ISO/IEC 27001

⌘K
  2. Home
  4. Docs
  6. ISO/IEC 27001
  8. Other Doc
  10. New Employee Security Onboarding Checklist

New Employee Security Onboarding Checklist

1. Purpose

The New Employee Security Onboarding Checklist provides a structured process for securely onboarding a new employee before and after access to organizational systems and information is provided.

The objective is to ensure that each new employee:

  • Is appropriately identified and authorized
  • Understands their information-security responsibilities
  • Receives required security awareness training
  • Signs applicable confidentiality agreements
  • Receives only the access required for their role
  • Uses approved devices and systems
  • Configures required security controls
  • Understands incident-reporting requirements
  • Completes required security training
  • Has onboarding evidence recorded
  • Is subject to appropriate monitoring and review

Core Principle

Hire → Verify → Define Role → Communicate → Train → Approve → Provision → Validate → Record → Monitor

2. When to Use

Use this checklist for:

  • Permanent employees
  • Temporary employees
  • Interns
  • Employees with remote access
  • Employees with privileged access
  • Employees with production access
  • Employees handling customer information
  • Employees handling personal data
  • Employees joining technical teams
  • Employees joining security-sensitive roles

The checklist should be adapted according to the organization’s role and risk requirements.

3. Employee Information

FieldDetails
Employee Name
Employee ID
Job Title
Department
Manager
Employment Type
Join Date
Location
Remote/Office/Hybrid
Role Risk Level
Onboarding Owner
HR Owner
IT Owner
Security Owner

4. Pre-Onboarding

Complete appropriate security activities before the employee starts or before access is provided.

☐ Employment approval completed

☐ Position/role approved

☐ Job responsibilities defined

☐ Role risk assessed

☐ Information access requirements identified

☐ System access requirements identified

☐ Privileged access requirements identified

☐ Production access requirements identified

☐ Customer-data access identified

☐ Personal-data access identified

☐ Cloud access identified

☐ Source-code access identified

☐ Security responsibilities defined

☐ Required screening completed where applicable

☐ Confidentiality requirements identified

☐ Required security training identified

5. Employment and Confidentiality

Verify applicable employment/security documentation.

☐ Employment agreement completed

☐ Confidentiality obligations communicated

☐ NDA/confidentiality agreement completed where required

☐ Intellectual-property obligations communicated

☐ Acceptable-use requirements communicated

☐ Information-security responsibilities communicated

☐ Privacy obligations communicated where applicable

☐ Security policy acknowledgement completed where required

Evidence

6. Employee Screening

Where applicable and lawful:

☐ Required background verification completed

☐ Identity verification completed

☐ Employment history verified where required

☐ Education/professional qualification verified where required

☐ Role-specific checks completed

☐ Screening outcome reviewed

☐ Exceptions documented

☐ Screening evidence protected

Screening should be proportionate to the role, risk, applicable law, and organizational requirements.

7. Role and Responsibility Definition

Verify that the employee’s role is clearly defined.

☐ Job description available

☐ Responsibilities documented

☐ Security responsibilities documented

☐ Information responsibilities identified

☐ System responsibilities identified

☐ Manager assigned

☐ Appropriate segregation of duties considered

☐ Sensitive responsibilities identified

☐ Privileged responsibilities identified

8. Access Requirement Assessment

Before provisioning access, document what the employee actually needs.

SystemEnvironmentAccess RequiredPrivilegedBusiness NeedApprover

Avoid granting access simply because it may be useful in the future.

Principle

No Business Need → No Access

9. Access Approval

Verify:

☐ Access request submitted

☐ Business owner identified

☐ Manager approval obtained

☐ System owner approval obtained where required

☐ Security approval obtained where required

☐ Privileged access separately approved

☐ Production access separately approved

☐ High-risk access reviewed

☐ Access expiry defined where appropriate

10. User Account Creation

For each required system:

☐ Individual account created

☐ Correct employee identity used

☐ Unique username assigned

☐ Shared account avoided

☐ Appropriate role assigned

☐ Correct group membership assigned

☐ Access limited to approved scope

☐ Account owner identified

☐ Account creation recorded

11. Authentication and MFA

Before access is activated:

