Employer Glossary
Employer Glossary for HR, Payroll & People Leaders
This practical employer glossary explains essential terms across HR, payroll, employee data, benefits, workforce access, fraud prevention, remote work, compliance, and workplace operations.
Employer terminology, explained clearly.
Browse clear definitions covering payroll protection, HR data, benefits, workforce access, fraud prevention, remote work, compliance, and incident response.
401(k) Account Fraud
Unauthorized changes, withdrawals, loans, or transfers involving an employee retirement account. Strong identity checks, change alerts, MFA, and coordination with the plan provider help protect participants.
Access Control
The rules and tools that determine who may view, change, export, or approve information. HR and payroll access should match job duties and be removed promptly when responsibilities change.
Account Lockout
A safeguard that temporarily blocks login after repeated failed attempts or suspicious activity. It helps slow password guessing while giving administrators a signal to investigate.
Administrative Account
An account with power to configure systems, manage users, or change sensitive settings. Administrative access should be separate from everyday use, individually assigned, and strongly authenticated.
Anti-Phishing Training
Practical instruction that teaches employees to recognize and report deceptive messages. Effective training uses realistic payroll, benefits, executive, vendor, and document-sharing examples.
Applicant Data
Personal information collected during recruiting, such as resumes, contact details, interview notes, and screening results. Access should be limited and the information retained only as long as business and legal needs require.
Approval Workflow
A defined sequence of reviews required before a sensitive HR, payroll, access, or payment action is completed. Workflows reduce reliance on a single person's judgment and create an audit trail.
Authentication
The process of proving that a user is who they claim to be. Passwords, security keys, authenticator apps, and device checks are common authentication methods.
Automated Clearing House (ACH) Fraud
The unauthorized use or redirection of ACH payments. Employers should independently verify new banking instructions and unusual payroll or vendor payment requests before funds are released.
Background Check Data
Sensitive information received or created during employment screening. Employers should restrict access, use approved vendors, protect transmission and storage, and follow applicable notice and retention requirements.
Benefits Account Takeover
Unauthorized control of an employee's retirement, insurance, HSA, or other benefit account. Stolen credentials may be used to change contact details, beneficiaries, investments, or disbursements.
Benefits Enrollment Fraud
A deceptive enrollment or change involving ineligible participants, stolen identities, fake portals, or altered benefit selections. Verification and audit trails help HR teams investigate suspicious activity.
Benefits Platform Security
The safeguards protecting systems used for enrollment, eligibility, retirement, health, or other employee benefits. Employers should review administrator access, MFA, integrations, audit logs, and vendor response commitments.
Breach Notification
The process of informing affected people, regulators, clients, insurers, or other parties after certain data incidents. Requirements vary, so employers should preserve facts and involve qualified legal counsel promptly.
Bring Your Own Device (BYOD)
A policy that allows employees to use personal devices for work. Employers should define which data and systems are permitted and how screen locks, updates, separation, support, and removal will be handled.
Business Continuity Plan
A plan for maintaining essential operations during a disruption. Employers should identify how payroll, employee communications, benefits, scheduling, and required reporting will continue if normal systems are unavailable.
Business Email Compromise (BEC)
A targeted scam that impersonates an executive, employee, vendor, or advisor to obtain money or confidential information. Payroll and bank-change requests are frequent targets.
California Consumer Privacy Act (CCPA)
A California privacy law that can affect how covered businesses disclose and manage personal information. Employers should understand whether it applies to workforce data and coordinate compliance with qualified counsel.
California Privacy Rights Act (CPRA)
California privacy requirements that expanded rights and obligations relating to personal information, including certain employee and applicant data. Covered employers need clear notices, controls, and request-handling procedures.
Change Verification
A separate confirmation step for sensitive requests such as bank-account, address, tax-withholding, or access changes. Verification should use a trusted contact method, not the contact details supplied in the request.
Clean Desk Policy
A rule for securing employee records, pay information, passwords, badges, and portable media when work areas are unattended. It applies in offices, shared spaces, and home work environments.
Confidential Employee Information
Workforce information that should not be broadly available, including compensation, performance, leave, disciplinary, identity, and banking records. Access should follow job responsibilities and documented business need.
Contingent Worker Access
System access provided to contractors, temporary staff, consultants, or other nonemployees. It should have a defined owner, limited scope, expiration date, and offboarding process.
Credential Theft
The stealing of usernames, passwords, authentication codes, or session tokens. Criminals may use stolen credentials to enter email, HRIS, payroll, or employee self-service systems.
