People, Policies and Training

Every other lesson in this course ends up at a person. A firewall rule gets written by someone. A backup gets tested, or not, by someone. An invoice with a changed bank account gets paid, or questioned, by someone in accounts payable at 4:40 on a Friday. The FBI's Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025 and 24,768 business email compromise complaints with reported losses of $3,046,598,558 (IC3 2025 report, as of October 2026). Divide the loss by the complaints and the average comes to about $123,000 per reported case. Most of those cases ended with an employee doing something that looked reasonable at the time.

Managers cannot fix that with a memo. They can fix a lot of it with a small set of clear rules, a training habit that people tolerate, controls that catch the mistakes training will not, and hiring and exit steps that do not leave doors open. This lesson covers those. For the technical layers that sit behind them, see the layered defense lesson. For the how-to side at the level of an office of 1 to 50, see the small business data security module, which is the practical companion to this management view.

Policy, standard, procedure, guideline

Most policy sets fail because everything gets written into one document. A policy changes when the business changes. A password length changes when attackers or the framework changes. A procedure changes when the software vendor moves a menu. Keep them apart and each one stays current.

Document	Answers	Typical length	Who approves	Reviewed	Example
Policy	What must happen, and why	1 to 2 pages	CEO, owner or board committee	Yearly, or on a major change	"Company data is classified, and each class has handling rules."
Standard	How much, how strong, how often	1 page per topic	Security lead or IT head	Yearly, or when a framework changes	"Laptops use full-disk encryption. Passwords for non-MFA accounts are 15 characters or longer."
Procedure	The exact steps, in order	Checklist, 1 page	The team lead who runs it	When the tool or team changes	"Offboarding checklist: disable account, revoke sessions, collect devices, transfer files."
Guideline	Advice, not mandatory	Short	Team lead	As needed	"Tips for spotting invoice fraud."

The reason to write it down is partly practical and partly legal. The FTC Safeguards Rule, which covers many non-bank financial businesses, requires a written information security program with a designated Qualified Individual, a written risk assessment, and a written incident response plan (16 CFR 314.4). The HIPAA Security Rule requires policies and procedures in written form (which may be electronic) and requires them to be kept for six years from the date they were created or last in effect, whichever is later (45 CFR 164.316). PCI DSS version 4.0.1, the card industry's contract standard, has its own policy and incident-plan requirements, including a plan that must name the notification of payment brands and acquirers (Requirement 12.10.1). Even if no rule applies to you, an insurer's application or a customer's security questionnaire will ask whether a written policy exists. A document that exists and is followed answers every one of those requests at once. Lesson 06 explains which federal laws reach which businesses.

The eight-policy set

Policy	What it settles	Suggested owner	Frameworks and rules that expect it
Acceptable use	What staff may do with company systems, email, internet, and what is off limits; that monitoring happens; consequences of breaking the rules	HR with IT	HIPAA sanction policy (45 CFR 164.308(a)(1)(ii)(C)), PCI DSS, ISO/IEC 27001, SOC 2
Access control	Unique accounts, MFA, least privilege, admin separation, access reviews, joiner-mover-leaver steps	IT lead	Safeguards Rule access controls and MFA (314.4(c)(1), (c)(5)), HIPAA workforce access, PCI DSS Requirements 7 and 8
Data classification and handling	Public, internal, confidential, restricted: who may see each, how to send, store and destroy each	Privacy or compliance lead	State privacy laws, Safeguards Rule, HIPAA, contracts
Remote work and personal devices (BYOD)	Approved devices, encryption, screen lock, company-managed apps, lost-device reporting, travel	IT lead	Insurer applications, customer questionnaires
Incident response	What counts as an incident, who declares it, the call list, who speaks to whom (see lesson 11)	Security lead	Safeguards Rule 314.4(h), HIPAA, PCI DSS 12.10, NYDFS and other sector rules
Retention and disposal	How long each record type is kept and how it is destroyed; legal holds	Compliance or finance lead	I-9 and payroll rules, HIPAA six-year documents, state privacy laws
Vendor and third-party	Tiering, due diligence, contract clauses, offboarding (see lesson 09)	Procurement with security	Safeguards Rule 314.4(f), HIPAA business associates, GDPR processors
AI use	Approved tools, what data may never go into a public AI service, review of outputs, disclosure (see lesson 13)	Privacy lead with IT	NIST AI RMF, state AI laws, customer contracts

One owner, one approver, one review date on the first page. That is the whole governance of a policy. If the owner leaves the company, the policy gets a new owner the same week, because an orphaned policy is how an audit finds out that nobody has read the document in three years.

