{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"people_hr","domain":["Human Resources / Personnel Security","Access Control & Identity Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-insufficient-screening","description":"Failure to vet employees, contractors, or third parties before granting access enables insider threats or introduces compromised individuals; adversaries may deliberately place subverted individuals into (privileged) positions.","details":{"category":"people_hr","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"hr-insufficient-screening","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:hr-insufficient-screening","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Ahr-insufficient-screening","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","pci-dss","soc2"],"sourceUrl":null,"title":"Insufficient personnel screening and vetting","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:221c0572868063d2db85bd10571bff2cbba0dc633113e78a4d9e4eccd007185e","properties":{"rationale":"Access revocation and transfer re-evaluation contain the blast radius of an insider who slipped through vetting but perform no screening; the operative vetting defense is UC-HR-01, so this is contributory, not primary.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-03-1f58d8f9.json","sourceId":"uc:UC-HR-03","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2bc3000083b70b18a8b11bb2a3c1c3af8db4c52ea608871c69176b9bdc03be19","properties":{"rationale":"Background verification and position-risk vetting before access is the operative defense against placing unvetted, insider-threat, or compromised individuals in roles.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-01-c7e14dc5.json","sourceId":"uc:UC-HR-01","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2f35b186e99e3d1d93077a1fd7c80e76dd3d42cbc0038827587f7071d699e86b","properties":{"rationale":"Consistent, proportional sanctions deter personnel, including potential malicious or negligent insiders, from misusing access or violating policy.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-04-a71cf995.json","sourceId":"uc:UC-HR-04","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:65f30ed34c2d77fe0ce1e9f7ecd158df708cdb2daf4d52b32fd6bc32708c1a88","properties":{"rationale":"Extends screening/vetting requirements to third-party and supplier personnel before access, closing the contractor vetting gap the risk explicitly names.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-05-4049a32e.json","sourceId":"uc:UC-HR-05","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:aebdccc9f405dd52e0939ff45911ee81ee0c822ba4c9b24413cee228d2f87b03","properties":{"rationale":"Least privilege bounds the blast radius of an inadequately vetted insider, reducing impact if a poorly screened individual turns malicious.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/risk-hr-insufficient-screening-bdce1f80.json","targetId":"risk:hr-insufficient-screening","type":"mitigates"}],"schemaVersion":1}