Their HR sync feature is supposed to automate training assignments for ISO 27001. It works, but only after you configure it correctly. The default settings will assign irrelevant training modules.
Key steps to lock it down:
* Map your HRIS `department` or `location` fields directly to specific ISO 27001 training modules in Secureframe.
* Use employee `start_date` for auto-assigning onboarding security training.
* Set up a separate "All Employees" policy for annual security awareness refreshers.
Here's a sample mapping config I used for BambooHR:
```yaml
training_mappings:
- hris_field: "department"
hris_value: "Engineering"
secureframe_policy: "Secure Development Policy"
secureframe_module: "Secure Coding Practices"
- hris_field: "department"
hris_value: "Finance"
secureframe_policy: "Data Handling Policy"
secureframe_module: "Protecting Financial Data"
- hris_field: "start_date"
action: "assign_on_hire"
secureframe_policy: "Information Security Onboarding"
delay_days: 1
```
Without this, new engineers get finance training. Sync runs nightly. You still need to manually manage contractors.
- bench_beast
Benchmarks don't lie.
Oh, mapping the HRIS fields directly is the key. That config snippet is super helpful, especially the `delay_days: 1` trick for onboarding. I'd add one more thing: double-check your sync frequency for terminations.
> Sync runs nightly.
This means a termed employee could have access to assigned training for a full day. For ISO 27001, you might need a more immediate revocation trigger. We had to set up a separate webhook from our HRIS to deprovision training access instantly, because the nightly sync wasn't fast enough for our auditor's liking 😅
Also, for the "All Employees" annual refresher, remember to exclude contractors if they're in your HRIS. We got burned on that once.
Yeah, you're absolutely right about the default settings being a trap. The out-of-the-box mapping logic is way too broad, and you end up with a compliance headache where everyone's assigned the wrong modules.
Your point about manually managing contractors hits home. We learned the hard way that you can't rely on the HR sync for them at all. We had a contractor's assignment expire, the sync tried to re-assign them based on their department, but they weren't in the "All Employees" annual policy group. It created a gap in their training record that our auditor flagged. Now we handle all contractors as a separate, manual cohort outside the sync logic.
That BambooHR config snippet is gold, by the way. The `delay_days: 1` is a small but critical touch for letting the HRIS record settle.
Implementation is 80% process, 20% tool.
That contractor gap is a perfect example of why you can't treat HR sync as a set-it-and-forget-it system. It's a logic engine, and you need to build the exceptions into the rules.
You need a field in your HRIS to explicitly tag employee type (FTE, contractor, intern). Then map your "All Employees" policy to only sync where `employee_type == "FTE"`. Most companies skip that and rely on manual groups, which creates audit drift over time.
The delay_days config is useful, but check if it applies to termination syncs too. If it does, that's another point of failure for immediate access revocation.
VendorNegotiator