SPHR HR information, safety and security, new in 2024

After detecting anomalous activity in the benefits portal, IT proposes an immediate, total lockout of all enterprise HR systems. How should the HR leader respond to ensure business continuity?

1. Suspend all employee benefits enrollment activities until the next fiscal quarter begins
   Suspending enrollment for a quarter can cost employees coverage and break plan deadlines, far beyond what containment requires.
2. Demand that IT permanently disable the benefits portal and transition to paper applications
   Permanently abandoning the portal for paper overreacts to one incident and creates lasting inefficiency and new privacy risks.
3. Request targeted access revocation for the affected portal instead of a sweeping lockout
   Containing the affected portal limits the threat while payroll and other HR systems keep running, balancing security with continuity.
4. Implement a parallel unencrypted shadow system to process critical HR transactions temporarily
   An unencrypted shadow system creates a new, unprotected copy of sensitive data in the middle of a security incident.
5. Authorize the total system shutdown to completely eliminate potential enterprise security risks
   Shutting down every HR system stops payroll and other critical processes over an issue so far seen in one portal.

A multinational organization is evaluating potential HR technology solutions to replace multiple legacy systems. What should be the primary consideration in the selection process?

1. Integration with current enterprise systems
   A multinational replacing several legacy systems needs the new platform to exchange data cleanly with payroll, finance, and other enterprise systems, or the consolidation fails.
2. Vendor's years in business
   Vendor longevity is a minor stability signal, not the main test of whether the system fits the organization.
3. Total cost of implementation and annual licensing
   Cost matters, but a cheaper system that cannot connect to enterprise systems recreates the fragmentation the project is meant to remove.
4. Number of available features
   A long feature list does not help if the features cannot share data with the rest of the enterprise.

During an HRIS data breach, InfoSec begins technical containment. What is the most critical strategic role for the HR leader during this immediate response phase?

1. Terminate every employee suspected of causing the breach
   Firing suspects before any investigation invites wrongful termination claims and can destroy evidence.
2. Coordinate employee communications with the security team's response
   During containment HR's value is people-facing: timing and wording employee messages so they are accurate, match the investigation, and neither tip off an attacker nor feed rumor.
3. Personally run the network isolation steps on the HRIS database
   Technical isolation is the security team's job; an HR leader running it would add risk, not reduce it.
4. Move all core business processes to an alternative cloud platform
   Moving every business process to another cloud is a drastic technical decision outside HR's role during containment.
5. Run background checks on the external cybersecurity consulting staff
   Vetting the consultants is not the urgent issue while the breach is being contained.

The HRIS vendor provides a SOC 2 report but no penetration test results. What should HR require in the contract?

1. Accept the SOC 2 report as sufficient assurance of security
   A SOC 2 report attests to controls but does not show how the system holds up to an actual attack test, the gap the stem names.
2. Require the vendor to encrypt all data at rest and in transit
   Encryption is a baseline control, but it does not tell HR whether the vendor's system resists real attacks.
3. Request a letter from the vendor's CISO stating security posture
   A CISO's letter is the vendor vouching for itself, which adds no independent assurance.
4. Require regular penetration tests with remediation deadlines
   A SOC 2 report shows controls were designed and operating, but independent penetration testing checks whether the system can actually be broken into, and deadlines make sure findings get fixed.

When implementing a new HRIS, what is the most important first step to ensure successful data migration?

1. Mapping data fields between the old and new systems
   Migration depends on knowing which field in the old system feeds which field in the new one; mapping exposes gaps and cleanup needs before any data moves.
2. Converting all paper records to digital format
   Digitizing paper records is a separate project, and not every record needs converting for a migration.
3. Training all employees on the new system before migration
   Training belongs closer to go-live; it does nothing to make the data move correctly.
4. Purchasing additional storage capacity for the database
   Storage is rarely the constraint in a modern HRIS and does nothing to ensure the data arrives accurately.

IT reports an external server was breached. Before drafting external communications, HR must interpret the security report to determine the exact data fields compromised. What is the primary purpose of this assessment?

