1. Purpose
The New Employee Security Onboarding Checklist provides a structured process for securely onboarding a new employee before and after access to organizational systems and information is provided.
The objective is to ensure that each new employee:
- Is appropriately identified and authorized
- Understands their information-security responsibilities
- Receives required security awareness training
- Signs applicable confidentiality agreements
- Receives only the access required for their role
- Uses approved devices and systems
- Configures required security controls
- Understands incident-reporting requirements
- Completes required security training
- Has onboarding evidence recorded
- Is subject to appropriate monitoring and review
Core Principle
Hire → Verify → Define Role → Communicate → Train → Approve → Provision → Validate → Record → Monitor
2. When to Use
Use this checklist for:
- Permanent employees
- Temporary employees
- Interns
- Employees with remote access
- Employees with privileged access
- Employees with production access
- Employees handling customer information
- Employees handling personal data
- Employees joining technical teams
- Employees joining security-sensitive roles
The checklist should be adapted according to the organization’s role and risk requirements.
3. Employee Information
| Field | Details |
|---|---|
| Employee Name | |
| Employee ID | |
| Job Title | |
| Department | |
| Manager | |
| Employment Type | |
| Join Date | |
| Location | |
| Remote/Office/Hybrid | |
| Role Risk Level | |
| Onboarding Owner | |
| HR Owner | |
| IT Owner | |
| Security Owner |
4. Pre-Onboarding
Complete appropriate security activities before the employee starts or before access is provided.
☐ Employment approval completed
☐ Position/role approved
☐ Job responsibilities defined
☐ Role risk assessed
☐ Information access requirements identified
☐ System access requirements identified
☐ Privileged access requirements identified
☐ Production access requirements identified
☐ Customer-data access identified
☐ Personal-data access identified
☐ Cloud access identified
☐ Source-code access identified
☐ Security responsibilities defined
☐ Required screening completed where applicable
☐ Confidentiality requirements identified
☐ Required security training identified
5. Employment and Confidentiality
Verify applicable employment/security documentation.
☐ Employment agreement completed
☐ Confidentiality obligations communicated
☐ NDA/confidentiality agreement completed where required
☐ Intellectual-property obligations communicated
☐ Acceptable-use requirements communicated
☐ Information-security responsibilities communicated
☐ Privacy obligations communicated where applicable
☐ Security policy acknowledgement completed where required
Evidence
6. Employee Screening
Where applicable and lawful:
☐ Required background verification completed
☐ Identity verification completed
☐ Employment history verified where required
☐ Education/professional qualification verified where required
☐ Role-specific checks completed
☐ Screening outcome reviewed
☐ Exceptions documented
☐ Screening evidence protected
Screening should be proportionate to the role, risk, applicable law, and organizational requirements.
7. Role and Responsibility Definition
Verify that the employee’s role is clearly defined.
☐ Job description available
☐ Responsibilities documented
☐ Security responsibilities documented
☐ Information responsibilities identified
☐ System responsibilities identified
☐ Manager assigned
☐ Appropriate segregation of duties considered
☐ Sensitive responsibilities identified
☐ Privileged responsibilities identified
8. Access Requirement Assessment
Before provisioning access, document what the employee actually needs.
| System | Environment | Access Required | Privileged | Business Need | Approver |
|---|---|---|---|---|---|
Avoid granting access simply because it may be useful in the future.
