Personnel security and supply chain risk management

People and suppliers are two of the largest sources of security risk, and two of the hardest to control with technology alone. An organization trusts its employees, contractors and vendors with access to systems and data, and that trust can be misplaced, abused or simply exploited by attackers who target the weakest link. Sub-domain 1.8 of the CISSP outline covers personnel security policies and procedures across the employment life cycle, and sub-domain 1.11 covers supply chain risk management (SCRM). This lesson treats them together because both are about managing trust in people and organizations outside the security team's direct control.

The employment life cycle

Personnel security applies at every stage of a person's relationship with the organization: before hiring, during employment, when changing roles and when leaving. Human resources, managers, legal, IT and security share responsibility.

Candidate screening and hiring

Screening reduces the risk of hiring people who are dishonest, unqualified or vulnerable to coercion. The depth of screening should match the sensitivity of the role: a receptionist and a database administrator with access to every customer record do not need the same checks. Common checks include verifying identity and the right to work, confirming education and professional credentials, checking references and employment history, and, where lawful and relevant, criminal record, credit or security clearance checks. Job descriptions should define security responsibilities and the access each role needs, which later guides least privilege.

In the United States, background checks through consumer reporting agencies are governed by the Fair Credit Reporting Act, which requires written disclosure and authorization and an adverse action process. The EEOC's guidance on the use of criminal records warns against blanket exclusions that may discriminate, and many states and cities have 'ban the box' laws delaying criminal history questions; some also limit credit checks. Federal positions require background investigations, and access to classified information requires a clearance through the federal personnel vetting system.

Employment agreements and onboarding

Employment agreements and policy acknowledgments set expectations before access is granted. Common elements include non-disclosure or confidentiality agreements, which protect trade secrets and confidential information; acceptable use policy acknowledgment; intellectual property assignment clauses; conflict-of-interest disclosures; and, where lawful, non-solicitation or non-competition clauses. Onboarding should grant only the access needed for the role, provide security awareness training before or soon after access is granted, and record the person's identity and access in the identity management system.

During employment, several controls reduce the risk of fraud and misuse. Separation of duties prevents one person from completing and hiding a harmful transaction. Job rotation moves people between roles so that irregularities are more likely to be noticed by the next person. Mandatory vacations, common in banking, require people to take consecutive days off so that someone else performs their duties and might uncover fraud that depends on constant attention. Regular access reviews confirm that each person's access still matches their role, and monitoring for unusual behavior can help detect insider threats.

Transfers and termination

Role changes are a common source of excessive access. When a person moves departments, they often gain new access but keep the old, a problem called privilege creep or access accumulation. Transfer procedures should review and remove access no longer needed, not only add new access.

Termination procedures must revoke access promptly and recover assets. For voluntary departures, the process usually includes an exit interview reminding the person of continuing obligations such as confidentiality, return of equipment and badges, and disabling accounts at the end of the last day. For involuntary terminations, especially of people with privileged access, accounts should be disabled at or just before the moment the person is told, and the person escorted from the premises if risk warrants it. Shared passwords the person knew should be changed. A well-designed process connects the HR system to the identity system so that termination automatically triggers deprovisioning.

Vendors, consultants and contractors

Third parties who work inside the organization, such as consultants, contractors and managed service providers, need the same discipline as employees. Contracts should specify security requirements, background checks for their staff where appropriate, confidentiality, the right to audit, incident notification and return of data at the end. Access should be time-limited, tied to named individuals rather than shared accounts, monitored and reviewed. Many major breaches started with compromised third-party credentials, such as a contractor's remote access account.

Supply chain risk management

Supply chain risk is the risk that a product or service acquired from a supplier introduces harm, whether through poor quality, compromise by attackers, insolvency, geopolitical events or the supplier's own suppliers. The outline highlights risks associated with acquiring products and services, and mitigations such as third-party assessment and monitoring, minimum security requirements, service level requirements and software bills of materials.

Software supply chain attacks have shown the scale of the problem. In the SolarWinds compromise discovered in 2020, attackers inserted malicious code into a trusted software update distributed to thousands of customers. In 2021, the Kaseya attack used a managed service platform to spread ransomware to many downstream businesses, and the Log4Shell vulnerability in a widely used open-source logging library exposed vast numbers of systems. In 2024, a backdoor deliberately planted in the open-source XZ Utils compression library was discovered shortly before it reached major Linux distributions. These cases illustrate that a supplier's weakness can become every customer's weakness.

A practical SCRM program usually includes:

• Inventory and tiering: list suppliers and classify them by criticality and data access, so effort focuses on those that matter most.
• Due diligence before contract: security questionnaires, review of SOC 2 reports or ISO 27001 certificates, financial stability checks and, for critical suppliers, on-site or technical assessments.
• Contractual requirements: minimum security controls, breach notification timelines, right to audit, subcontractor controls, data location, service levels and exit provisions.
• Software assurance: requiring a software bill of materials (SBOM) that lists components and versions, secure development practices, vulnerability disclosure and timely patching.
• Ongoing monitoring: periodic reassessment, external security ratings, news and threat intelligence, and performance against SLAs.
• Exit and contingency planning: how to replace a supplier or bring a service in-house if it fails.

In the United States, Executive Order 14028 (2021) drove federal software supply chain requirements, including the NIST Secure Software Development Framework (SP 800-218) and a self-attestation form that software producers selling to federal agencies must complete. NIST SP 800-161 Revision 1 describes cybersecurity supply chain risk management practices, and the NTIA defined minimum elements for an SBOM. Section 889 of the 2019 National Defense Authorization Act prohibits federal use of certain Chinese telecommunications equipment, and financial regulators' 2023 interagency guidance covers third-party relationships for banks.

Insider threats

Insider threats come from people with legitimate access who misuse it, whether maliciously, negligently or because they have been manipulated by outsiders. Malicious insiders may steal data before leaving for a competitor, sabotage systems after a grievance or commit fraud. Negligent insiders cause incidents by mistake, such as emailing files to the wrong person or falling for phishing. Compromised insiders are legitimate users whose credentials or devices an attacker controls.

An insider threat program combines personnel, technical and procedural controls. It typically involves human resources, legal, security and management working together, with clear rules to protect employee privacy and avoid discrimination. Indicators can include unusual access patterns, large downloads before a resignation, attempts to bypass controls, and behavioral concerns raised by colleagues. Responses should be proportionate and fair: most indicators have innocent explanations, and programs that treat every employee as a suspect damage trust and morale. The strongest defenses remain the basics covered in this lesson: careful hiring, least privilege, separation of duties, prompt deprovisioning and a culture in which people feel able to raise concerns.

Supplier relationships can also create insider-like risk. A managed service provider's administrators may have more access to an organization's systems than most of its own staff. Contracts should require the provider to screen and train its personnel, limit and log their access, and notify the customer promptly when staff with access leave.

Personnel and supplier controls should be reviewed with the same discipline as technical controls. Useful indicators include the time taken to deprovision leavers, the number of accounts found without a current owner during reconciliations, the share of critical suppliers assessed in the past year, and the number of supplier incidents reported to the organization. Tracking these over time shows whether trust in people and partners is being managed or merely assumed, and helps leaders decide where to invest next.

Trust, in short, should be granted deliberately, verified regularly and withdrawn promptly.