Payroll specialists click a fake open-enrollment link that spoofs the city's benefits portal. The CHRO is aligning HR processes to the municipal cyber strategy. Which control should HR and IT apply?
Select an answer to reveal the explanation.
Short Explanation
Payroll keys are not the same as a library-front-desk login. A poster for everybody is like putting the same lock on the vault and the break-room fridge. High-privilege HR seats need extra checks—MFA and a second channel—before money or benefits move.
Full Explanation
Roles that can alter pay, tax, and benefits data are high-value phishing targets, so the municipal cyber strategy should apply tighter controls than generic awareness. Multi-factor authentication and out-of-band verification for sensitive HR transactions reduce the chance that a spoofed open-enrollment link becomes a successful change in the hands of payroll specialists. Role-based controls belong around those processes.
Sending a citywide phishing poster and treating payroll like any other office role under-protects privileged workflows. Moving payroll to paper checks so staff no longer need network access abandons modern controls and introduces different fraud and delay risks. Banning payroll staff from email so they cannot click links is operationally unrealistic and still leaves portal and VPN attack surfaces untouched.
Exam caveat: MFA and out-of-band checks must cover vendor portals and change requests, not only the city inbox. Operational check: enforce MFA on payroll and benefits admin roles, require a second channel for bank or enrollment changes, and run a targeted phishing simulation with those roles next quarter. Document ownership so auditors can see who maintains the control.