Principle
No Business Need → No Access
9. Access Approval
Verify:
☐ Access request submitted
☐ Business owner identified
☐ Manager approval obtained
☐ System owner approval obtained where required
☐ Security approval obtained where required
☐ Privileged access separately approved
☐ Production access separately approved
☐ High-risk access reviewed
☐ Access expiry defined where appropriate
10. User Account Creation
For each required system:
☐ Individual account created
☐ Correct employee identity used
☐ Unique username assigned
☐ Shared account avoided
☐ Appropriate role assigned
☐ Correct group membership assigned
☐ Access limited to approved scope
☐ Account owner identified
☐ Account creation recorded
11. Authentication and MFA
Before access is activated:
☐ Strong authentication configured
☐ MFA enabled where required
☐ MFA enrollment completed
☐ Recovery methods configured securely
☐ Authentication requirements explained
☐ Password requirements explained
☐ Password sharing prohibited
☐ Authentication secrets protected
☐ Security notifications enabled where appropriate
12. Privileged Access
If privileged access is required:
☐ Business justification documented
☐ Privileged role approved
☐ Named account used
☐ MFA enabled
☐ Least privilege applied
☐ Administrative permissions defined
☐ Production access separately approved
☐ Logging enabled where appropriate
☐ Access review frequency defined
☐ Expiry/review date defined
☐ Privileged-user training completed
13. Production Access
If production access is required:
☐ Business need documented
☐ Production access approved
☐ Access scope defined
☐ Least privilege applied
☐ MFA enabled
☐ Change-management requirements explained
☐ Emergency-change requirements explained
☐ Production-data handling requirements explained
☐ Logging requirements explained
☐ Incident escalation explained
14. Cloud Access
Where applicable:
☐ Cloud accounts identified
☐ Cloud role assigned
☐ IAM access approved
☐ Least privilege applied
☐ MFA enabled
☐ Production access separately controlled
☐ Administrative access restricted
☐ Cloud logging enabled where required
☐ Cloud security responsibilities explained
Example
For an AWS environment:
- IAM role identified
- Appropriate permissions assigned
- MFA enabled
- Production access restricted
- Administrative activity logged
- Access reviewed periodically
15. Source-Code and Development Access
For developers:
☐ Source-code repositories identified
☐ Repository access approved
☐ Correct repository permissions assigned
☐ Write/admin access restricted
☐ MFA enabled
☐ Branch protections explained
☐ Secrets-management requirements explained
☐ Secure-development requirements communicated
☐ Dependency-security responsibilities communicated
☐ Code-review requirements communicated
16. Email and Collaboration Tools
Provision only approved services.
☐ Corporate email created
☐ MFA enabled
☐ Email security configured
☐ Collaboration tools configured
☐ Appropriate groups/channels assigned
☐ External-sharing restrictions explained
☐ Sensitive-information sharing requirements explained
☐ Phishing reporting mechanism explained
☐ Unauthorized forwarding restrictions explained
17. Endpoint Assignment
If an organizational device is provided:
☐ Laptop/device assigned
☐ Asset ID recorded
☐ Device ownership recorded
☐ Device encryption enabled
☐ Endpoint protection enabled
☐ Security configuration applied
☐ Operating system supported
☐ Security updates enabled
☐ Screen lock configured
☐ Automatic locking enabled
☐ Device management enabled where required
☐ Local administrator access restricted
18. Mobile Device
Where applicable:
☐ Mobile device requirement assessed
☐ Device registered
☐ Screen lock enabled
☐ Device encryption enabled where supported
☐ Approved applications installed
☐ Device-management controls applied where required
☐ Lost/stolen-device reporting explained
☐ Remote-wipe capability considered
19. Physical Access
For office-based employees:
☐ Building access approved
☐ Access card/badge issued
☐ Badge linked to employee
☐ Visitor requirements explained
☐ Restricted-area requirements explained
☐ Secure-area access approved separately
☐ Lost badge reporting explained
☐ Physical security responsibilities explained
20. Remote Working
For remote/hybrid employees:
☐ Remote-working requirements explained
☐ Secure Wi-Fi guidance provided
☐ VPN configured where required
☐ Device-security requirements explained
☐ Screen privacy explained
☐ Confidential-information handling explained
☐ Public-location risks explained
☐ Lost-device reporting explained
☐ Approved collaboration tools explained
21. Security Awareness Training
Complete required initial awareness training.
☐ Information-security responsibilities
☐ Acceptable use
☐ Password security
☐ MFA
☐ Phishing
☐ Social engineering
☐ Malware/ransomware
☐ Incident reporting
☐ Information classification
☐ Customer-data protection
☐ Privacy
☐ Remote working
☐ Endpoint security
☐ Physical security
☐ AI security where applicable
22. Policy Awareness
Provide access to applicable security policies.
