New Starter Security Induction: Day One and First Month

New starters receive accounts, devices and access before they know how the organisation works, which makes their first weeks one of the riskiest periods in the employee life cycle. They do not yet recognise real colleagues, real IT requests or real payment processes, and attackers watch job announcements to exploit exactly that gap. This guide sets out what a security induction should cover before day one, on day one and across the first month, how to tie it to account provisioning so access follows training, how to adapt it for contractors and high-risk roles, and how to measure whether it worked. It is for security awareness leads, IT onboarding teams and HR. For the wider programme, see the Security Awareness and Human Risk Management Guide.

Key takeaways

Sequence it, do not front-load it. Give a short set of survival behaviours on day one, then spread the rest across the first month; the NCSC advises delivering training in small, frequent chunks.
Tie access to acknowledgement. NIST SP 800-53 PL-4 and PS-6 expect rules of behaviour and access agreements to be acknowledged before access is authorised, so make induction steps gates in the joiner workflow, not a course to finish later.
Warn about the attacks aimed at new starters. The FTC describes scammers who watch social media for new job announcements and pose as the new boss with urgent gift card or data requests.
Teach the reporting route first. A new starter who knows exactly how to report a suspicious message or a mistake, and that they will not be blamed, is worth more than one who can list phishing indicators.
Measure behaviour in the first 90 days. Track MFA enrolment, first reports and early simulation results for the joiner cohort, not just module completion.

Why new starters need their own induction

A generic annual awareness module assumes the learner already knows the organisation's people, systems and processes. A new starter does not, and that changes both the risk and what the training must do.

New starter situation	Why it creates risk	What the induction must give them
Does not know colleagues' names, voices or writing style	Impersonation of a manager or IT is hard to spot	A verification habit: call back on a number from the directory, never the one in the message
Expects a flood of setup emails, MFA prompts and app invitations	Fake IT setup messages and MFA prompts blend in	What genuine onboarding messages look like, who sends them and which channel they use
Has publicly announced the new job	The FTC warns that scammers watch social media for new job announcements and pose as the new boss	A direct warning on day one: no manager will ask for gift cards, codes or bank details by text
Wants to make a good impression	The FTC notes new employees may be eager to please and less likely to question an unusual request	Explicit permission to pause, check and refuse, said by their manager
Brings habits and files from a previous employer or personal devices	Data from elsewhere, personal browser profiles and unapproved tools enter the estate	Clear rules on personal accounts, browser sync, removable media and AI tools
Does not yet know where data may be stored or shared	Mis-sent email and public sharing links	The two or three approved places to store and share work data

Before day one: pre-start actions

Much of a good induction happens before the person arrives. These steps are shared between HR, IT and the line manager.

Screening completed: NIST SP 800-53 PS-3 expects individuals to be screened prior to authorising access. Confirm screening is complete before the account is enabled, not just before the start date.
Access agreement and rules of behaviour sent: send the acceptable use policy and any confidentiality agreement with the contract so the person can read them before day one. PS-6 expects access agreements to be signed prior to access being granted. See the Acceptable Use Policy Template.
Account created disabled: provision the account from the HR record but keep it disabled until the start date, with role-based access only. See the Joiner-Mover-Leaver Guide.
Pre-start warning: include one line in the welcome pack: "We will never ask you for gift cards, payment or your passwords by text or personal email. If you get such a message, tell your manager." This reaches the person during the window when the FTC describes boss imposter scams starting, before or soon after the start date.
Device prepared: enrolled in device management, encrypted, patched, with the approved password manager and browser policy applied before handover.
Manager briefed: give the line manager a one-page note on their part: telling the new starter how they will genuinely contact them, and repeating that checking is welcome.

Day one: the survival set

Day one should cover only what the person needs to work safely this week. Keep it to 30 to 45 minutes in total, mixed between a live welcome and short e-learning. The NCSC's free Top Tips for Staff package, which takes under 30 minutes and is available as SCORM packages for an organisation's own learning platform, covers passwords, devices, phishing and reporting and can serve as the baseline module. CISA's Secure Our World programme frames the same core as four behaviours: Recognize and Report Phishing, Use Strong Passwords, Turn on MFA and Update Software.