1. Mandating immediate company-wide password policy updates
   Password changes are a security follow-up, not the reason HR reviews which fields were exposed.
2. Initiating disciplinary procedures for the IT department
   Discipline is premature and has nothing to do with deciding what to tell affected people.
3. Identifying who carried out the breach
   Attribution belongs to investigators and law enforcement; HR's communications depend on what data was taken, not who took it.
4. Calculating the total financial cost of network repairs
   Repair costs are IT's budget question and do not shape the content of external communications.
5. Determining whether exposed fields trigger notice laws
   State breach laws apply only when certain data elements are exposed, such as a name with a Social Security number, so the field-level review decides whether, and to whom, notice is required.

A decentralized HR team requires system access across multiple regional offices. Which approach best prevents internal data snooping while maintaining operational efficiency?

1. Establish multi-factor authentication requirements without restricting user view permissions
   MFA confirms who is logging in but does nothing to stop an authorized user from viewing records outside their role.
2. Segment the database by country to block cross-border information sharing
   Splitting the database by country blocks routine cross-border work and still lets anyone inside a country see everything there.
3. Require executive approval for each data query run by regional staff
   Executive sign-off on each query would bring daily HR work to a halt.
4. Implement role-based access controls based on the principle of least privilege
   Role-based access limited to what each job needs stops people from browsing records they have no reason to see, without slowing their own work.
5. Give every regional HR director full administrator rights
   Full administrator rights for every director maximize the snooping risk HR is trying to prevent.

An HRIS vendor uses a third-party data center for backups. Which contractual control best reduces the risk of unauthorized access to employee data?

1. Require encryption of data in transit between the vendor and HR
   Encryption in transit protects data moving between HR and the vendor, not backups sitting in someone else's data center.
2. Right to approve subprocessors and conduct audits
   The backup data center is a subprocessor holding employee data; approving it and auditing its controls extends the employer's protection to the party that actually stores the backups.
3. Require the vendor to hold ISO 27001 certification
   The vendor's ISO 27001 certificate covers the vendor's own management system, not necessarily the third-party data center.
4. Include a clause that the vendor must report breaches within 72 hours
   A reporting deadline helps after unauthorized access happens; it does not reduce the chance of it.

During a natural disaster, a warehouse employee suffers a severe injury. The business continuity plan focuses on IT recovery and omits safety reporting. What should HR recommend to prevent missed OSHA reporting during future crises?

1. Increase funding for IT disaster recovery systems
   More IT recovery funding strengthens the part of the plan that already works and leaves the reporting gap.
2. Create a separate emergency response plan for injuries
   A separate injury plan is easy to forget in a crisis; the gap is that the plan actually used omits safety reporting.
3. Assign safety reporting to the IT department
   IT has no role in injury reporting; moving the duty there hands it to people who do not know the requirements.
4. Conduct annual OSHA training for all employees
   General OSHA training does not tell anyone who reports an injury during a disaster, or how.
5. Integrate safety reporting into the continuity plan
   OSHA requires reporting a fatality within 8 hours and an in-patient hospitalization, amputation, or eye loss within 24 hours, so the plan used in a crisis has to carry that duty and name its owner.

An HRIS vendor states only that it uses encryption. Which additional contract clause is most critical to ensure employee PII is protected at rest?

1. Language requiring the vendor to comply with all applicable privacy laws
   A promise to follow privacy laws is generic and does not specify the technical protection at issue.
2. A requirement that the vendor maintain ISO 27001 certification
   ISO 27001 certifies a security management system, not that this vendor encrypts the employer's data at rest with properly controlled keys.
3. A clause detailing encryption scope with key custody and backup coverage
   "We use encryption" can mean little; the contract must say which data is encrypted at rest, including backups, and who controls the keys.
4. An indemnification clause covering data breaches
   Indemnity pays for damage after a breach but does nothing to protect the data at rest.

Refer to the table. Based on the HR systems listed, which system should have the lowest recovery time objective (RTO)?

