Employee onboarding security checklist

• HR sends IT the start date, role, manager and the systems the role needs at least five working days ahead.
• Access is based on a role template (for example "Associate", "Bookkeeper", "Office admin"), not copied from another employee's account, which carries over years of extra access.
• Device ordered and enrolled in management (Autopilot, Apple Business Manager or equivalent) so it arrives encrypted, patched and with security software.
• Accounts created in a disabled or temporary-access state until the start date.
• Policies ready for acknowledgement: acceptable use, BYOD, remote work, confidentiality, AI use.

Least privilege means each person gets the access their job needs and nothing more. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations list access control and authorization as a core control, along with strong user authentication.

Give the new hire a standard user account. If the role genuinely needs admin rights (an IT staffer, for example), create a separate admin account that is used only for admin work. Add group memberships that grant access to sites and shared mailboxes rather than granting access item by item, so the next access review can read it.

1. 01

   Issue a temporary credential securely

   Give the initial password or Temporary Access Pass in person or by phone, never in the same email as the username.

2. 02

   Register MFA on day one

   Walk the person through the authenticator app or a passkey. Phishing-resistant methods (passkeys, security keys) are preferable where supported.

3. 03

   Set a long passphrase

   NIST SP 800-63B-4 favours length over complexity: at least 15 characters where a password is the only factor, and no forced periodic changes. A password manager makes this easy.

4. 04

   Hand over the device

   Confirm it is enrolled, encrypted and compliant before data syncs.

5. 05

   Set up phone apps

   If using a personal phone, install Outlook and Teams and confirm app protection applies.

Ask for acknowledgement of each policy in the first week, not buried in a 40-page handbook signed on the first morning. Short policies that people actually read work better.

• Acceptable use of systems and data.
• Confidentiality and client information handling.
• BYOD and remote work rules.
• Electronic monitoring (in Ontario, employers with 25 or more employees must have a written electronic monitoring policy and give a copy to employees).
• AI tools: which ones are approved and what data may be entered.
• Incident reporting: who to tell, how, and that early reports are welcomed.

In the first week, cover the handful of threats most likely to hit this person's role. A bookkeeper needs to know about payment redirection fraud; a receptionist needs to know about phone pretexting; everyone needs to know how to spot a fake login page.

• How to report a suspicious email (the button, or who to forward to).
• Payment and banking change verification: always call back on a known number.
• MFA fatigue: never approve a sign-in prompt you didn't start.
• Where to store files (team sites, not desktops or personal cloud).
• Who to call if something goes wrong, including outside business hours.

At 30 days, the manager and IT spend ten minutes confirming the setup held up. It catches access that was granted temporarily and never removed, and devices that never finished enrolling.