What each policy needs to say, in plain terms

The acceptable use policy has to tell staff that company systems may be monitored, and that is a legal point as much as a cultural one (see the monitoring section below). It should also say that personal use is tolerated within limits, that no one may bypass security tools, and what happens when the rules are broken. The HIPAA Security Rule makes a sanction policy mandatory for covered entities and business associates, applying appropriate sanctions against workforce members who fail to comply with the security policies. Other businesses benefit from the same fairness: if the consequence for clicking a phishing link is the same as the consequence for stealing data, people will stop reporting clicks.

The access control policy turns the principle of least privilege into rules. Each person gets a unique account. Administrator accounts are separate from daily accounts. Access reviews happen on a schedule, usually every quarter for sensitive systems and every year for the rest. Shared logins need an exception that the security lead signs. The FTC Safeguards Rule goes further for the businesses it covers, requiring multi-factor authentication for any individual accessing any information system unless the Qualified Individual approves in writing a reasonably equivalent or more secure control (314.4(c)(5)).

The data classification policy is the one most small companies skip, and the one that makes the others cheaper. If every record is "confidential," nothing is. Four labels are enough. A client's tax return is restricted. The employee handbook is internal. A price list on the website is public. Tie each label to three rules: who may open it, how it may be sent, and how it is destroyed. Lesson 03 covers data inventory and mapping, which feeds this policy.

The retention policy is half a privacy policy and half a records policy. Keeping data forever feels safe and is not: every extra year is more data that a breach can expose and more records that a rights request can reach. Some records have fixed minimums. A Form I-9 must be kept for three years after hire or one year after employment ends, whichever is later (8 CFR 274a.2(b)(2)(i)(A)). HIPAA documentation must be kept six years. Write the minimums into a table, then write the disposal date next to each, and run the disposal. A schedule that is not executed is a wish.

Training that works, and training that does not

Annual compliance training exists because rules require it, and the rules are real. The Safeguards Rule requires providing personnel with security awareness training updated as the risk assessment changes (314.4(e)(1)). The HIPAA Security Rule requires a security awareness and training program for all members of the workforce, including management (45 CFR 164.308(a)(5)(i)). PCI DSS Requirement 12.6 requires awareness training. The rules say the training must happen. They are silent on whether it works.

The strongest recent evidence says that the standard version does not. UC San Diego Health ran a randomized experiment over eight months with more than 19,500 employees, using 10 different phishing campaigns. Researchers reported that annual mandated training had no significant relationship with whether employees fell for phishing emails, and that embedded training, the page shown after someone clicks, reduced the chance of clicking by about 2 percent. About three-quarters of employees spent a minute or less on the embedded material, and a third closed it without engaging at all. The lure mattered more than the training: a fake password update for the Outlook mail system drew a 1.82 percent click rate, while a fake vacation policy update drew 30.8 percent (UC San Diego, September 2025). The study covered one health system, so treat it as strong evidence about that setting and a warning for others, not a law of nature.

A manager should size training as one layer among several, and should not cancel it.

Practice	What the evidence and the standards support	Management decision
Annual 45-minute video	Meets a checkbox. Little measured effect on clicking.	Keep only if a rule or customer requires it; do not count it as your defense.
Short monthly or quarterly lessons (5 to 15 minutes)	NIST SP 800-50 Rev. 1 (September 12, 2024) describes a life-cycle learning program aimed at behavior change, with metrics and continual improvement.	Fund a small, steady program with a named owner.
Role-based training	Accounts payable, executive assistants, HR and IT admins face different attacks.	Give finance a payment-fraud module and give executives an impersonation module.
Technical controls behind the training	CISA's fact sheet on phishing-resistant MFA covers methods, such as FIDO security keys and passkeys, that do not work on a fake sign-in page.	Spend on phishing-resistant sign-in for admins, finance and executives before spending more on awareness content.
A one-click "report this email" button	Converts an employee's doubt into a signal the security team can use.	Make reporting the primary measure of success.

Phishing simulations, done fairly

A simulation is a fake phishing email sent by your own team to measure and teach. It can be useful and it can poison trust. The UC San Diego numbers show why a single click rate says little: the same workforce clicked at 1.82 percent on one lure and 30.8 percent on another. If management reads that gap as "employees got dumber in March," it will punish people for a variable the sender chose.

