Cybersecurity focus on human risk management

The focus of cybersecurity is expanding to include the management of human-related vulnerabilities. Initial discussions emphasize the necessity of integration between Information Technology and Human Resources departments to manage the employee lifecycle and mitigate risks from intentional or accidental employee actions.

This has evolved into the emergence of ‘Human Risk Management’ as a specific strategic component. This approach complements technical security measures by implementing structured assessments of personnel risks, including background checks during hiring, recurring screenings, and the continuous evaluation of access permissions as employee roles change.

In Germany, the implementation of these practices faces specific legal constraints. Following a ruling by the Landesarbeitsgericht Düsseldorf, which awarded damages to an applicant after an unannounced internet search, legal experts have emphasized that companies must adhere to strict GDPR principles. Unlike broader US-style screening practices, German law requires that data processing for background checks be proportionate, necessary, and conducted with prior information to the individual.