☐ Strong authentication configured

☐ MFA enabled where required

☐ MFA enrollment completed

☐ Recovery methods configured securely

☐ Authentication requirements explained

☐ Password requirements explained

☐ Password sharing prohibited

☐ Authentication secrets protected

☐ Security notifications enabled where appropriate

12. Privileged Access

If privileged access is required:

☐ Business justification documented

☐ Privileged role approved

☐ Named account used

☐ MFA enabled

☐ Least privilege applied

☐ Administrative permissions defined

☐ Production access separately approved

☐ Logging enabled where appropriate

☐ Access review frequency defined

☐ Expiry/review date defined

☐ Privileged-user training completed

13. Production Access

If production access is required:

☐ Business need documented

☐ Production access approved

☐ Access scope defined

☐ Least privilege applied

☐ MFA enabled

☐ Change-management requirements explained

☐ Emergency-change requirements explained

☐ Production-data handling requirements explained

☐ Logging requirements explained

☐ Incident escalation explained

14. Cloud Access

Where applicable:

☐ Cloud accounts identified

☐ Cloud role assigned

☐ IAM access approved

☐ Least privilege applied

☐ MFA enabled

☐ Production access separately controlled

☐ Administrative access restricted

☐ Cloud logging enabled where required

☐ Cloud security responsibilities explained

Example

For an AWS environment:

  • IAM role identified
  • Appropriate permissions assigned
  • MFA enabled
  • Production access restricted
  • Administrative activity logged
  • Access reviewed periodically

15. Source-Code and Development Access

For developers:

☐ Source-code repositories identified

☐ Repository access approved

☐ Correct repository permissions assigned

☐ Write/admin access restricted

☐ MFA enabled

☐ Branch protections explained

☐ Secrets-management requirements explained

☐ Secure-development requirements communicated

☐ Dependency-security responsibilities communicated

☐ Code-review requirements communicated

16. Email and Collaboration Tools

Provision only approved services.

☐ Corporate email created

☐ MFA enabled

☐ Email security configured

☐ Collaboration tools configured

☐ Appropriate groups/channels assigned

☐ External-sharing restrictions explained

☐ Sensitive-information sharing requirements explained

☐ Phishing reporting mechanism explained

☐ Unauthorized forwarding restrictions explained

17. Endpoint Assignment

If an organizational device is provided:

☐ Laptop/device assigned

☐ Asset ID recorded

☐ Device ownership recorded

☐ Device encryption enabled

☐ Endpoint protection enabled

☐ Security configuration applied

☐ Operating system supported

☐ Security updates enabled

☐ Screen lock configured

☐ Automatic locking enabled

☐ Device management enabled where required

☐ Local administrator access restricted

18. Mobile Device

Where applicable:

☐ Mobile device requirement assessed

☐ Device registered

☐ Screen lock enabled

☐ Device encryption enabled where supported

☐ Approved applications installed

☐ Device-management controls applied where required

☐ Lost/stolen-device reporting explained

☐ Remote-wipe capability considered

19. Physical Access

For office-based employees:

☐ Building access approved

☐ Access card/badge issued

☐ Badge linked to employee

☐ Visitor requirements explained

☐ Restricted-area requirements explained

☐ Secure-area access approved separately

☐ Lost badge reporting explained

☐ Physical security responsibilities explained

20. Remote Working

For remote/hybrid employees:

☐ Remote-working requirements explained

☐ Secure Wi-Fi guidance provided

☐ VPN configured where required

☐ Device-security requirements explained

☐ Screen privacy explained

☐ Confidential-information handling explained

☐ Public-location risks explained

☐ Lost-device reporting explained

☐ Approved collaboration tools explained

21. Security Awareness Training

Complete required initial awareness training.

☐ Information-security responsibilities

☐ Acceptable use

☐ Password security

☐ MFA

☐ Phishing

☐ Social engineering

☐ Malware/ransomware

☐ Incident reporting

☐ Information classification

☐ Customer-data protection

☐ Privacy

☐ Remote working

☐ Endpoint security

☐ Physical security

☐ AI security where applicable

22. Policy Awareness

Provide access to applicable security policies.

