IT Onboarding: Checklist for New Employees Joining

HR and supervisors must ensure that new employees are onboarded and informed about rules, instructions and procedures. A checklist and a fixed contact person should help (BSI ORP.2.A1). User IDs and permissions may only be granted based on actual need (ORP.4.A2). Four areas therefore belong to every onboarding:

• Account and permissions: clearly assigned to one person, only what the task requires, documented (ORP.4.A1 to A3).
• Devices and access: issue physical and logical access means and document the issue (ORP.4.A5 to A7); record device handover as well (TOMORIS recommendation).
• Commitment: data secrecy under § 6 DSG, compliance with laws and internal rules (ORP.2.A14), processing of personal data only on instruction (Art. 29 and 32(4) GDPR).
• Briefing and training: secure use of IT and task-based training (ORP.3.A3, A6).

This checklist is a TOMORIS recommendation. BSI IT-Grundschutz is not a legal requirement in Austria but a standard the checklist follows; § 6 DSG and the GDPR apply directly. Leaving the company is covered by the IT offboarding checklist.

• HR reports the new hire, function and start date to IT and supervisors in good time.
• Required permissions derived from the function; permissions beyond the standard only with additional justification and review (ORP.4.A2).
• Account created and clearly assigned to one person; created only through a separate administrative role (ORP.4.A1, A2).
• Account, groups and permission profile documented (ORP.4.A3).
• Physical and logical access defined; issue of keys, smart cards or tokens is documented (ORP.4.A5 to A7).
• Device prepared and added to inventory; license assigned in Microsoft 365.
• Qualifications required for the position clarified (ORP.2.A15); if needed, trustworthiness details checked, such as the résumé (ORP.2.A7).
• Contact person or buddy for onboarding named (ORP.2.A1).
• For external staff: written confidentiality agreement before access to confidential information is granted (ORP.2.A5).

1. 1

   Brief

   Inform about applicable rules, instructions and procedures (ORP.2.A1); brief on the secure use of IT components and provide binding, understandable policies (ORP.3.A3).

2. 2

   Commit and instruct

   Unless already bound by law, contractually oblige the person to transmit personal data only on instruction and to maintain data secrecy even after the employment ends; instruct them on transmission orders and the consequences of a breach (§ 6 paras. 2 and 3 DSG). Commit them to compliance with laws and internal rules (ORP.2.A14).

3. 3

   Sign in securely for the first time

   For the first sign-in, issue a Temporary Access Pass that the person uses to set up their own sign-in methods. TOMORIS recommends not sending passwords by email and handing over the access pass in person or through a separate channel.

4. 4

   Set up multifactor sign-in

   Have the person register an authenticator app or passkey. The MFA in Microsoft 365 checklist covers rollout and methods in detail.

5. 5

   Hand over device and access means

   Hand over keys, smart cards and tokens and document the issue (ORP.4.A5 to A7), and the device as well (TOMORIS recommendation). Instruct the person to keep passwords secret (ORP.4.A8).

6. 6

   Explain the reporting path

   Show how to report suspicious emails and security incidents and who the contact person is (TOMORIS recommendation).

• Trained on information security according to tasks and responsibilities (ORP.3.A6).
• Informed that information from work is for internal use only and that information security also applies outside working hours (ORP.2.A14).
• Tasks and responsibilities documented (ORP.2.A14).
• Permissions matched against actual tasks; documentation and granted permissions are consistent (ORP.4.A3).
• Temporarily granted permissions, for example for onboarding, revoked (derived from ORP.4.A2).
• Deputy arrangements for the new person’s tasks in place (ORP.2.A3).
• Onboarding completed with supervisor and contact person, and feedback on the checklist collected (TOMORIS recommendation).

Names, default values and license terms in Microsoft 365 can change; Microsoft’s current documentation is authoritative. Password rules are best set in a dedicated password policy.

• When staff changes occur, remove IDs and permissions no longer needed (ORP.4.A2) instead of only adding new permissions.
• Commit external staff to laws, regulations and internal rules just like your own employees (ORP.2.A4).
• Supervise short-term external staff in security-relevant areas, and brief long-term external staff like your own employees (ORP.2.A4).
• Create accounts for external staff with an expiration date and revoke access rights when the engagement ends (ORP.2.A4; expiration date as a TOMORIS recommendation).

The exact split is a recommendation; what matters is that every task has a responsible person. Complete the checklist for each new hire and file it in the personnel file or the IT documentation.