1. Recruiting
   Recruiting delays slow hiring timelines but carry no legal deadline, so a longer recovery time is tolerable.
2. Benefits
   Benefits changes matter to employees, but the table rates their impact as moderate and most changes can wait a few days.
3. Payroll
   Payroll has hard legal deadlines for paying wages and depositing taxes, so its recovery time objective must be the shortest.
4. Reporting
   Long-term workforce reporting can wait the longest of the four systems.

An organization is upgrading its HRIS and evaluating cybersecurity resource allocation. To optimize data protection efforts effectively across all HR systems, which strategic action must HR prioritize first?

1. Automate deletion of candidate background check records
   Deleting background check data is one retention rule, and doing it before knowing what is held and required could breach record-keeping duties.
2. Classify HR data by sensitivity and map where it is stored
   Protection effort can be allocated sensibly only once HR knows which data is most sensitive and where it lives, so classification and mapping come first.
3. Encrypt active employee records enterprise-wide
   Encrypting the records is a control chosen before knowing which data is most sensitive or where copies sit outside the main records.
4. Limit server room access to executives and core HR staff
   Physical server access matters little when most HR data sits in cloud systems, and it skips the inventory that should guide controls.
5. Require phishing awareness training for all staff
   Phishing training reduces one threat, but it is not the first step in deciding where protection resources should go.

An HRIS vendor's contract limits liability to fees paid and explicitly excludes regulatory fines for data breaches. What contractual provision should HR demand as a priority?

1. Indemnity for regulatory fines and breach-related costs
   The contract as written leaves the employer paying fines and breach costs the vendor causes, so indemnity covering them, outside a cap that would swallow it, is the priority fix.
2. Enhanced uptime service-level agreements with penalties
   Uptime penalties address availability, not who pays when employee data is breached.
3. Mandatory cyber-insurance coverage carried by the vendor
   Vendor insurance helps only if the contract makes the vendor liable for these costs; with fines excluded, there is nothing for it to pay.
4. An annual right to audit the vendor's security controls
   An audit right improves oversight but leaves the financial exposure for fines where it is.
5. A reduced liability cap for data breach incidents
   Lowering the cap makes the existing problem worse by limiting the vendor's liability further.

The CEO demands zero-RTO for all HR systems regardless of cost. As HR leader, which approach is most responsible?

1. Reduce RTO to the minimum possible with current budget
   Driving every system to the lowest RTO the budget allows spends money without asking which systems need fast recovery.
2. Implement zero-RTO for all systems as requested
   Zero RTO for every system is technically unrealistic and enormously expensive, so agreeing without analysis is not responsible advice.
3. Outsource the HR systems to a cloud provider with a zero-RTO guarantee
   No provider can guarantee zero recovery time, and outsourcing does not remove the need to decide which systems matter most.
4. Focus on payroll and benefits systems for zero-RTO
   Picking payroll and benefits by judgment skips the analysis and still commits to zero RTO, which is rarely achievable even for those systems.
5. Classify systems and propose realistic RTOs with their costs
   Tiering systems by criticality and showing what each recovery target costs lets the CEO make an informed trade-off instead of paying for instant recovery where it adds little.

An HR administrator accidentally clicks a malicious link, and a hacker begins actively altering executive direct deposit information. What is the most critical immediate action to mitigate the situation?

1. Issuing a press release detailing the specific executive accounts
   A press release naming executive accounts publicizes sensitive details before the breach is even contained.
2. Running background checks on the affected executives
   Background checks on the executives are irrelevant; they are the victims, not the source of the breach.
3. Reversing the direct deposit transactions through the central bank
   Recovering payments runs through the company's own bank, not the central bank, and chasing deposits before stopping the attacker lets the changes continue.
4. Isolating the affected workstation to contain the breach
   While the attacker is still active, cutting the compromised machine off the network stops further changes; restoring the deposit details and resetting credentials follow.
5. Drafting a termination letter for the responsible administrator
   Disciplining the administrator does nothing to stop the attack in progress and can wait for the investigation.