☐ Information Security Policy

☐ Acceptable Use Policy

☐ Access Control Policy

☐ Information Classification Policy

☐ Incident Management Policy

☐ Remote Working Policy

☐ Cloud Security Policy

☐ Privacy/Data Protection Policy

☐ AI Security Policy

☐ Other applicable policies

Employee Confirmation

☐ Policies provided

☐ Policies reviewed

☐ Acknowledgement completed where required

23. Incident Reporting Training

The employee must know:

☐ What is a security event

☐ What is a security incident

☐ What must be reported

☐ Who to contact

☐ How to report

☐ When to report

☐ What information to provide

☐ What actions to avoid

Test

Ask the employee:

“What would you do if you accidentally sent customer information to the wrong person?”

Expected response should align with the organization’s incident-reporting procedure.

☐ Correct

☐ Additional training required

24. Information Classification Training

Verify that the employee understands:

☐ Public information

☐ Internal information

☐ Confidential information

☐ Restricted information

☐ Storage requirements

☐ Transfer requirements

☐ Access restrictions

☐ Disposal requirements

The organization’s actual classification scheme should be used.

25. Data Protection and Privacy

Where applicable:

☐ Personal data identified

☐ Customer data identified

☐ Privacy responsibilities explained

☐ Data minimization explained

☐ Secure sharing explained

☐ Retention requirements explained

☐ Data deletion requirements explained

☐ Privacy incident reporting explained

26. AI Security

Where AI tools are used:

☐ Approved AI tools identified

☐ Confidential-data restrictions explained

☐ Customer-data restrictions explained

☐ Personal-data restrictions explained

☐ Source-code restrictions explained

☐ Credential/secret restrictions explained

☐ AI-generated content review explained

☐ Shadow-AI risks explained

☐ AI incident reporting explained

Key Rule

Do not enter confidential, restricted, personal, customer, credential, or secret information into an AI service unless explicitly authorized.

27. Security Responsibilities

The employee understands that they are responsible for:

☐ Protecting credentials

☐ Protecting assigned devices

☐ Protecting organizational information

☐ Protecting customer information

☐ Following security policies

☐ Using approved systems

☐ Reporting security incidents

☐ Reporting suspected weaknesses

☐ Following access restrictions

☐ Cooperating with security investigations

☐ Completing required training

28. Security Training Assessment

Verify understanding.

TopicTraining CompletedAssessmentResult
Information Security
MFA/Passwords
Phishing
Classification
Incident Reporting
Privacy
Acceptable Use
AI Security
Role-Specific Security

Overall Result

☐ Passed

☐ Additional training required

☐ Retest required

29. Asset Assignment

Record organizational assets provided to the employee.

AssetAsset IDSerial No.Assigned DateConditionEmployee Acknowledgement
Laptop
Mobile
Access Card
Token/Authenticator
Other

30. Secrets and Credentials

Verify that sensitive credentials are handled securely.

☐ No passwords sent through insecure channels

☐ Temporary credentials handled securely

☐ Initial passwords changed where applicable

☐ Secrets not stored in email/chat

☐ API keys not unnecessarily issued

☐ SSH keys managed appropriately

☐ Cloud credentials managed appropriately

☐ Secrets-management requirements explained

31. Application and SaaS Access

For each approved SaaS application:

☐ Application identified

☐ Business need documented

☐ Account created

☐ Correct role assigned

☐ MFA enabled

☐ External sharing restrictions considered

☐ Sensitive data access assessed

☐ Access recorded

32. Security Validation Before Go-Live

Before the employee begins normal system use:

☐ Required accounts created

☐ MFA verified

☐ Access permissions verified

☐ Device security verified

☐ Endpoint protection verified

☐ Required applications installed

☐ Security policies communicated

☐ Security training completed

☐ Incident-reporting method tested

☐ Privileged access validated where applicable

☐ Production access validated where applicable

33. Manager Verification

The manager confirms:

☐ Employee role is correctly defined

☐ Access requested is appropriate

☐ Security responsibilities are understood

☐ Required training is completed

☐ Additional role-specific training has been identified

☐ No unnecessary access has been requested

Manager: ___________________________

Date: _______________________________

34. IT/Security Verification

IT Verification

☐ Accounts created

☐ MFA enabled

☐ Device secured

☐ Applications configured

☐ Access validated

Security Verification

☐ Security training completed

☐ Privileged access reviewed

☐ High-risk access reviewed

☐ Security requirements communicated

☐ Exceptions assessed

IT Reviewer: _________________________

Security Reviewer: ___________________

Date: _______________________________

35. Exceptions

Where a security onboarding requirement cannot be completed:

Requirement: _________________________

Reason: ______________________________

Risk: _________________________________

Compensating Control: _________________

Owner: _______________________________

Approval: _____________________________

Target Completion Date: _______________

Review Date: __________________________

36. Onboarding Completion

Mandatory Requirements

☐ Employment documentation completed

☐ Required screening completed

☐ Confidentiality requirements completed

☐ Role defined

☐ Access requirements approved

☐ Accounts created

☐ MFA enabled

☐ Device secured

☐ Security training completed

☐ Policies communicated

☐ Incident reporting explained

☐ Required role-based training completed

☐ Access validated

☐ Assets recorded

☐ Evidence retained

37. Onboarding Status

☐ Complete

☐ Complete with Approved Exceptions

☐ Pending

☐ Security Review Required

☐ Access Must Not Yet Be Granted

Outstanding Items

Required Actions

38. Post-Onboarding Review

Conduct a follow-up review after the employee has started working.

Suggested review points:

After 7 Days

☐ Access working correctly

☐ No unnecessary access identified

☐ Training completed

☐ Security questions addressed

After 30 Days

☐ Access remains appropriate

☐ Role responsibilities understood

☐ Security training effectiveness reviewed

☐ Additional training identified

After 90 Days

☐ Access reviewed

☐ Security performance considered

☐ Role-specific training reviewed

☐ Any onboarding issues addressed

39. Evidence Retention

Maintain appropriate onboarding evidence.

☐ Employment documentation

☐ Screening evidence where applicable

☐ Confidentiality acknowledgement

☐ Security training records

☐ Policy acknowledgement

☐ Access approvals

☐ Account provisioning records

☐ MFA configuration evidence

☐ Asset assignment

☐ Privileged-access approval

☐ Production-access approval

☐ Exceptions

☐ Manager approval

☐ Security/IT verification

Evidence should be protected and retained according to the organization’s retention requirements.

Do not unnecessarily retain passwords, private keys, authentication secrets, or other credentials as onboarding evidence.

40. AWS SaaS Startup Example

Consider a SaaS startup hiring a new software engineer.

Employee

Role: Software Engineer

Systems Required:

  • Corporate email
  • GitHub
  • Jira
  • Slack
  • AWS development environment
  • CI/CD platform

Access

The engineer requires:

  • GitHub repository access
  • Development AWS access
  • Jira access
  • Slack access

The engineer does not initially require:

  • AWS production administrator access
  • Production database access
  • Security administration
  • Customer production data

Security Onboarding

☐ NDA completed

☐ Role defined

☐ Background verification completed where required

☐ MFA configured

☐ Security awareness completed

☐ Phishing training completed

☐ Information classification training completed

☐ Secure-development training completed

☐ GitHub access approved

☐ AWS development access approved

☐ Production access not granted

☐ Device encryption enabled

☐ Endpoint protection enabled

Audit Trail

Employee → Role → Risk → Access Need → Approval → Training → MFA → Provisioning → Validation → Evidence → Monitoring

41. Startup-Friendly Onboarding Model

A startup can keep onboarding efficient without weakening security.

Before First Access

Complete:

  • Role definition
  • Access requirements
  • Required approvals
  • Confidentiality
  • Required screening
  • Security responsibilities

Day 1

Complete:

  • Security awareness
  • MFA
  • Device security
  • Account setup
  • Policy awareness
  • Incident reporting

First Week

Complete:

  • Role-based security training
  • Application-specific training
  • Access validation

First 30 Days

Review:

  • Access
  • Training
  • Security understanding
  • Any exceptions
  • Additional requirements

Principle

Fast onboarding should mean fast secure onboarding—not bypassing security controls.

