HR Cyber Security Policy

HR Cyber Security Policy

Purpose: This Cyber Security Policy establishes minimum standards, employee responsibilities, and management controls required to protect the confidentiality, integrity, and availability of the organization's information assets and systems. Effective Date:

Personal Information

Position Information

Employment Start Date:

Employment History

Education

References

Policy Statements and Requirements

Scope: This policy applies to all employees, contractors, temporary staff, and third parties with access to the organization's information systems, including on-premises and cloud-hosted resources, removable media, and mobile devices.

Acceptable Use

Employees must use computing resources for business purposes consistent with job responsibilities. Prohibited activities include unauthorized access, sharing of credentials, introduction of malware, unauthorized encryption or exfiltration of company data, and use of peer-to-peer file sharing for business systems.

Identity and Access Management

Accounts are provisioned on a least-privilege basis. Users are accountable for all activities performed under their credentials. Shared accounts are prohibited except where explicitly authorized in writing by IT management and logged.

Passwords must meet complexity and length requirements defined by IT. Passwords must not be shared. Multi-factor authentication is required for remote access and privileged accounts.

Device and Endpoint Security

All company-owned devices must run approved security software and be configured with encryption where available. Employees using personal devices for work (BYOD) must enroll devices in the organization's management platform and comply with minimum-security controls.

Data Classification and Handling

Information must be classified and handled according to sensitivity. Confidential data must be transmitted and stored using approved encryption. Employees must not store confidential data on unauthorized personal cloud services or removable media.

Incident Reporting

Suspected or confirmed security incidents, including data breaches, must be reported immediately to the designated security contact. Reports must include date/time, systems affected, and an initial description of the scope and impact.

Monitoring and Privacy

The organization may monitor systems and communications to protect assets and ensure compliance. Monitoring will be conducted in accordance with applicable law and internal policy. Users should have no expectation of privacy for data or communications on corporate resources.

Training and Awareness

Employees must complete mandatory cyber security training at hire and at least annually. Managers are responsible for ensuring team completion and for reinforcing secure behaviors.

Enforcement and Disciplinary Action

Violations of this policy may result in disciplinary action up to and including termination, restitution, and legal action. Alleged violations will be investigated promptly and fairly.

Exceptions and Review

Exceptions to policy must be approved in writing by IT and HR and documented with compensating controls. This policy is subject to periodic review and amendment by management.

Legal Disclosures

At-Will Employment: Nothing in this policy modifies an employment relationship that is otherwise at-will. Either the employee or the organization may terminate employment at any time, with or without cause, subject to applicable law.

Equal Opportunity: The organization provides equal employment opportunity without regard to protected characteristics and will not tolerate discrimination or harassment in any form.

Authorization and Certification

I certify that all information provided in this form is true and complete to the best of my knowledge. I authorize the organization to contact prior employers and references provided for the purposes of background verification and employment eligibility screening.

I acknowledge that I have read, understand, and agree to comply with the terms of this Cyber Security Policy. I understand that failure to comply with this policy may result in disciplinary action, up to and including termination.

I acknowledge the Acceptable Use requirements.
I acknowledge Password and Access Management responsibilities.
I will promptly report suspected security incidents.
I agree to participate in required training and awareness programs.

Applicant Certification and Background Authorization

By signing below I authorize the organization and its agents to conduct background investigations, reference checks, and any other verifications necessary to validate information provided herein and to confirm fitness for employment regarding information security responsibilities.

Sign Now