risk
Insufficient personnel screening and vetting
Failure to vet employees, contractors, or third parties before granting access enables insider threats or introduces compromised individuals; adversaries may deliberately place subverted individuals into (privileged) positions.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- people_hr
- domain
- Human Resources / Personnel Security
- Access Control & Identity Management
- taxonomy
- iso-27005-vulnerability
- nist-800-30-threat-event
- inherent_rating
- high
Details
- risk_id
- hr-insufficient-screening
- category
- people_hr
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-800-30-threat-event
Source
No record-specific source URL is provided.
Connections
- UC-HR-03 — Secure termination and transfer of personnel mitigates Insufficient personnel screening and vetting
- strength
- related
- rationale
- Access revocation and transfer re-evaluation contain the blast radius of an insider who slipped through vetting but perform no screening; the operative vetting defense is UC-HR-01, so this is contributory, not primary.
- UC-HR-01 — Screen personnel commensurate with position risk mitigates Insufficient personnel screening and vetting
- strength
- primary
- rationale
- Background verification and position-risk vetting before access is the operative defense against placing unvetted, insider-threat, or compromised individuals in roles.
- UC-HR-04 — Enforce a formal disciplinary process for violations mitigates Insufficient personnel screening and vetting
- strength
- related
- rationale
- Consistent, proportional sanctions deter personnel, including potential malicious or negligent insiders, from misusing access or violating policy.
- UC-HR-05 — Hold third-party personnel to equivalent security terms mitigates Insufficient personnel screening and vetting
- strength
- primary
- rationale
- Extends screening/vetting requirements to third-party and supplier personnel before access, closing the contractor vetting gap the risk explicitly names.
- UC-ACCESS-03 — Enforce least privilege, need-to-know, and segregation of duties mitigates Insufficient personnel screening and vetting
- strength
- related
- rationale
- Least privilege bounds the blast radius of an inadequately vetted insider, reducing impact if a poorly screened individual turns malicious.