Cyber Insurance
Insurance intended to help with specified costs arising from cyber incidents. Employers should understand coverage conditions, reporting deadlines, exclusions, and the security controls represented in the application.
Cybersecurity Policy
A written statement of security responsibilities and acceptable practices. It should be understandable to employees, aligned with actual operations, and supported by training and consistent enforcement.
Data Backup
A protected copy of information used for recovery after deletion, corruption, ransomware, or system failure. Important backups should be tested and kept separate from the accounts and systems they protect.
Data Breach
An incident in which protected information is accessed, acquired, altered, or disclosed without authorization. A suspected breach requires prompt containment, fact gathering, and legal and insurance review.
Data Classification
A method for labeling information by sensitivity, such as public, internal, confidential, or restricted. Classification helps HR and payroll teams apply the right access, sharing, retention, and disposal controls.
Data Minimization
Collecting, sharing, and retaining only the employee information needed for a defined purpose. Less unnecessary data means less exposure during a mistake, account compromise, or vendor incident.
Data Retention Schedule
A documented timetable for keeping and disposing of records. It helps employers balance employment, tax, safety, benefits, litigation, and business requirements against the risk of retaining unnecessary data.
Direct-Deposit Change Verification
A documented process for confirming an employee's request to change payroll banking information. Strong procedures use a second channel, identity checks, and an audit trail before the change takes effect.
Direct-Deposit Fraud
The redirection of an employee's wages to an account controlled by a criminal. It often begins with a compromised employee email, stolen self-service credentials, or an impersonation request.
Disaster Recovery
The process for restoring systems and data after a serious outage or incident. Recovery priorities should reflect payroll deadlines, benefits administration, employee communications, and other time-sensitive obligations.
Electronic Funds Transfer (EFT) Fraud
Fraud involving an electronic transfer of payroll, benefit, tax, or vendor funds. Payment limits, dual approval, reconciliation, and rapid bank notification help reduce losses.
Email Authentication
Domain controls such as SPF, DKIM, and DMARC that help receiving systems identify forged email. These controls can reduce impersonation of the employer's domain when properly configured and monitored.
Employee Data
Information connected to a worker, including contact, payroll, benefits, performance, leave, safety, and employment records. Employers should know where it is stored, who can access it, and which vendors receive it.
Employee Self-Service Portal
A system where employees view or change pay, banking, tax, benefits, and personal details. Because it enables high-impact changes, the portal should use strong authentication and change notifications.
Encryption
A method of making information unreadable without the correct key. Encryption helps protect employee files on laptops, phones, backups, emails, and data transfers.
Endpoint Protection
Security controls installed on laptops, desktops, and mobile devices to detect or block malicious activity. Coverage should include remote workers and devices used to reach HR or payroll systems.
Exit Access Checklist
A documented list of accounts, devices, files, keys, tokens, and vendor relationships to address when someone leaves. It helps HR, managers, and IT coordinate timely removal or transfer of access.
File-Sharing Controls
Rules and technical settings that govern who can upload, download, forward, or publicly link sensitive files. HR and payroll documents should be shared through approved systems with expiration and access limits where available.
Former Employee Access
Any login, token, mailbox, device, or shared credential that remains usable after employment ends. Timely deactivation is essential because dormant access can expose HR, payroll, and company data.
Fraud Escalation Procedure
A documented path for employees to report suspected payroll, benefits, payment, identity, or executive impersonation fraud. It should name backup contacts and include immediate steps such as pausing a transaction.
Governance
The assignment of responsibility, decision-making, and oversight for cybersecurity and workforce data. Good governance makes clear who approves risk, owns systems, manages vendors, and leads response.
Health Information
Information about an employee's health, leave, accommodation, benefits, or workplace injury. Employers should restrict access and store it separately when required by applicable law or policy.
HR Data Owner
The person accountable for how a category of workforce information is collected, accessed, shared, retained, and disposed of. Ownership helps resolve questions that technology settings alone cannot answer.
HR Information System (HRIS)
Software that stores and manages workforce information and HR processes. Security should cover user roles, integrations, exports, audit logs, backups, and the full employee lifecycle.
HR Vendor Risk
The risk created when a recruiting, payroll, benefits, background-check, scheduling, or HR technology provider handles workforce data or access. Contracts and oversight should address security, incidents, and data return or deletion.
Human Firewall
Employees who recognize suspicious activity, follow verification steps, protect information, and report mistakes quickly. People become a strong control when expectations are practical and reinforced.
I-9 Data
Identity and work-authorization information maintained for Form I-9 compliance. Because these records contain sensitive identifiers, employers should tightly control access and use secure storage and transmission.
