New employees receive full system access on their first day but attend security awareness training several weeks later. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't hand someone the car keys before they've seen the rules of the road. Getting basic training and a signed acceptable use policy done first means people know the rules before they can break them. The trap is just sending materials and hoping someone reads them.
Full Explanation
New employees are a common target because they are unfamiliar with internal processes and eager to comply with requests. Providing access before they know the organization's security expectations creates a window in which mistakes are likely, and without a signed acceptable use acknowledgement the organization has limited grounds to hold them accountable for misuse. Requiring concise onboarding training and acknowledgement before access is granted, usually on the first day as part of the joiner process, closes that window and establishes accountability from the start. Delaying training until after probation makes the exposure longer, not shorter. Granting read-only access for a year would prevent many employees from doing their jobs and does not address awareness; it is an unworkable restriction that the business would reject. Emailing materials on the first morning provides content but no assurance that it was read or understood and no record of acceptance of the rules. Exam caveat: onboarding training can be brief and focused on essentials, with fuller role-based training following, so the requirement need not delay productive work. Operational check: configure the provisioning workflow so access activation requires a recorded training completion and acknowledgement, and sample new hires to confirm the sequence is followed.