☐ Information Security Policy
☐ Acceptable Use Policy
☐ Access Control Policy
☐ Information Classification Policy
☐ Incident Management Policy
☐ Remote Working Policy
☐ Cloud Security Policy
☐ Privacy/Data Protection Policy
☐ AI Security Policy
☐ Other applicable policies
Employee Confirmation
☐ Policies provided
☐ Policies reviewed
☐ Acknowledgement completed where required
23. Incident Reporting Training
The employee must know:
☐ What is a security event
☐ What is a security incident
☐ What must be reported
☐ Who to contact
☐ How to report
☐ When to report
☐ What information to provide
☐ What actions to avoid
Test
Ask the employee:
“What would you do if you accidentally sent customer information to the wrong person?”
Expected response should align with the organization’s incident-reporting procedure.
☐ Correct
☐ Additional training required
24. Information Classification Training
Verify that the employee understands:
☐ Public information
☐ Internal information
☐ Confidential information
☐ Restricted information
☐ Storage requirements
☐ Transfer requirements
☐ Access restrictions
☐ Disposal requirements
The organization’s actual classification scheme should be used.
25. Data Protection and Privacy
Where applicable:
☐ Personal data identified
☐ Customer data identified
☐ Privacy responsibilities explained
☐ Data minimization explained
☐ Secure sharing explained
☐ Retention requirements explained
☐ Data deletion requirements explained
☐ Privacy incident reporting explained
26. AI Security
Where AI tools are used:
☐ Approved AI tools identified
☐ Confidential-data restrictions explained
☐ Customer-data restrictions explained
☐ Personal-data restrictions explained
☐ Source-code restrictions explained
☐ Credential/secret restrictions explained
☐ AI-generated content review explained
☐ Shadow-AI risks explained
☐ AI incident reporting explained
Key Rule
Do not enter confidential, restricted, personal, customer, credential, or secret information into an AI service unless explicitly authorized.
27. Security Responsibilities
The employee understands that they are responsible for:
☐ Protecting credentials
☐ Protecting assigned devices
☐ Protecting organizational information
☐ Protecting customer information
☐ Following security policies
☐ Using approved systems
☐ Reporting security incidents
☐ Reporting suspected weaknesses
☐ Following access restrictions
☐ Cooperating with security investigations
☐ Completing required training
28. Security Training Assessment
Verify understanding.
| Topic | Training Completed | Assessment | Result |
|---|---|---|---|
| Information Security | |||
| MFA/Passwords | |||
| Phishing | |||
| Classification | |||
| Incident Reporting | |||
| Privacy | |||
| Acceptable Use | |||
| AI Security | |||
| Role-Specific Security |
Overall Result
☐ Passed
☐ Additional training required
☐ Retest required
29. Asset Assignment
Record organizational assets provided to the employee.
| Asset | Asset ID | Serial No. | Assigned Date | Condition | Employee Acknowledgement |
|---|---|---|---|---|---|
| Laptop | |||||
| Mobile | |||||
| Access Card | |||||
| Token/Authenticator | |||||
| Other |
30. Secrets and Credentials
Verify that sensitive credentials are handled securely.
