A city's cyber strategy says IT owns data protection, yet personnel files sit in unlocked cabinets and on shared drives. How should HR align employee-file controls?
Select an answer to reveal the explanation.
Short Explanation
Locking the front door and leaving the filing cabinet open is not security. Personnel files are data whether they live on paper or a shared drive. HR owns those files; IT's cyber plan does not make the cabinet someone else's problem.
Full Explanation
Employee-file security is part of enterprise data protection for a municipal employer, not a side cabinet outside the cyber strategy. Aligning physical and digital controls—locks, permissions, and retention—with HR as an accountable owner puts paper and electronic personnel records under the same confidentiality logic the city's data-protection strategy already claims. SPHR practice refuses the myth that HR records are somehow outside IT-era risk.
Leaving paper files unsecured because the cyber strategy supposedly covers only firewalls misreads the strategy's purpose and leaves identity and employment data exposed to walk-up access. Moving personnel records into supervisors' personal email so IT has "no role" creates uncontrolled copies and destroys retention and legal-hold capability. Posting personnel files to the public website to reduce internal copies is a catastrophic disclosure failure, not a consolidation tactic.
Exam caveat: alignment does not mean IT unilaterally owns every HR decision; HR remains accountable for need-to-know and retention while using enterprise controls. Operational check: inventory paper and shared-drive personnel stores, apply lock-and-permission standards matching the cyber policy, assign an HR records owner, and sample access logs and cabinet audits quarterly.