Hiring supervisors email completed I-9s and Social Security numbers to HR because that channel is fastest. The CHRO is aligning documentation practice to the city's data-protection strategy. What should the CHRO do?
Select an answer to reveal the explanation.
Short Explanation
Emailing employment-eligibility forms and Social Security numbers is like mailing the spare house key on a postcard because the post office is handy. Training people to be careful on a bad channel still leaves the channel open. Replace the convenience path with a secure upload that actually matches the city's data rules.
Full Explanation
Convenient channels that violate the data-protection strategy must be replaced, not coached around. Banning email for I-9s and Social Security numbers and standing up a secure upload that meets the city's strategy gives hiring supervisors a controlled intake path with encryption, access, and retention while still allowing hiring to function. SPHR work is designing that replacement.
Keeping email with a monthly reminder not to attach SSNs leaves the fastest path as the noncompliant path. Training supervisors to password-protect PDFs and still email them retains an insecure transport and weak shared-secret habits. Accepting emailed copies if the subject line is marked confidential confuses labeling with protection.
Exam caveat: the secure upload must be usable on the devices supervisors actually have, or shadow email will return. Operational check: disable or block identity-document email patterns where feasible, launch the upload with a five-minute supervisor aid, and sample new hires to confirm zero I-9s arrived by ordinary email. Document ownership so auditors can see who maintains the control. Re-test the control after the next tabletop or hiring cycle. Keep the civic workforce impact visible in the evaluation notes.