☐ No passwords sent through insecure channels
☐ Temporary credentials handled securely
☐ Initial passwords changed where applicable
☐ Secrets not stored in email/chat
☐ API keys not unnecessarily issued
☐ SSH keys managed appropriately
☐ Cloud credentials managed appropriately
☐ Secrets-management requirements explained
31. Application and SaaS Access
For each approved SaaS application:
☐ Application identified
☐ Business need documented
☐ Account created
☐ Correct role assigned
☐ MFA enabled
☐ External sharing restrictions considered
☐ Sensitive data access assessed
☐ Access recorded
32. Security Validation Before Go-Live
Before the employee begins normal system use:
☐ Required accounts created
☐ MFA verified
☐ Access permissions verified
☐ Device security verified
☐ Endpoint protection verified
☐ Required applications installed
☐ Security policies communicated
☐ Security training completed
☐ Incident-reporting method tested
☐ Privileged access validated where applicable
☐ Production access validated where applicable
33. Manager Verification
The manager confirms:
☐ Employee role is correctly defined
☐ Access requested is appropriate
☐ Security responsibilities are understood
☐ Required training is completed
☐ Additional role-specific training has been identified
☐ No unnecessary access has been requested
Manager: ___________________________
Date: _______________________________
34. IT/Security Verification
IT Verification
☐ Accounts created
☐ MFA enabled
☐ Device secured
☐ Applications configured
☐ Access validated
Security Verification
☐ Security training completed
☐ Privileged access reviewed
☐ High-risk access reviewed
☐ Security requirements communicated
☐ Exceptions assessed
IT Reviewer: _________________________
Security Reviewer: ___________________
Date: _______________________________
35. Exceptions
Where a security onboarding requirement cannot be completed:
Requirement: _________________________
Reason: ______________________________
Risk: _________________________________
Compensating Control: _________________
Owner: _______________________________
Approval: _____________________________
Target Completion Date: _______________
Review Date: __________________________
36. Onboarding Completion
Mandatory Requirements
☐ Employment documentation completed
☐ Required screening completed
☐ Confidentiality requirements completed
☐ Role defined
☐ Access requirements approved
☐ Accounts created
☐ MFA enabled
☐ Device secured
☐ Security training completed
☐ Policies communicated
☐ Incident reporting explained
☐ Required role-based training completed
☐ Access validated
☐ Assets recorded
☐ Evidence retained
37. Onboarding Status
☐ Complete
☐ Complete with Approved Exceptions
☐ Pending
☐ Security Review Required
☐ Access Must Not Yet Be Granted
Outstanding Items
Required Actions
38. Post-Onboarding Review
Conduct a follow-up review after the employee has started working.
Suggested review points:
After 7 Days
☐ Access working correctly
☐ No unnecessary access identified
☐ Training completed
☐ Security questions addressed
After 30 Days
☐ Access remains appropriate
☐ Role responsibilities understood
☐ Security training effectiveness reviewed
☐ Additional training identified
After 90 Days
☐ Access reviewed
☐ Security performance considered
☐ Role-specific training reviewed
☐ Any onboarding issues addressed
39. Evidence Retention
Maintain appropriate onboarding evidence.
☐ Employment documentation
☐ Screening evidence where applicable
☐ Confidentiality acknowledgement
☐ Security training records
☐ Policy acknowledgement
☐ Access approvals
☐ Account provisioning records
☐ MFA configuration evidence
☐ Asset assignment
☐ Privileged-access approval
☐ Production-access approval
☐ Exceptions
☐ Manager approval
☐ Security/IT verification
Evidence should be protected and retained according to the organization’s retention requirements.
Do not unnecessarily retain passwords, private keys, authentication secrets, or other credentials as onboarding evidence.
40. AWS SaaS Startup Example
Consider a SaaS startup hiring a new software engineer.
Employee
Role: Software Engineer
Systems Required:
- Corporate email
- GitHub
- Jira
- Slack
- AWS development environment
- CI/CD platform
Access
The engineer requires:
- GitHub repository access
- Development AWS access
- Jira access
- Slack access
The engineer does not initially require:
- AWS production administrator access
- Production database access
- Security administration
- Customer production data
Security Onboarding
☐ NDA completed
☐ Role defined
☐ Background verification completed where required
☐ MFA configured
☐ Security awareness completed
☐ Phishing training completed
☐ Information classification training completed
☐ Secure-development training completed
☐ GitHub access approved
☐ AWS development access approved
☐ Production access not granted
☐ Device encryption enabled
☐ Endpoint protection enabled
Audit Trail
Employee → Role → Risk → Access Need → Approval → Training → MFA → Provisioning → Validation → Evidence → Monitoring
41. Startup-Friendly Onboarding Model
A startup can keep onboarding efficient without weakening security.
Before First Access
Complete:
- Role definition
- Access requirements
- Required approvals
- Confidentiality
- Required screening
- Security responsibilities
Day 1
Complete:
- Security awareness
- MFA
- Device security
- Account setup
- Policy awareness
- Incident reporting
First Week
Complete:
- Role-based security training
- Application-specific training
- Access validation
First 30 Days
Review:
- Access
- Training
- Security understanding
- Any exceptions
- Additional requirements
Principle
Fast onboarding should mean fast secure onboarding—not bypassing security controls.