Identity Verification
The process of confirming a person's identity before granting access or completing a sensitive request. Employers should use stronger checks for payroll, benefits, tax, and employee-record changes.
Incident Response Plan
A written plan for detecting, containing, investigating, communicating about, and recovering from a security event. Roles for HR, payroll, leadership, IT, legal, vendors, and insurance should be clear.
Insurance Enrollment Fraud
A fraudulent attempt to add, remove, or change benefit coverage or participants. HR teams should investigate inconsistent identity details, unusual timing, and requests that bypass standard enrollment processes.
Integration Access
The permissions given to applications that exchange data with HRIS, payroll, benefits, timekeeping, or identity systems. Integrations should use the least access possible and be reviewed when vendors or processes change.
Job Applicant Privacy
The protection of personal information collected from candidates during recruiting and screening. Applicants should receive appropriate notices, and their data should not be shared or retained without a legitimate purpose.
Job Change Access Review
A review of permissions when an employee transfers, is promoted, takes leave, or assumes new duties. Old access should be removed instead of simply adding new permissions.
Least Privilege
Giving each person only the minimum access needed to perform their role. This limits accidental exposure and reduces what a compromised employee account can reach.
Leave-of-Absence Access
A documented decision about system, email, facility, and device access while an employee is on leave. The approach should reflect role, policy, operational need, and applicable employment requirements.
Manager Self-Service
HRIS functions that let managers view employee information or initiate job, pay, scheduling, or performance actions. Permissions and approvals should prevent managers from seeing or changing more than their role requires.
Mobile Device Management (MDM)
Technology used to configure, secure, inventory, and remotely protect work-enabled phones or tablets. It can enforce screen locks, encryption, updates, and separation of company data.
Mobile Payroll Approval
Reviewing or authorizing payroll from a phone or tablet. Approvers should use managed devices, multi-factor authentication, and a separate verification step for unusual changes.
Multi-Factor Authentication (MFA)
A login safeguard that requires more than one form of proof. MFA is especially important for email, HRIS, payroll, benefits, remote access, and administrative accounts.
New-Hire Fraud
Deception involving a fabricated candidate, stolen identity, fraudulent remote worker, or false onboarding information. Employers should verify identity and unusual equipment, payment, and account requests.
New-Hire System Access
Accounts and permissions prepared for a new employee. Access should be based on an approved role, activated at the right time, and communicated through trusted onboarding channels.
Non-Disclosure Agreement (NDA)
An agreement addressing the use and disclosure of confidential information. It can support information protection but does not replace access controls, secure systems, training, or applicable employment-law review.
Offboarding
The coordinated process for ending access, recovering assets, transferring records, and protecting confidential information when a worker leaves. HR, payroll, managers, facilities, and IT all have responsibilities.
Onboarding
The process of establishing a new worker's identity, accounts, permissions, equipment, and policy acknowledgments. Secure onboarding avoids shared credentials and confirms requests through trusted contacts.
Open Enrollment Scam
A fraudulent message, website, or call that imitates a benefits provider during enrollment season. Employers should publish trusted links and warn employees before high-volume benefits communications begin.
Password Manager
A protected application that creates and stores unique passwords. Approved password managers reduce reuse and make it easier for employees to use strong credentials without informal spreadsheets or notes.
Password Reuse
Using the same or similar password for multiple services. A breach of one account can then expose email, HRIS, payroll, benefits, or other business systems.
Payroll Administrator Access
Elevated access that can change employee pay, banking details, tax settings, or payroll files. It should be limited to named users, protected with MFA, and reviewed regularly.
Payroll Diversion
A scheme that reroutes wages or payroll payments to a fraudulent account. Warning signs include urgent bank changes, mismatched contact details, or changes made shortly before payroll closes.
Payroll Impersonation
A scam in which someone pretends to be an employee, executive, or payroll provider to request a sensitive payroll action. Staff should verify identity outside the original message.
Payroll Reconciliation
The comparison of payroll reports, employee changes, bank totals, and prior-period results before and after processing. Reconciliation can reveal unauthorized additions, pay changes, or account substitutions.
Personally Identifiable Information (PII)
Information that identifies or can be linked to a person, such as a name, Social Security number, address, or account number. Employee PII requires appropriate access, handling, and breach-response procedures.
Phishing
A fraudulent message designed to steal information, capture a login, deliver malware, or trigger an unauthorized action. Messages may imitate HR, payroll, benefits, executives, vendors, or government agencies.
Protected Health Information (PHI)
Individually identifiable health information protected under HIPAA when handled by a covered entity or business associate. Not every employer-held medical record is PHI, but it may still be sensitive and legally protected.
