Phishing emails spoof the city manager and ask HR staff to send W-2 files. What control actually aligns HR to the organization's cyber strategy?
Select an answer to reveal the explanation.
Short Explanation
A wanted poster about pickpockets does not replace keeping the wallet zipped. HR is a phishing target because it holds W-2s and SSNs. The control is a call-back rule and practice with IT, not a cute sign.
Full Explanation
HR is a high-value phishing target because it can release wage, tax, and identity data. Alignment to cyber strategy is a process: out-of-band verification, least-privilege access, and rehearsed staff behavior with IT—not awareness décor. Auto-fulfilling executive-looking mail and concentrating W-2s in an unencrypted mailbox are the failure modes attackers rely on. SPHR-level privacy design treats the release protocol as the control.