42. Common Mistakes

Avoid:

  • Creating accounts before confirming the employee’s role.
  • Granting access before approval.
  • Giving excessive access “just in case.”
  • Giving production access by default.
  • Giving privileged access without additional review.
  • Forgetting MFA.
  • Treating NDA completion as security onboarding.
  • Providing security training only months after joining.
  • Not explaining incident reporting.
  • Not recording asset assignments.
  • Ignoring contractors or interns.
  • Ignoring remote-working risks.
  • Ignoring AI usage.
  • Failing to review access after onboarding.
  • Retaining unnecessary credentials as evidence.
  • Treating HR onboarding and security onboarding as completely separate processes.

43. Relationship With Other ISMS Documents

DocumentRelationship
Employee Screening PolicyDefines pre-employment screening
Background Verification ProcedurePerforms applicable verification
Employee Onboarding ChecklistCovers broader employee onboarding
Employee Security Training ChecklistVerifies individual security training
Security Awareness and Training ProcedureDefines training process
Annual Security Awareness PlanDefines annual awareness activities
Access Management ProcedureControls account/access provisioning
Role-Based Security Responsibilities MatrixDefines security responsibilities
Access Review ChecklistReviews ongoing access
Employee Role Change ChecklistControls access/training during role changes
Employee Offboarding ChecklistControls secure employee exit
Asset Management ProcedureControls asset assignment
Information Classification PolicyDefines information-handling requirements
Incident Response ProcedureDefines security incident reporting
Acceptable Use PolicyDefines acceptable technology usage

44. ISO 27001 Connection

Secure employee onboarding supports the organization’s information-security management system by ensuring that personnel understand their responsibilities, receive appropriate awareness and training, and obtain only the access required for their roles.

The onboarding process should be risk-based and consider:

  • Job responsibilities
  • Information handled
  • System access
  • Privileged access
  • Production access
  • Customer information
  • Personal data
  • Cloud access
  • Security responsibilities
  • Applicable policies
  • Legal and contractual requirements

The New Employee Security Onboarding Checklist is not itself a universally prescribed ISO 27001 form. The organization should determine the appropriate onboarding activities and evidence based on its ISMS scope, risks, applicable controls, business requirements, and legal/contractual obligations.

45. Final Audit Checklist

☐ Employee identity verified

☐ Role defined

☐ Responsibilities defined

☐ Role risk assessed

☐ Required screening completed

☐ Confidentiality requirements completed

☐ Security responsibilities communicated

☐ Access requirements identified

☐ Access approved

☐ Accounts created

☐ MFA enabled

☐ Least privilege applied

☐ Privileged access separately approved

☐ Production access separately approved

☐ Cloud access reviewed

☐ Endpoint secured

☐ Assets recorded

☐ Security policies communicated

☐ Security awareness completed

☐ Role-based training completed

☐ Incident reporting understood

☐ Information classification understood

☐ Privacy requirements understood

☐ AI-security requirements understood where applicable

☐ Access validated

☐ Manager verification completed

☐ IT/Security verification completed

☐ Exceptions documented

☐ Evidence retained

☐ Post-onboarding review scheduled

46. Final Audit Trail

For every new employee, the organization should be able to demonstrate:

Who is the employee?
What is their role?
What security responsibilities do they have?
What information will they access?
What systems will they access?
What access is actually required?
Who approved that access?
Was MFA enabled?
Was the employee trained?
Do they understand how to report incidents?
Were privileged or production permissions separately reviewed?
Were organizational assets properly assigned?
Was unnecessary access avoided?
Was onboarding evidence retained?
Was the employee’s access validated after onboarding?

Final Principle

Secure employee onboarding is the first point at which the organization establishes a person’s security responsibilities, identity, access, training, and accountability. The objective is not merely to get the employee working quickly, but to ensure they can begin work securely from day one.

Onboarding lifecycle:

Verify → Define Role → Assess Risk → Approve → Train → Authenticate → Provision → Validate → Record → Monitor