No laptop ready. An account created Friday afternoon by whoever answered the phone. A quick instruction to “give Dana everything Tom had.” Her email works before anyone confirms MFA. And someone shares a generic login “just for the first week.”
For Dana, the new associate, paralegal, or office coordinator, it’s a rushed start. For your firm, it can be the moment a security gap opens.
Onboarding is a security event, not just an HR task. Your first-day decisions shape who can access your data, which devices can reach it, and whether there’s a record of the controls you put in place. If the setup works, nobody may think to review it again. That’s how a temporary exception quietly becomes the permanent way of doing business.
Why Dana’s First Day Matters
Identity. Devices. Access. They all come together at once.
In regulated work, that also raises a documentation question: can you show who approved Dana’s access, what she received, and when? The FTC Safeguards Rule includes access-control expectations for covered financial institutions. HIPAA’s Security Rule includes workforce-security and information-access procedures. Law firms also have duties to protect client information; ABA Formal Opinion 477R offers context on securing client communications.
A dated onboarding checklist is not a compliance guarantee. But it can document the steps your firm took, and help make those steps repeatable.
Day One Should Be Boring. Week One Can Be Specific.
Repeatable. Predictable. Documented.
Day one is for the essential security foundation. The new hire should have a managed device, a unique identity with MFA enforced, and access based on their role, not someone else’s account. Credentials should be delivered securely. Security awareness training should be assigned, and the employee should acknowledge the firm’s acceptable-use and confidentiality policies.
Week one is for tailoring. Add the approved line-of-business applications, client or patient systems, and specialized folders Dana needs. Then review what was granted and remove any temporary access that isn’t justified.
The mistake is treating a week-one request as a day-one favor. “She needs it right now” is how excess access gets normalized.
“Everything Tom Had” Is Not a Role
It’s a shortcut with a long memory.
Tom may have accumulated permissions over years: extra group memberships, access to old matters or shared folders, or administrative rights granted to solve an urgent problem. Some of those permissions may not belong to Tom anymore, let alone Dana.
Copying Tom’s account copies his history, not Dana’s job requirements. Instead, define role templates: for example, associate attorney, paralegal, billing specialist, medical assistant, or accounting staff. Assign access through groups in Microsoft 365 and device policies in Intune, then approve exceptions deliberately. This makes it easier to give new hires the right foundation and easier to review changes later.
MFA, Credentials, and the First-Week Phishing Window
New employees are learning names, systems, and routines. They’re also likely to receive welcome emails, account setup instructions, and payroll messages, exactly the kind of activity a convincing scam can imitate.
Set up and require MFA before Dana’s first email arrives. Deliver initial credentials through a secure, approved channel, not plaintext email, a chat message, or a note left beside the keyboard. During first-week training, make the rule explicit: IT will never ask you to disclose your password over email or phone. Show employees how to report suspicious messages and unexpected MFA prompts.
This is practical email security, not just a login setting. A well-timed impersonation message can target a new hire before they know how your firm handles IT requests.
The Device Question: Firm-Owned, Personal, or “For Now”?
“Use your own laptop for now” sounds convenient. The danger is that “for now” becomes permanent, without clear safeguards, support, or a plan to remove firm data when the employee leaves.
A managed device gives your firm a consistent way to configure security, apply updates, and protect work data. Microsoft describes Intune as a cloud-based service for managing devices and apps, including enrollment and security policies. In supported bring-your-own-device arrangements, controls can be designed to protect work information without taking over someone’s personal device. The right approach depends on your needs and policies.
The key is to decide before Dana signs in. Device management is usually easier to establish on day one than to retrofit after firm data is already on the device.
A Practical Day-One / Week-One Security Checklist
Use this as a starting template. Assign an owner, record completion, and tailor the steps to your systems and obligations.
- Create a unique identity and enforce MFA before the employee’s first sign-in.
- Enroll the device in management before it accesses firm data.
- Assign role-template access; never clone permissions from another person.
- Deliver credentials out-of-band through an approved secure method, never plaintext email.
- Start with minimum necessary access and expand it only when approved.
- Assign security awareness training on day one and confirm completion during week one.
- Obtain a signed acceptable-use and confidentiality acknowledgment and file it appropriately.
- Ban shared or generic logins, even “temporarily.”
- Review access during week one and remove temporary grants that aren’t needed.
- Keep a dated onboarding record documenting approvals, access, device setup, training, and acknowledgments.
The record should be useful, not decorative. Keep it where the people responsible for onboarding and compliance can find it. Confirm retention and documentation practices with qualified counsel.
Internal Onboarding vs. a Managed Services Provider
There’s no single right operating model. The important thing is having a consistent one.
Handled internally
- Pros: Your office manager or IT generalist knows the firm’s people and roles. Communication can be direct, and there may be no additional provider cost.
- Cons: Onboarding is episodic, so steps are easy to skip when the phone is ringing and the new hire is waiting. Tooling may be inconsistent, records can end up scattered, and the process can depend on one person: “Hey Margaret, can you get Dana set up?” is not a durable control.
Handled with a managed services provider
- Pros: A provider can help establish a documented, repeatable procedure, automate role-based provisioning, maintain consistent evidence, and connect onboarding with offboarding and role changes. That can create economies of scale and more predictable business IT support.
- Cons: The provider may not know your firm’s role distinctions without guidance. You’ll need upfront time to define templates and approvals, and you’ll rely on an external team’s response process.
Even firms with internal IT benefit from a written standard. A managed services provider can support the process with managed IT services or cybersecurity services, but your firm still owns the decisions about roles, approvals, and policy.
Final Word
Dana’s first day should feel welcoming, not improvised. When each new hire gets a managed device, an individual account, role-appropriate access, MFA, secure credentials, and clear training, your firm starts with a stronger foundation and a better record of what was done.
That matters whether you need law firm cybersecurity, medical practice IT, accounting firm IT, HIPAA compliance support, GLBA compliance support, or a more consistent IT support process for a small business. Requirements vary by regulator, state, and engagement. This article is general information, not legal advice; consult qualified legal counsel about acknowledgments, HIPAA workforce access, and confidentiality obligations.
If your onboarding still depends on whoever is free that afternoon, make the next hire an opportunity to improve the process. Talk with A PC of Mind about an IT assessment, IT asset management, Microsoft 365 support, endpoint security, and business IT support designed to make day one safer, and more predictable.