• Announce the program in the acceptable use policy and at onboarding. Surprise is not a requirement.
• Do not use lures built on fear about pay, bonuses, layoffs, health or family. They damage trust, and real attackers will use them anyway, so teach about them in words instead.
• No public lists of who clicked. Show results by department or company, and send a private note to the individual only if they want one.
• Measure the report rate alongside the click rate. A workforce that clicks 12 percent and reports 40 percent is safer than one that clicks 8 percent and reports 2 percent, because the second one will not tell you when a real attack lands.
• Vary the difficulty and the lure type, and compare like with like quarter to quarter.
• Never discipline a click. Discipline concealment: a person who clicked and told no one for three days, while a real credential was in play.

Insider risk and separation of duties

Insider risk covers different problems that call for different controls. The careless insider mis-sends a file, loses a laptop or approves a fake invoice. The pressured insider has a financial or personal reason to take data or money. The malicious insider is rare and does the most damage when access is wide and unreviewed. Most businesses spend all their attention on the first and none on the second and third.

The controls are old and cheap. Least privilege limits what any one person can touch. Access reviews catch the former project member who still sees the payroll folder. Logging of file downloads and privileged actions creates evidence and a deterrent. Separation of duties makes sure a single person cannot both create and approve a payment, both add a vendor and pay the vendor, or both change a bank account and release the next payroll.

Sensitive task	Split between	Why
Adding or changing a vendor's bank details	Requester in accounts payable; verifier calls the vendor on a number already on file; approver in finance	Defeats business email compromise and internal fraud with the same step
Paying invoices above a set amount, such as $10,000	One person prepares; a second approves in the bank portal	Dual approval is a common bank feature and costs minutes
Payroll changes	HR enters; finance approves; employee gets a confirmation to a known channel	Stops payroll diversion
Granting administrator rights	IT requests; the security lead or business owner approves	Keeps admin rights rare and visible
Restoring or deleting backups	Backup admin acts; a second person is notified or co-approves for deletes	Protects recovery from both ransomware and a rogue admin

In a company of 12, the same two people may do all of this. The fallback is the owner's review: a monthly look at new vendors, changed bank details and admin accounts, done from reports the owner does not produce. That one monthly review does a surprising amount of work for small businesses.

Hiring, background checks and the law

Security starts before the first day. A business that hires an accounts payable clerk with access to wire approval, or an administrator with domain-wide rights, is placing trust that deserves a proportionate check. The law sets the guardrails for how.

The Fair Credit Reporting Act

When an employer buys a background report from a consumer reporting agency, the Fair Credit Reporting Act applies. Before the employer procures the report, it must give the applicant a clear and conspicuous written disclosure, in a document that consists solely of the disclosure, that a consumer report may be obtained for employment purposes, and it must get the person's written authorization. Before taking any adverse action based in whole or in part on the report, the employer must give the person a copy of the report and a summary of rights (15 U.S.C. 1681b(b)(2) and (b)(3)). The "solely" matters. Burying the authorization inside an application form is a common source of lawsuits, which is why HR templates use a separate page.

Criminal history and the EEOC

The Equal Employment Opportunity Commission issued Enforcement Guidance No. 915.002 on April 25, 2012. It explains that a neutral criminal-record screen can still violate Title VII of the Civil Rights Act if it disproportionately screens out a protected group and the employer cannot show it is job related and consistent with business necessity. It points to the three factors from a 1977 Eighth Circuit decision, Green v. Missouri Pacific Railroad: the nature and gravity of the offense, the time that has passed, and the nature of the job. It describes a targeted screen and an individualized assessment as safer than a blanket exclusion, and notes that an arrest alone generally does not prove conduct occurred (EEOC guidance). State and local fair-chance hiring laws add timing rules about when a criminal-history question may be asked. Those vary by state and city and were not compiled for this lesson, so check each place where you hire.

A practical rule for security roles: tie the check to the access, not to the job title. A role with wire authority or domain administrator rights gets a deeper, documented check than a receptionist. Write the rule once, apply it to everyone in the class of role, and keep the written reasons.

Form I-9 and records

Employment eligibility records contain identity document copies and numbers, which are exactly what an identity thief wants. Keep Forms I-9 separate from the general personnel file, limit access to HR, and apply the retention rule (three years after hire or one year after employment ends, whichever is later). Destroy on schedule. A keep-everything habit turns a modest HR drive into a breach notification list.

Offboarding and the moment of exit

Departing staff are the largest predictable source of lingering access. The sequence matters more than the paperwork, and it runs on the clock of the separation, not on HR's weekly cycle.

