Reference no: EM133025603

HRIS Data Breach (adapted from Nkomo, et. al.) Sweets, Inc., a candy manufacturer, is finalizing the implementation of a comprehensive human resource information data system covering its 400-plus employees, It has been working on the system for two (2) years and hopes to finish it within the next few months. This system will eliminate virtually all the paper forms used by the HR department. When the process is complete, the firm will be able to store, analyze, retrieve, and distribute most of its HR information.

Shortly, the company will be able to post job openings on the companies web page, with simultaneous listings to the major job search search sites (e.g., indeed, Glassdoor, etc). All incoming applications will be initially screened using job-specific key words. It will know what skills and abilities all of its employees possess and what training each has received. It will be able to access performance appraisal information on all employees to determine job performance levels and necessary training. Sweets will be able to examine pay and benefit information to determine individual and aggregate compensation levels. It will also be able to easily prepare various reports, such as turnover by department, EEO-1, and OSHA 300 logs. All of this information will be available with just a few key strokes.

Until yesterday everything had gone smoothly. Then, a major problem developed that turned everything upside down. A laptop computer containing sensitive data went missing from one of the HR offices. Was it stolen? Did someone borrow it to work on at home? Was it just moved to another office? No one knew for sure and a frantic search began, but without any success.

The HR director decided he had better call Sweets' president and the CIO to explain what had happened. The president wanted to know immediately what information was stored on the computer and how it could be retrieved by others, assuming it was stolen. The HR director stated that he was not sure if the laptop had been stolen, but that employee compensation information was probably on the computer, including name, address, telephone, and social security numbers. The confidential information was password protected, but an experienced hacker might be able to retrieve it. All three executives were aware of recent incidents in which sensitive data had been compromised at many large corporations, which resulted in warnings to those affected, as well as negative press.

Questions to address:

1. What action do you recommend that Sweets, Inc. take now? Why?
2. What steps can be taken to prevent the problem from occurring again?
3. What additional information needs to be gathered before any decisions are made or actions taken?

To recap, this assignment requires that you examine the ramifications of a data breach at a large employer. The final deliverable required is a single document grammatically correct and addressing all questions in the assignment. External references should be utilized and included in APA format at the end of the document.