Topic	What to cover	How to confirm it landed
Signing in and MFA	Enrol MFA with IT present, using the organisation's preferred method; never approve a prompt you did not start; never read out a code	MFA registered before first access to email
Passwords and the password manager	Use the password manager; a unique password for every system; no reuse of personal passwords	Password manager installed and unlocked
How to report	The report button in email, the IT or security contact, the urgent phone number; report mistakes too	New starter sends a test report or locates the button
How the organisation will contact you	Which channel IT, HR and the manager will genuinely use; how to verify an unexpected request	Manager confirms it in the first one-to-one
Device basics	Lock the screen when away, install updates when prompted, no personal accounts or browser sync on the work device	Device compliance status in the management console
Where work data lives	The approved storage and sharing locations; no work files in personal cloud storage or email	Covered in the acceptable use acknowledgement

The browser point is not theoretical. In the Okta support system breach, the credentials of a service account had been saved in an employee's personal Google profile in Chrome on a managed laptop, and compromise of that personal account or device was the likely route. A day one rule on personal profiles, backed by a browser policy, addresses the same habit.

The first month: building on the basics

Once the person knows their role and colleagues, deeper topics stick. Spread them weekly, five to ten minutes each, and have the manager reinforce one point in each weekly one-to-one.

Week	Topics	Linked guidance
Week 1	Phishing and social engineering, including voice calls and fake IT support; QR codes; unexpected sharing invitations	Callback Phishing (TOAD) Guide
Week 2	Data handling: classification labels, sharing externally, sending to the wrong recipient, clear desk and screen	Data Classification Guide
Week 3	Approved AI tools and what may not be pasted into them; working remotely and on public networks	AI Acceptable Use Policy Template, Home Office and Remote Worker Security Guide
Week 4	Physical security and visitors, insider risk indicators, lost devices, and a recap quiz	Acceptable Use Policy Template
Day 30 to 90	First phishing simulation with immediate, supportive feedback; role-based modules start	Security Awareness Plan Template

This sequence lines up with the CIS Controls v8.1 Control 14 safeguards that every organisation is expected to cover: social engineering (14.2), authentication (14.3), data handling (14.4), unintentional data exposure (14.5), recognising and reporting incidents (14.6), missing security updates (14.7) and insecure networks (14.8). Safeguard 14.1 expects training at hire and at least annually. See the CIS Control 14 Security Awareness and Skills Training Guide.

Role-based additions

NIST SP 800-53 AT-3 and CIS Safeguard 14.9 call for role-based training. For new starters, the role module should be complete before the person receives the privileged or sensitive access that the role needs.

Finance and payments: payment change verification, invoice fraud and deepfake executive calls, before payment system access. See the Business Email Compromise Awareness for Finance Teams Guide.
Service desk: caller verification for password and MFA resets, before reset permissions are granted. See the Vishing and Help Desk Social Engineering Awareness Guide.
Administrators: separate admin accounts, phishing-resistant authentication and the change process, before any admin role is assigned.
Developers and engineers: where secrets, API keys and tokens may be stored, secret scanning, approved package sources and code assistants, before repository write access.
Executives and their assistants: impersonation, travel and public profile risks. See the Security Awareness for Executives and Assistants Guide.
Frontline and deskless staff: shorter, mobile-friendly content and shared device rules. See the Frontline Worker Security Awareness guide.

Where identity fits

Induction and identity provisioning are the same process seen from two sides. Each security step in the induction should map to an identity event, so that completion is evidenced by the system rather than by a tick in a spreadsheet.

First credential handover: deliver initial sign-in through a time-limited, one-time onboarding code or in-person setup rather than a password in email, and enrol MFA in the same session. See the Phishing-Resistant MFA Guide.
Access in stages: grant baseline access on day one and role access once the role module and acknowledgement are recorded, using birthright and request-based access from the identity governance process.
No shared or inherited credentials: a new starter should never be given a predecessor's account, a shared mailbox password or a team API key. If a system needs a shared credential, it belongs in the vault with named access.
Machine credentials: developers and engineers are often handed tokens and keys during setup. Teach where non-human credentials live and how to request their own. See the Secrets Management Guide.

Contractors, temporary staff and transfers

Contractors and agency staff: NIST AT-2 names contractors among the system users who need literacy training. Use the same day one survival set and acknowledgement, shortened if the engagement is brief, and make completion a condition of account activation in the contract.
Interns and graduates: often the most active on social media about a new job, so the impersonation warning matters most here.
Internal movers: a move into finance, the service desk or an admin role is a new start for that role. Trigger the role module from the mover event and remove old access at the same time.
Returners: people returning from long leave should repeat the day one set, because processes, tools and reporting routes may have changed.

