A small investment in employee screening before hiring can alert management to serious questions about a person's trustworthiness. For both the government and private sector, finding something negative or detrimental in a person's background does not necessarily mean that they are unsuitable for a particular job. A determination must be made based on the type of job, the type of finding or incident, and other relevant factors. In the government, this process is referred to as adjudication. Once a candidate has been hired, the staffing process continues with training in the computer security responsibilities and duties of the position.
Training can be very cost-effective in promoting security.
Some computer security experts argue that employees must receive initial training before granting them any access to computer systems. Others argue that this must be a risk-based decision, perhaps only granting restricted access or access only to their PC until the required training is completed. Both approaches, however, recognize that adequately trained employees are crucial to the effective functioning of computer systems and applications. In addition, although training of new users is critical, managers must recognize that security training and awareness activities should be ongoing throughout the time that an individual is a system user. In addition, user administration can detect some unauthorized and illegal activities.