Skip to content
Layer 8 SecurityThe Human Factor
Standards

For the team that has to open attachments from strangers.

HR & Privacy Variant

HR is the only department explicitly required to open attachments from people it has never met, and it sits on a goldmine of personal information. This module covers the data lifecycle, Australian privacy compliance, and the growing threat of recruitment fraud.

Let’s talk
Builds on the Core Baseline. Teams on this variant are trained to Core Baseline domains 1–5 first, then domains 10–13 below.Core Baseline
Specialist domains
4
Topics
12
Domains in total, with the Core Baseline
9

Domain 10

Recruitment Fraud & Candidate Social Engineering

How attackers exploit the hiring process, either to breach the network or to place a malicious insider.

  1. 10.1

    Weaponised Resumes

    Recognising malicious payloads (macros or embedded links) hidden in PDF, Word or zip files sent by “candidates” or fake recruiters.

  2. 10.2

    The Fake Candidate

    Spotting AI-generated headshots, stolen identities, and deepfake video or audio during remote screening interviews.

  3. 10.3

    Social Media Exploitation

    How attackers use platforms like LinkedIn to map the organisational chart and target HR staff with highly tailored spear-phishing.

Domain 11

The Privacy Act & HR Data Lifecycle

The legal requirements of the Australian Privacy Act 1988, translated into practical security behaviours for HR staff.

  1. 11.1

    The Employee Records Exemption Trap

    Employee records are largely exempt from the Australian Privacy Principles, but data about unsuccessful applicants, contractors and volunteers is fully protected and needs strict compliance.

  2. 11.2

    Data Minimisation in Hiring

    Not collecting sensitive information, such as passports, driver’s licences or Tax File Numbers, until a candidate has accepted a job offer.

  3. 11.3

    The Notifiable Data Breaches (NDB) Scheme

    Knowing the threshold at which the loss or theft of candidate or contractor data must be escalated for reporting to the Office of the Australian Information Commissioner (OAIC).

Domain 12

Internal Data Spillage & Payroll Security

HR handles the most sensitive internal data. This domain is about preventing accidental leaks and securing HR systems.

  1. 12.1

    Accidental Disclosure

    Preventing the accidental mass-mailing of salaries, performance reviews or redundancy lists: BCC vs CC failures, or attaching the wrong spreadsheet.

  2. 12.2

    HRIS Access Control

    Why HR must enforce role-based access control (RBAC) in the HR information system, so managers only see data for their direct reports.

  3. 12.3

    Cross-Department Verification

    Working with Finance on out-of-band verification whenever an “employee” asks to change their payroll bank details.

Domain 13

Offboarding & Insider Threat

The moment someone resigns or is terminated, their risk profile changes entirely. This domain covers the secure offboarding lifecycle.

  1. 13.1

    Rapid Access Revocation

    Coordinating with IT so all system access ends at the same moment the employee leaves.

  2. 13.2

    Data Exfiltration Indicators

    Recognising the signs that a departing employee is downloading bulk confidential data or emailing intellectual property to a personal account.

  3. 13.3

    Hostile Terminations

    Applying physical and digital security protocols when managing disgruntled staff, to prevent sabotage or data destruction.

Mapping to compliance

What this module evidences

  • ISO/IEC 27001:2022

    • Annex A 6.1 Screening
    • Annex A 6.2 Terms and Conditions of Employment
    • Annex A 6.5 Responsibilities After Termination or Change of Employment

  • Australian Privacy Act 1988

    Direct evidence of compliance for job applicant and contractor data, which the employee records exemption does not cover.

Other standards

Train your team to the HR & Privacy Variant

Tell us which roles you need to cover and what you have to evidence, and we will show you how a session maps to these domains.

Let’s talk