Cybersecurity is no longer just an IT issue. With cyberattacks on the rise, safeguarding an organization’s data and systems requires a holistic, companywide effort—and HR is uniquely equipped to help lead the charge.
Keep in mind, ransomware attacks rose 13% last year. During that same period, the FBI’s Internet Crime Complaint Center received nearly 20,000 phishing complaints, resulting in nearly $2.4 billion in losses. Yes, the threat is real.
No wonder, right after inflation and the economy, cybersecurity is what’s keeping many C-suiters up at night.
HR can help allay those fears. For one thing, most corporate cybersecurity crises happen because of…well, people. According to Verizon’s 2022 Data Breach Investigations Report, 82% of last year’s corporate data breaches involved a “human element.”
For another, HR’s unique, multidepartmental role allows it to reach every employee, regardless of title, team or location.
That’s why, in addition to using the most advanced technological protections available, employers can leverage their HR teams to elevate their internal cybersecurity defenses. By partnering with their company’s information security/IT teams, HR can significantly shape employee behavior—and here are five ways to do just that.
5 Ways HR Can Help Improve Cybersecurity
- Develop a Strong Cybersecurity Policy
Your information security and IT experts know what robust cybersecurity looks like. But your HR team is invaluable when it comes to both defining it in terms of your workforce and making it standard operating procedure.
From working with IT to setting up user permissions guidelines to ensuring employees know how to access hardware and software safely and removing an employee’s data rights promptly upon termination, HR is best equipped to act as gatekeeper between your employees and your technology. It also can help keep your workforce informed and engaged every step of the way.
- Create a Robust Cybersecurity Training Program
Obviously, one of the most effective ways to communicate any workforce policy is through a vibrant training program for both managers and employees.
Cybersecurity training should begin with onboarding and be considered an ever-evolving work in progress. After all, hackers are constantly honing their techniques and trying new strategies, so employers need to as well.
Training should include guidance for issues like creating (and protecting) strong passwords and how to recognize common cyberattacks like phishing—which are becoming more sophisticated and harder to spot.
In addition, your policies should be reinforced in your employee handbook as well as through ongoing communications and training.
- Develop a Process for Reporting Potential Threats
It’s not enough for employees to be able to recognize cyberattacks; they need to feel comfortable reporting them.
Say, one of your employees clicks a link in an email sent from an external source, then realizes something may be off. In that moment of panic, what are the chances they’ll tell their manager vs. keep it to themselves? That will depend on what message you’ve sent them.
Employees need to know that there’s a process in place for handling this very situation and that they won’t face consequences for coming forward. Similarly, managers need to know exactly who to report the incident to ASAP—and so forth, right up the chain.
“People and their well-being always come first,” said Dwayne Smith, chief information security officer (CISO) of PrismHR, EPAY’s parent company. “Cyberattacks can be traumatizing, so HR must look after their employees first in times of duress. Taking preventive measures to help ensure a cyberattack doesn’t take place in the first place is the best approach.”
- Nurture a Cybersafe Culture
It’s important to treat employees like cybersecurity partners because, frankly, they are.
The good news is cybersecurity is an interesting topic, which means most employees are probably eager to learn more and also want to do their part. Instead of lecturing them, leverage that interest to build a cyberwise workforce, keeping your people apprised of ever-changing cyber scams that could cross their path.
By maintaining an open, we’re-in-this-together approach, you’ll ultimately create a proactiv, cybersafe culture.
- Make Sure Your HR and Payroll Software Is Secure, Too
HR and payroll records—i.e., Social Security numbers, bank accounts, personal contact information—make up some of the most sensitive data an employer must protect.
It’s not enough to ensure your own internal systems are secure. That information is also handled by your HR and payroll software provider—so it’s essential that it meets (and hopefully exceeds) industry security standards. These include:
- Maintaining its technology on a private cloud
- Housing its servers in certified data centers that meet highly specific requirements
- Encrypting data for all system transactions
- Monitoring servers and networks against attempted breaches
And that’s just the tip of the iceberg.
Bottom line: If you don’t know if your HR software provider follows these best practices, it’s time to ask. And if you find those answers less than reassuring, be ready to take action.
Because if HR is to help lead the charge on cybersecurity—and it should—you’ll need an HR software provider that takes cybersecurity as seriously as you do.
