Free checklist

    The Hiring Identity Checklist

    Verify who you hire before they get access.

    The first login happens before day one. Every new hire is an identity you are about to trust with accounts, data and a laptop, so hiring is an identity-proofing step, not just paperwork. Use this one-page checklist at each stage. The reasoning behind it is in my article The First Login Happens Before Day One.

    Stage 1Before interviews

    • Require at least one live video round with the camera on.
    • Check that the resume, LinkedIn and GitHub histories agree (account age, activity, connections).
    • Verify employer references through phone numbers you found independently, never numbers the candidate supplies.
    • Treat refusal of live video, shifting stories, or voice and location mismatches as escalation triggers.

    Stage 2At offer

    • Verify a government ID against the live person using document verification plus a liveness check, in line with the remote identity-proofing approach of NIST SP 800-63A (IAL2).
    • Run a background check from a reputable provider.
    • Confirm work authorization (Form I-9 in the US).
    • Confirm legal name and address history.

    Stage 3Before day one

    • Ship equipment only to the verified address, and flag any last-minute address change.
    • Have the new hire enroll a phishing-resistant authenticator in a supervised live session.
    • Set up accounts only after identity is confirmed.

    Stage 4First 90 days

    • Start with least-privilege access and expand in steps.
    • Watch for remote-access tools and logins from locations that do not match the stated one.
    • Review access at 30, 60 and 90 days.

    Stage 5Process

    • One named owner, shared by HR and Security.
    • Document every exception.
    • Keep evidence under a retention policy that respects privacy law.

    salmantabrez.com/checklist · Salman Tabrez