiny to every role wastes resources on low-risk positions, while applying too little scrutiny to critical roles exposes the organization to a risk disproportionate to the effort it would take to prevent it.