Protect the draft without hiding its working boundary
Encrypted storage protects files at rest, but editing can create plaintext downloads, previews, caches and recovery files. Define where managers may open drafts, where approved changes return and how the workspace is locked after each session.
HR imports a clean draft into protected storage, gives one authorized manager time-limited access, observes where the editor creates temporary files, returns the approved revision, then locks the workspace and clears residual working copies.
Run the control in five steps
- 01Create the protected workspace from the approved manifest.
- 02Grant only the assigned HR and manager roles.
- 03Test open, edit, save, close and re-lock behavior.
- 04Return approved revisions through a controlled path.
- 05Inspect downloads, recent files and temporary storage after closure.
Preserve an accountable decision trail
Record workspace ID, software version, device, authorized users, import version, unlock and closure checks, working-copy location, revision return and residue review.
Stop and investigate when
- The draft remains in Downloads after the vault is locked.
- Shared accounts obscure who edited the review.
- A password reset is assumed to recover old encrypted files.
State what the control does not prove
Does not replace provider permissions, guaranteed backup, password recovery or enterprise identity management. Validate manager assignment, provider permissions, plaintext copies, retention and recovery separately.
Performance review security questions
Is a review encrypted while it is open in an editor?
Do not assume so. Test the actual application and temporary-file path.
Should the encrypted workspace become the HR system of record?
Only if formally approved; many workflows should transfer the final review to the designated HR system.
Sources for this decision
Links support specific control decisions and do not imply endorsement.