Document Management Systems and HR Security

[KBFINN]

We are in the process of implementing a Document Management System are concerned about storing confidential HR documents there. I am interested in hearing how other companies manage this. (1) How is the system administered? (2) How many people (IT or otherwise) have full access to the system? (3) What "roles" are there in administering the system? (4) What checks and balances are there to ensure that the information is not accessed or disemanated? (5) Are the system administrators required to sign special non-disclosure agreements? (6) Is there any information that was deemed too sensitive to store on the DMS?

Thanks for your comments.

 

[bi]

Regarding #5: In places I have worked, everyone who had access to the system had to sign a non-disclosure/confidentiality agreement. This included sys admins who didn't really have access to the HR application that was running on the system. Before accounts were set up on the OS, a process was put in place to ensure the non-disclosure had been signed.

The biggest loophole, however, was when people left: no one told the sys admins to disable or delete accounts. The biggest offender for this lapse was the HR department.