How should HR and IT handle a security alert that involves an employee's device?
As a security event about a device first, not as evidence against a person. An alert says that a device behaved unusually: it may be infected, used by someone else, or doing something legitimate that looks odd. IT checks the facts first: what the device did, when, whether malware is present, and whether an account was misused. HR is involved only if the facts point to a conduct issue, and then under your disciplinary policy, employment law and data protection rules, ideally with the data protection officer consulted. Keep the circle small, record each step, and do not discuss names until the facts are clear. NetSenX supports this split: its alerts describe devices, connections and destinations, and its audit log records who handled an alert and what they decided.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Can a network security tool be used for employee investigations?
- Is it legal in the EU to use network logs in a disciplinary case?
- How do we keep network security monitoring from becoming employee surveillance?
- Can an unused office computer be used by attackers?
- How do we spot activity on a computer that should be idle?