Movers matter as much as leavers. A person who moves from accounts payable to sales should lose the payment approvals on the day of the move, not at the next annual access review. HIPAA's Security Rule lists termination procedures among its administrative safeguards, to end access to electronic protected health information when employment ends (45 CFR 164.308(a)(3)(ii)(C), an addressable specification). Any business can use the same rule.

Reporting culture

The most useful security sensor most businesses own is a person who says "this looks wrong." Whether that person speaks up depends on what happened to the last one. The behaviors to protect are reporting a suspicious email, admitting a click, flagging a colleague's unusual request, and raising a mistake early.

• Publish a single reporting channel: a button in the email client, one shared mailbox, one phone number. Test it twice a year.
• Thank people by name, with permission, when a report catches something real.
• Write into policy that good-faith reports carry no penalty, even when the report reveals the reporter's own error.
• Track time from event to report. A fast report on a real phishing click often decides whether the company deals with one reset password or a month of forensics.

Employee monitoring and privacy law

Businesses monitor email, web use, devices and sometimes calls, for security, compliance and productivity. The legal ground is mostly about consent and notice. Federal law, state law and a few state notice statutes set the rules, and a business that has staff in several states has to meet the strictest.

Source	What it says	What a business does
Federal wiretap law, 18 U.S.C. 2511	It is not unlawful for a person not acting under color of law to intercept a communication where that person is a party to it or where one party has given prior consent, unless it is for a criminal or tortious purpose. A separate provider exception covers monitoring that is a necessary incident to protecting the provider's service.	Get written employee acknowledgment of monitoring in the acceptable use policy. Do not record calls you are not a party to without consent.
Idaho Code 18-6702(2)(d)	It is lawful to intercept a wire, electronic or oral communication when one of the parties has given prior consent. Idaho Code 18-6702(2)(e) makes it unlawful to intercept any communication for the purpose of committing a criminal act.	One-party consent is the Idaho rule. It does not bind other states.
New York Civil Rights Law 52-c (second section of that number)	Employers with a place of business in New York that monitor telephone, email or internet use through any electronic device or system must give written notice on hiring, get a written or electronic acknowledgment, and post the notice conspicuously. The notice must say that these may be monitored at any and all times and by any lawful means. The Attorney General enforces it, with maximum civil penalties of $500, $1,000 and $3,000 for a first, second and later offense.	Use one notice that satisfies New York and apply it to everyone.
Connecticut General Statutes 31-48d	Public Act 26-73 (signed June 4, 2026, effective October 1, 2026) replaced this section. The notice must name the premises locations where monitoring may occur and be posted there, with exceptions for airports and for security or safety monitoring on reasonable grounds. Employees hired on or after October 1, 2026 get a plain-language written statement before they start. Penalties are up to $500, $1,000 and $3,000. Lesson 17 has the detail.	Update Connecticut notices and new-hire statements.
Other states	A few other states are reported to have notice statutes; Delaware is often cited. This lesson did not verify Delaware or others.	Check each state where staff work, and keep a table.

Beyond statutes, there are rules of fairness that avoid lawsuits and employee anger. Monitor what the policy says, for the purposes it states. Do not read personal webmail or banking sessions in the course of routine web filtering. Limit access to monitoring data to the few who need it, and log that access. Do not install tracking on personal devices beyond what a BYOD policy discloses. Do not monitor in places where employees have a reasonable expectation of privacy, such as restrooms and changing areas. If employees may discuss pay and working conditions with each other, as federal labor law generally protects for many private-sector workers, a monitoring or social-media rule that reads as a ban on that talk can create its own problem. The National Labor Relations Board's position on workplace rules has shifted over time and was not verified for this lesson, so treat that point as a prompt to read the Board's current guidance on the subject.

For state consumer privacy laws that cover employee data, see lesson 07. California's law covers employee and job-applicant data, which brings notices, access and deletion rights for staff in scope.

The first ninety days of a people program

Days	Action	Owner	Evidence produced
1 to 14	Name owners and approvers for the eight policies; collect any existing documents; pick the review dates	CEO or operations director	Policy register with owner, approver, review date
15 to 45	Draft the eight one-page policies; draft standards for passwords, MFA, encryption and patch timing; draft onboarding and offboarding checklists	Policy owners	Approved policies, standards and checklists
30 to 60	Add the one-click report button and the reporting channel; turn on dual approval and call-back for bank detail changes	IT lead and finance lead	Screenshots of settings; written payment procedure
45 to 75	Launch short monthly training; run a first simulation with a clear announcement and a no-discipline rule	Security lead or HR	Attendance, click rate, report rate
60 to 90	Run the first quarterly access review; collect signed acknowledgments; brief the board or owners on results	Security lead	Access review sign-off; one-page dashboard

Questions to ask your IT provider or vendor

• Can you show which accounts were disabled, and how many minutes after a recent leaver's last day, from your ticket system rather than from memory?
• Do we have a one-click report button, and who sees the reports? What is the average time from report to response?
• Which users have administrator rights today, and who approved each one?
• Can the bank portal and our payment system enforce two approvers above a dollar threshold?
• Where do monitoring logs live, who can read them, and how long do we keep them?
• Does your phishing simulation platform let us exclude lures about pay, health or layoffs and report results only in aggregate?