Implementation: building the induction

Agree owners: HR owns the schedule and acknowledgement, IT owns account and device steps, security owns content and measurement, and line managers own reinforcement.
Define the gates: list which induction steps block which access (for example, acknowledgement before email, role module before payment system access) and record them in the joiner workflow.
Build or license content: start from a free baseline such as the NCSC Top Tips for Staff package and add organisation-specific content: your report button, your contact channels, your approved tools. The NCSC advises tailoring training to the behaviours people need and to your own technical controls.
Pilot with one intake: run the full sequence with a single month's joiners, collect feedback at day 30 and check that every gate fired.
Automate enrolment: enrol joiners in the learning platform from the HR or identity system so no one is missed, and remove leavers the same way.
Review and roll back: if a gate blocks people from working (for example a role module that was not available on time), allow a time-limited exception approved by the manager and security, fix the cause and record it. Review content at least annually and after relevant incidents, as AT-2 expects lessons learned to be incorporated.

Decision guidance

Live session or e-learning: a short live welcome from a senior person sets the tone that security is part of the job, which the NCSC links to leaders' behaviour. Use e-learning for the content itself, so it is consistent and evidenced.
Small organisations: a 20-minute conversation with the IT lead using a printed checklist, the NCSC baseline module and a signed acceptable use policy will cover the essentials without a learning platform.
Large organisations: automate everything that can be automated (enrolment, gates, reminders) and spend human time on the manager briefing and role modules.
Regulated sectors: check sector rules for timing and records. For example, the HIPAA Privacy Rule at 45 CFR 164.530(b) requires training for each new member of the workforce within a reasonable period after joining and documentation that it was provided.

Detection and measurement

Measure the joiner cohort separately from the whole workforce, because their risk and their learning curve are different.

Acknowledgement before access: percentage of joiners whose rules of behaviour acknowledgement was recorded before their account was enabled (target 100%).
MFA enrolled on day one: percentage of joiners with MFA registered before first email access.
Time to first report: median days from start date to a joiner's first reported suspicious message, real or simulated.
Early simulation outcome: report rate and credential submission rate for joiners in their first 90 days compared with the workforce baseline.
Role module before role access: percentage of privileged or sensitive access grants where the role module was complete first.
Early incidents: security incidents involving people in their first 90 days, by type, to feed content updates.

For programme-level measures, see the Security Awareness Metrics guide.

Common failure patterns

The two-hour policy dump: every policy on day one, read and forgotten. Keep day one to survival behaviours and sequence the rest.
Access first, training later: the account and payment system access arrive on day one, the module is due in 30 days and is chased for months. Make key steps gates.
No warning about new-starter scams: the person's first unusual request arrives from someone claiming to be their new manager before anyone has told them how the manager really communicates.
Reporting buried in a policy: the report button is mentioned once on slide 40. Make reporting the first practical exercise.
Contractors skipped: agency and contract staff get accounts through a side process with no induction, though AT-2 explicitly includes contractors.
Blame for early mistakes: a new starter who fails a first simulation is publicly named or sent to remedial training. The NCSC warns that people who fear punishment may not report mistakes.

Framework mapping

Framework	Reference	Induction element
NIST SP 800-53 Rev. 5	AT-2 Literacy Training and Awareness, AT-2(2), AT-2(3)	Initial training for new users; insider threat and social engineering topics
NIST SP 800-53 Rev. 5	AT-3 Role-based Training	Role modules before role access
NIST SP 800-53 Rev. 5	PL-4 Rules of Behavior, PS-6 Access Agreements, PS-3 Personnel Screening	Acknowledgement and screening before access
NIST CSF 2.0	PR.AT-01, GV.RR-04	Awareness for general tasks; security in HR practices
CIS Controls v8.1	Safeguards 14.1 to 14.9	Training at hire, topic coverage, role-specific training
ISO/IEC 27001:2022 Annex A	A.6.1 Screening, A.6.2 Terms and conditions of employment, A.6.3 Information security awareness, education and training, A.5.10 Acceptable use	Pre-start checks, contractual responsibilities, induction content, acceptable use
HIPAA Privacy Rule	45 CFR 164.530(b)	Training new workforce members within a reasonable period, with documentation

Practitioner checklist

Agree owners across HR, IT, security and line managers, and write the induction schedule down.
Send the acceptable use policy and a new-starter scam warning with the contract or welcome pack.
Confirm screening is complete before the account is enabled.
Record rules of behaviour acknowledgement before access, and enrol MFA in person on day one.
Keep day one to the survival set: MFA, passwords, reporting, genuine contact channels, device basics and data locations.
Sequence weekly modules across the first month, with manager reinforcement in one-to-ones.
Gate role-based access on completion of the role module.
Include contractors, interns, internal movers and returners.
Enrol joiners automatically from the HR or identity system.
Measure the joiner cohort separately and update content from early incidents.

New Starter Security Induction Guide: What to Cover on Day One and in the First Month