Quarterly Access Review
A recurring review in which managers and system owners confirm that user access is still appropriate. High-risk HR, payroll, benefits, finance, and administrator permissions deserve priority.
Ransomware
Malicious activity that encrypts systems, steals data, or both, followed by a payment demand. Backups, access controls, updates, endpoint protection, and rapid reporting reduce business impact.
Remote Access
A method for reaching company systems from outside the workplace. Remote access should use approved devices or controls, MFA, limited permissions, and logging appropriate to the risk.
Remote Worker Security
The policies, tools, and habits that protect employees working away from a company location. It includes device care, private conversations, secure Wi-Fi, document handling, and rapid incident reporting.
Role-Based Access Control
Assigning permissions according to defined job roles rather than one-off decisions. It makes HR and payroll access more consistent and easier to review when employees transfer or are promoted.
Security Awareness Training
Ongoing education that connects security expectations to each employee's work. Training should cover reporting, passwords, data handling, remote work, and scams that target HR, payroll, and managers.
Security Incident
An event that may threaten systems, accounts, data, or operations. Examples include a lost device, misdirected employee file, suspicious login, phishing click, payroll change, or vendor notice.
Separation of Duties
Dividing sensitive responsibilities so one person cannot initiate, approve, and conceal the same action. It is especially useful for payroll changes, payments, user administration, and reconciliation.
Social Engineering
Manipulating a person into bypassing normal procedures. Attackers often use urgency, authority, familiarity, or fear to make an unusual payroll or data request seem legitimate.
Suspicious Payroll Change
A pay, banking, tax, address, or account change that does not fit normal behavior or procedure. Examples include unusual urgency, a new contact method, multiple changes at once, or a request near payroll cutoff.
Tax Form Fraud
The misuse of W-2, W-4, 1095, or other tax-related information to steal identities, redirect refunds, or deceive payroll staff. Requests and distribution methods should be verified and secured.
Third-Party Risk
The possibility that a vendor's people, systems, or subcontractors expose the employer's data or operations. Review should be proportionate to the sensitivity of data and level of access involved.
Timekeeping Fraud
The intentional manipulation of time records, identities, approvals, or devices. Employers need controls that protect both payroll accuracy and employees' rights under applicable wage-and-hour rules.
Two-Person Approval
A control requiring two authorized people to review a high-impact action. It is particularly useful for payroll release, bank changes, large payments, mass exports, and administrator access.
Unauthorized Access
Viewing, changing, exporting, or using information without permission. It may involve an external attacker, a former employee, a shared account, excessive privileges, or an internal policy violation.
Vendor Access
A vendor's ability to enter systems, receive files, or administer services. Access should be named, limited, monitored, time-bound when possible, and removed when the engagement ends.
Vendor Data Breach
A security incident at a service provider that affects employee or company information. Employers need a clear notification path, contact list, contract terms, and response process before an incident occurs.
Vishing
Voice phishing conducted by phone or voicemail. A caller may impersonate an employee, executive, bank, insurer, or vendor to obtain codes, personal information, or an urgent payroll action.
W-2 Phishing
A scam seeking employee tax forms or wage data, often by impersonating an executive or tax professional. Requests for batches of W-2s should receive heightened scrutiny and independent confirmation.
Workers' Compensation Data
Records relating to workplace injuries, claims, medical information, and return-to-work activity. Access should be limited to authorized roles and information should be shared only through approved channels.
Year-End Payroll Scam
Fraud timed around W-2 preparation, tax filing, bonuses, or holiday staffing. Criminals exploit deadlines and reduced coverage, so verification and backup approvers are especially important.
Zero Trust
A security approach that verifies each request and limits access instead of assuming a user or device is safe. For employers, it supports tighter control of HR, payroll, benefits, and remote access.
Important: This glossary provides general educational information, not legal, tax, insurance, or cybersecurity advice. Requirements vary by location, industry, workforce, and the data your organization handles.
Helpful HR News
Related employer guidance
How a Strong Payroll Process Helps Prevent Costly Compliance Mistakes
See how consistent payroll controls reduce errors, compliance exposure, and operational risk.
Why Payroll Compliance Should Be Reviewed Before Problems Surface
Learn why proactive payroll reviews are more effective than correcting issues after employees or regulators identify them.
Why Employee Training Fails Without Real-World Application
Explore practical ways to turn policies and training into repeatable workplace behavior.
Strengthen Your Workplace Practices
Employer's Guardian helps employers improve HR, payroll, compliance, safety, and workforce practices - the same operational foundations that make fraud and data incidents easier to prevent and manage.