Digital hygiene for company employees: a checklist for HR and IT departments

According to NIST recommendations, companies should train employees in cybersecurity basics, use multi-factor authentication, keep software up to date, and protect corporate data. NIST also recommends regularly updating software and installing available patches.

Passwords and Multi-Factor Authentication

One of the fundamental elements of digital hygiene is protecting corporate accounts. NIST recommends using strong passwords and considering the use of password managers.

However, a password alone is not sufficient to protect the most critical systems. Multi-factor authentication, or MFA, adds an additional method of verifying the user's identity. This can be a code, an authenticator app, a hardware key, or biometrics. More information on MFA principles can be found in the NIST recommendations on multi-factor authentication.

For HR and IT, it is important to check:
— whether MFA is enabled for corporate email and other critical services
— whether employees use unique and strong passwords
— whether there is a secure method for storing passwords
— whether employee access is revoked after termination or role changes.

How to Recognize Phishing

Phishing messages may look like ordinary emails from colleagues, managers, or familiar services. They can arrive not only via email but also through messengers, social networks, and SMS.

In the NIST guide on phishing protection, particular attention is advised for messages requesting urgent clicks on links, downloading files, sharing data, or performing financial transactions. Among the signs of potential phishing, NIST also highlights a sense of urgency and requests for confidential information.

Employees should follow a simple rule: do not click on suspicious links or open questionable attachments. If a message seems urgent or unusual, verify it through another communication channel using known contacts, rather than relying on the data provided in the message itself.

Companies should also train employees to recognize phishing and report suspicious messages.

Updates and Work Devices

Outdated software can create additional risks. NIST recommends installing software updates and patches as they become available, as well as keeping security software up to date.

For the IT department, this means monitoring updates for work computers, corporate services, and other used software. Employees, in turn, should not delay installing available updates without necessity.

Additional recommendations for securing work devices and data are compiled by NIST in the Securing Data & Devices section.

Access to Corporate Data

Employees do not always need access to all company systems. NIST recommends restricting access to systems and data only to the resources necessary for an individual to perform their job.

Therefore, HR and IT can regularly review which rights employees have, ensure they correspond to current responsibilities, and verify that access is revoked after role changes or departure from the company.

It is especially important to consider former employees, temporary specialists, and those who have moved to a different position within the company. NIST specifically recommends revoking access when it is no longer needed or when an employee leaves the organization.

As a result, a company's digital hygiene consists not of a single measure but of several basic processes: employee training, account protection using MFA, secure password management, phishing recognition, timely software updates, and regular review of access rights. These measures are considered basic practices that NIST recommends companies incorporate into their cyber risk management framework.