Personnel Security and Authorisation
Personnel security throughout the personnel life cycle
Personnel security is intended to reduce the risk of people being placed in, or remaining in, roles where they can harm the organisation's assets. At the same time, clear expectations, competence, good management and safe reporting channels should make employees a strong security barrier.
We distinguish clearly between clearance and authorisation, and support the organisation from the assessment of roles and needs through to authorisation, ongoing security-related management and controlled termination. Our advisers combine expertise in the Security Act, HR, insider risk, management and data protection, so that the measures are necessary, proportionate and practicable.
The advice may include
- mapping of assets requiring protection, roles, access rights, authorities and the consequences of error, misuse or compromise
- risk classification of positions and functions as a basis for the right level of control, training and follow-up
- establishment of a policy, procedures, role descriptions, decision criteria, registers and a governance calendar for personnel security
- clarification of the need for security clearance, access clearance and authorisation, including documentation of the need to know
- support with requests for clearance, verification of clearance status and follow-up of conditions set by the clearance authority
- establishment and quality assurance of the authorisation process, declarations of confidentiality, the authorisation register and access decisions
- preparation, conduct and documentation of authorisation interviews and periodic security interviews
- training of those responsible for authorisation, managers, HR, the security function and personnel with access to assets requiring protection
- secure onboarding with role-based training, the correct physical and digital access rights and clear reporting and notification lines
- ongoing security-related management through dialogue, security culture, tailored follow-up and periodic review of roles, clearances, authorisations and access rights
- prevention and handling of insider risk, attempts at influence, social engineering, security breaches, concerns and relevant changes in the situation of the individual or the organisation
- reassessment in the event of new tasks, changed access rights, renewal of clearance, incidents or reasonable doubt about security suitability
- controlled termination of employment and assignments, with withdrawal of authorisation and access rights, return of assets and a reminder of the lasting duty of confidentiality
What does the organisation receive?
The organisation receives a practical personnel security system with clear roles, decisions and control points throughout the personnel life cycle. The deliverable may include role classification, an authorisation procedure, interview templates, registers, training and routines for ongoing follow-up. This gives better control of access rights and a more secure basis for handling changes, concerns and incidents.
← Back to Security Act and Risk Analysis