42. Common Mistakes
Avoid:
- Creating accounts before confirming the employee’s role.
- Granting access before approval.
- Giving excessive access “just in case.”
- Giving production access by default.
- Giving privileged access without additional review.
- Forgetting MFA.
- Treating NDA completion as security onboarding.
- Providing security training only months after joining.
- Not explaining incident reporting.
- Not recording asset assignments.
- Ignoring contractors or interns.
- Ignoring remote-working risks.
- Ignoring AI usage.
- Failing to review access after onboarding.
- Retaining unnecessary credentials as evidence.
- Treating HR onboarding and security onboarding as completely separate processes.
43. Relationship With Other ISMS Documents
| Document | Relationship |
|---|---|
| Employee Screening Policy | Defines pre-employment screening |
| Background Verification Procedure | Performs applicable verification |
| Employee Onboarding Checklist | Covers broader employee onboarding |
| Employee Security Training Checklist | Verifies individual security training |
| Security Awareness and Training Procedure | Defines training process |
| Annual Security Awareness Plan | Defines annual awareness activities |
| Access Management Procedure | Controls account/access provisioning |
| Role-Based Security Responsibilities Matrix | Defines security responsibilities |
| Access Review Checklist | Reviews ongoing access |
| Employee Role Change Checklist | Controls access/training during role changes |
| Employee Offboarding Checklist | Controls secure employee exit |
| Asset Management Procedure | Controls asset assignment |
| Information Classification Policy | Defines information-handling requirements |
| Incident Response Procedure | Defines security incident reporting |
| Acceptable Use Policy | Defines acceptable technology usage |
44. ISO 27001 Connection
Secure employee onboarding supports the organization’s information-security management system by ensuring that personnel understand their responsibilities, receive appropriate awareness and training, and obtain only the access required for their roles.
The onboarding process should be risk-based and consider:
- Job responsibilities
- Information handled
- System access
- Privileged access
- Production access
- Customer information
- Personal data
- Cloud access
- Security responsibilities
- Applicable policies
- Legal and contractual requirements
The New Employee Security Onboarding Checklist is not itself a universally prescribed ISO 27001 form. The organization should determine the appropriate onboarding activities and evidence based on its ISMS scope, risks, applicable controls, business requirements, and legal/contractual obligations.
45. Final Audit Checklist
☐ Employee identity verified
☐ Role defined
☐ Responsibilities defined
☐ Role risk assessed
☐ Required screening completed
☐ Confidentiality requirements completed
☐ Security responsibilities communicated
☐ Access requirements identified
☐ Access approved
☐ Accounts created
☐ MFA enabled
☐ Least privilege applied
☐ Privileged access separately approved
☐ Production access separately approved
☐ Cloud access reviewed
☐ Endpoint secured
☐ Assets recorded
☐ Security policies communicated
☐ Security awareness completed
☐ Role-based training completed
☐ Incident reporting understood
☐ Information classification understood
☐ Privacy requirements understood
☐ AI-security requirements understood where applicable
☐ Access validated
☐ Manager verification completed
☐ IT/Security verification completed
☐ Exceptions documented
☐ Evidence retained
☐ Post-onboarding review scheduled
46. Final Audit Trail
For every new employee, the organization should be able to demonstrate:
Who is the employee?
What is their role?
What security responsibilities do they have?
What information will they access?
What systems will they access?
What access is actually required?
Who approved that access?
Was MFA enabled?
Was the employee trained?
Do they understand how to report incidents?
Were privileged or production permissions separately reviewed?
Were organizational assets properly assigned?
Was unnecessary access avoided?
Was onboarding evidence retained?
Was the employee’s access validated after onboarding?
Final Principle
Secure employee onboarding is the first point at which the organization establishes a person’s security responsibilities, identity, access, training, and accountability. The objective is not merely to get the employee working quickly, but to ensure they can begin work securely from day one.
Onboarding lifecycle:
Verify → Define Role → Assess Risk → Approve → Train → Authenticate → Provision → Validate → Record → Monitor