Questions and answers

How many policies is too many?

For a business of 10 to 500, the eight above plus a handful of procedures are enough to satisfy most insurers and customer questionnaires. Add a policy only when a rule, a contract or a specific risk demands it. A policy that no one owns is a liability, because it records a promise you are not keeping.

Do we need a separate policy for every law?

No. Write one policy per subject and map it to the laws that apply. A spreadsheet with policies down the side and rules across the top (Safeguards Rule, HIPAA, PCI DSS, state laws) shows which document answers which requirement. That is also the format an auditor likes.

How long should an acceptable use policy be?

One to two pages. Cover systems and data covered, personal use limits, prohibited actions, monitoring notice, reporting duty and consequences. Have each person sign or click an acknowledgment at hire and once a year after.

Is a phishing simulation worth the effort?

It is worth it as a measuring instrument and as a short teachable moment, if the program is fair and the report rate is the main number. It is not worth it as a stick. Given the UC San Diego finding that embedded training changed clicks by about 2 percent, do not expect simulations to replace phishing-resistant sign-in and payment controls.

Can we read employees' email?

Federal law allows monitoring with consent or where an exception applies, and Idaho follows the one-party consent model. The safe practice is a written notice at hire, an acknowledgment, a policy that says what is monitored and why, and narrow access to the results. Staff in New York, and in other states with notice statutes, must receive the specific notice those statutes describe.

What can we do about a departing employee who took files?

Preserve the evidence first: the mailbox, download logs, cloud sharing logs, and the device. Then revoke access, and use the written policy and any signed agreement as the basis for your demand letter or report. Keep the details need-to-know. Reporting to law enforcement is covered in lesson 11.

Do part-time staff and contractors need to be in the program?

Yes, scaled to their access. A contractor with a company email account and access to a customer folder needs the acceptable use acknowledgment, MFA and an end date on the account. Put an expiry on every contractor account when it is created.

How do we handle a manager who refuses MFA because it is inconvenient?

Treat it as a risk acceptance that the business owner signs in writing. The signed exception, with a date to review it, is far better than a quiet workaround, and the next insurer's question about MFA coverage gets an honest answer.

Hard questions

If training does not work, why spend on it?

Some training is required, and some of the value is not about clicks. A good short lesson teaches staff how to report, who to call, and what a verification call-back looks like. The money argument is weaker than the vendors say, so spend modestly, measure what matters, and put the larger share of the budget into phishing-resistant MFA, email filtering and payment controls. If an executive wants to cut training to zero, the answer is that regulators and insurers ask for it, and that a reporting habit does not form on its own.

Isn't monitoring employees disrespectful, and isn't it a risk of its own?

Both points are fair. Monitoring data is itself sensitive and can be breached, misused or turned into a morale problem. The answer is proportion: log what you need for security and compliance, tell people plainly, limit who sees it, and keep it for a fixed period. The alternative, no logs, leaves you unable to prove what happened after an incident, and the insurer will notice.

What if a background check turns up something and the candidate is otherwise ideal?

Follow the process. Under the FCRA, the person gets a copy of the report and a summary of rights before an adverse action, and a chance to dispute errors. Under the EEOC guidance, ask whether the offense relates to the job, how long ago it was and what the person has done since. Write down the reasons for your decision. Consistency across candidates is your best protection.

Should we fire someone who falls for a phishing email?

Almost never. If one click costs the business $50,000, the failure is a system that let one click cost that much: no dual approval, no phishing-resistant MFA, no segmentation. Reserve discipline for willful violations of the rules, concealment, or repeated disregard after clear coaching. A business that fires for honest error teaches everyone to hide the next one.

How much should we trust a vCISO or outsourced IT provider with all this?

Trust them to do the work and verify through evidence. The owner or a senior manager still signs the policies, accepts the risks and receives the reports. Outsourcing the labor does not outsource the accountability, which is the point of lesson 01. Ask for evidence: the access review sign-off, the offboarding tickets, the training report, in the quarterly dashboard.