A new employee’s first day is usually about coffee, a tour of the building, and a stack of names that are hard to remember. Meanwhile something happens that nobody really thinks about: an account gets created, a laptop gets handed over, and access gets arranged to systems that nobody has properly considered. At most companies this goes fine, until one day it doesn’t.
How it usually goes in practice
At most SMEs, onboarding is arranged by the manager who is expecting the new colleague. That manager calls or emails whoever handles ICT with a request to set things up the same way as for an existing colleague. That colleague has worked at the company for years and has picked up all sorts of extra access along the way: to the purchasing system, to another team’s shared drive, to a reporting tool that was really only meant for managers. The new employee inherits all of that at once, without anyone asking whether it actually fits the role.
This works fine as long as nothing goes wrong. But it slowly builds a company where nobody quite knows anymore who has access to what, or why.
Why this is more than a matter of convenience
A new employee is extra vulnerable in the first few weeks, and that has little to do with carelessness. Everything is new: the systems, the colleagues, the way of working. An email that appears to come from the director with an urgent request is less likely to be recognised as suspicious by someone who doesn’t know the company yet. Someone who has just started also tends to want to come across as helpful and quick. That makes this period attractive to anyone looking to exploit a moment of inattention.
On top of that, access that is too broad remains a risk even once the early unfamiliarity has worn off. A new employee who accidentally has access to financial data or customer information unrelated to the role is not just an internal risk. It is also something that is hard to explain during an incident or an audit.
Measure first: what roles does your company actually have
We never start this question with the technology, but with the question of what roles a company actually has. A wholesaler has different functions than a manufacturing company or a logistics business, but within any company it is possible to describe what someone in the warehouse, planning, administration, or sales needs in order to do their job. That sounds simple, but in practice it has often never been written down.
Only once those roles have been mapped out can you meaningfully determine what access belongs to each one. Not what someone happened to be given because it was convenient at the time, but what makes sense given the role. That is measuring before you arrange anything: you cannot make good policy about access you haven’t first brought into view.
Policy before technology
Once roles and the access that belongs to them have been defined, the technology can take over. A new account then becomes the application of an established template, rather than a copy of some other colleague: this role comes with this system, this equipment, and this level of access. A manager no longer has to make a judgement call, because that decision was already made when the policy was set.
This is also the point where demonstrability is created. If you can show which role gets which access and why, you have something that goes beyond a feeling that things are probably fine. That is exactly the kind of demonstrability you need when taking steps towards NIS2.
Bringing people along from day one
Policy and technology don’t solve everything. A new employee who is only told on day one what is and isn’t allowed, without any explanation why, experiences that as a list of rules standing in the way. Explain briefly from the first day why certain access is restricted, how the company handles suspicious emails, and who to turn to when in doubt. This doesn’t need to be a long training session. A quarter of an hour, delivered by someone who treats it as completely normal, works better than a document that goes unread.
That way, security becomes part of how the company works, rather than a requirement imposed afterwards.
What you can do this week
You don’t need to turn this into a major project to make progress.
- List the roles in your company and note per role which systems and data are actually needed.
- Agree who approves a new account, so this is no longer a manager’s individual call.
- Build a fixed moment into onboarding where someone briefly explains how the company handles passwords, access, and suspicious messages.
- Occasionally compare the access of a few employees in the same role. Large differences are often a sign that permissions have grown over time without anyone reviewing them.
Once this is in order, a new employee’s first day stops being a moment of uncertainty and simply becomes the application of something that was already decided.
A few questions we’re often asked
Do I need separate policy for every single function in my company?
Not for every individual function. Most companies have a limited number of roles that broadly need the same kind of access, such as warehouse staff, administration, or field sales. Start with those main groups and only refine further if a particular function genuinely differs.
What if a new employee comes through a staffing agency or on a temporary basis?
That is exactly when predefined policy matters most, because temporary staff tend to turn over faster and stay less visible to whoever manages access. Link access to the role and to an end date, so nobody has to remember to close a temporary account later.
How do I stop this from becoming extra work for managers?
It takes time upfront to define roles and access, but it saves time afterwards. A manager no longer has to make a judgement call for every new employee, because that decision is already built into the template.
Does this connect to what happens when someone leaves the company?
It is the mirror image of it. Offboarding is about withdrawing access that is no longer needed, in good time; onboarding is about never granting access that isn’t needed in the first place. Get both sides right, and you maintain a constant, clear picture of who has access and why.
Want to know what onboarding actually looks like at your company right now, and where roles and access don’t quite line up yet? We’re happy to think it through with you.
