Verify the manager and the review assignment
Encryption does not prove that the recipient is the correct manager, still assigned to the employee or using an approved device. Confirm role and assignment through the HR system, minimize the package and send any secret through a separate authenticated channel.
A reporting-line change occurs during calibration. HR pauses the handoff, verifies the new manager and approval chain, revokes the old link, prepares the current draft only and records receipt by the newly authorized reviewer.
Run the control in five steps
- 01Verify manager identity, assignment and continuing authorization.
- 02Confirm the exact employee and draft version to be shared.
- 03Use an approved destination and protected transfer method.
- 04Separate the secret or recovery material from the file channel.
- 05Record receipt, expiry, revocation and final return.
Preserve an accountable decision trail
Keep recipient, assignment source, employee/review ID, version, destination, authorization time, transfer and secret channels, receipt, expiry, revocation and exception.
Stop and investigate when
- A forwarded message becomes the authorization record.
- The password travels with the attachment.
- An old manager retains access after reassignment.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate manager assignment, provider permissions, plaintext copies, retention and recovery separately.
Performance review security questions
Does file encryption replace HR-platform permissions?
No. Manage identities, roles and provider permissions separately.
Can a shared manager mailbox receive drafts?
Only if policy explicitly authorizes it and individual accountability is preserved.
Sources for this decision
Links support specific control decisions and do not imply endorsement.