Preboarding is the period between a hiring decision and an employee’s first day, when access and onboarding preparation begin. In identity and access management, it can include creating a user record, collecting required details, and preprovisioning accounts or group memberships without enabling active access until start date and manager approval.
What preboarding actually does
Preboarding sits in the gap between selection and day one. It is the controlled preparation phase where HR, managers, and identity teams gather required data, set up records, and line up access so the new starter can begin quickly without receiving active access too early.
The point is not to grant standing access in advance. It is to remove avoidable friction, such as missing user details, delayed approvals, or late account creation, while preserving a clean start-date control. Done well, preboarding shortens time-to-productivity without weakening access governance.
Why preboarding matters in access and onboarding workflows
Preboarding is operationally important because it is often the first moment an organisation translates a hiring decision into system presence. That makes it the bridge between people operations and access operations, and it is where errors in ownership, timing, or data quality first surface.
If the workflow is loosely defined, teams may create duplicate records, mis-assign managers, or prepare the wrong entitlements. If it is too rigid, the new hire arrives with no account readiness and loses valuable time on the first day. The balance is to prepare identity artifacts in advance while keeping activation tightly gated.
How preboarding relates to identity and access controls
In IAM terms, preboarding commonly involves user provisioning, attribute collection, group staging, and role or access-package preparation. Those steps are useful because they let organisations preconfigure the access path before the person is operational, but the final enablement should remain tied to start date, approval, or both.
That distinction matters because a prepared account is not the same as an enabled account. Preboarding often needs coordination across HR systems, directory services, ticketing, and downstream applications, and each handoff should preserve traceability. For general control design, NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference for access control, identification and authentication, and configuration discipline, while NIST Cybersecurity Framework 2.0 provides the broader govern, identify, protect, detect, respond, recover structure that supports onboarding workflows.
Common failure modes in preboarding
The most common failures are not technical, they are procedural. Sensitive access may be created too early, approvals may be implied rather than explicit, or a precreated account may remain dormant and forgotten when the hire never starts. Each of those cases creates either unnecessary exposure or wasted administrative effort.
Another failure mode is treating preboarding as a purely HR task. In practice, it is an access governance activity as much as an administrative one, because the workflow decides who exists in systems, which affiliations they are associated with, and when they become active. If those decisions are not auditable, the organisation loses clarity around entitlement creation and accountability.
Risk and Threat Considerations
Preboarding creates a narrow but meaningful exposure window because access preparation begins before employment starts. If activation controls are weak, a precreated identity can become a premature entry point, an orphaned account, or a source of confused ownership when a hire is delayed or cancelled.
Failure mechanism: The workflow separates account preparation from start-date activation, but misses one of the guardrails that keeps the prepared identity inactive until the hire is real and authorised.
Impact: The result can be unnecessary access exposure, dormant accounts that are later forgotten, or a cleaner path for misuse if a prepared identity is activated without the expected approval chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Preboarding depends on accurate identity and system inventory for new-user readiness. |
| Recommendation — Maintain authoritative inventory records so prepared onboarding access maps to known assets and accounts. | ||
| NIST SP 800-53 Rev 5 | IA-4 — Identifier Management | Preboarding creates and stages user identifiers before activation and start date. |
| AC-2 — Account Management | Preboarding is a lifecycle account activity that creates, stages, and later enables accounts. | |
| Recommendation — Assign and manage identifiers so staged records are created before use and activated only when authorised. Use account-management controls to precreate accounts, hold them inactive, and enable them only at the right time. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Preboarding is part of identity lifecycle control for new starters. |
| Recommendation — Define identity-management procedures that stage new-user records and control when access becomes active. | ||
| CIS Controls v8 | CIS-5 — Account Management | Preboarding is an account-management workflow for creating and controlling new accounts. |
| Recommendation — Standardise account creation and activation so preboarded users are not granted standing access early. | ||
Practitioner Guidance
Governance implication: Treat preboarding as a controlled staging process, not a soft-launch of access. The practical question is who owns the prepared identity, who approves activation, and what condition flips the record from staged to live.
Practitioner takeaway: The safest preboarding designs make preparation easy and activation unmistakable, so readiness never depends on memory or manual follow-up.