Building cyber-resilient payroll systems in government
Rapeepong Puttakumwong via Getty Images
COMMENTARY | Cybersecurity needs to be built into everything that keeps government running, especially as payroll is one of the most critical systems in operation.
Payroll systems don’t usually make headlines, but in 2024, the State Department warned employees about a payroll fraud scheme where cybercriminals posed as staff to reroute direct deposits.
It started with spoofed emails that looked like they came from real employees and retirees, and some included fake 1099 forms loaded with malware. The goal was simple: Get in, change payment instructions, and disappear before anyone noticed.
It’s a sharp reminder that payroll is a high-value target. Essential, but vulnerable.
What the Threat Landscape Looks Like Now
Cybercriminals are increasingly targeting payroll and HR platforms because they know exactly what’s inside: credentials, Social Security numbers and bank details — prime ingredients for identity theft. Phishing attacks are the most common, but business email compromise is also rising. In these cases, attackers impersonate vendors or internal departments to reroute funds or gain access to sensitive files.
And while external threats get the most attention, internal risks shouldn’t be overlooked. Overly broad access or outdated permissions can lead to accidental exposure or worse. Then there are third-party tools that connect to payroll systems, like file transfer software or benefits integrations. These add convenience but also risk.
Take the 2023 MOVEit breach, for example. A vulnerability in a file transfer tool allowed attackers to steal sensitive data from government contractors, including personal information tied to Medicare. The breach showed just how damaging a weak link in the software supply chain can be.
Core Cybersecurity Measures Every Payroll System Needs
There’s no single fix for these risks, but there are clear priorities. Multi-factor authentication should be standard for everyone with access to payroll platforms, especially admin users. Role-based access controls help limit exposure and keep users from seeing more than they need to.
Encryption is critical, with masking and tokenization adding protection. Agencies should scan for vulnerabilities, log activity, and flag unusual access.
The good news is that there are solid frameworks out there. The National Institute of Standards and Technology’s Cybersecurity Framework and the CIS Controls give agencies clear starting points. The latest NIST update even highlights the need to embed cybersecurity into HR practices like employee onboarding, offboarding, and system deprovisioning. That’s especially important when payroll and HR platforms overlap, as they often do.
Security vs. Compliance: Where Agencies Get Stuck
Just because a system checks the compliance boxes doesn’t mean it’s secure. Some legacy platforms technically meet Federal Information Security Modernization Act or Fair Labor Standards Act standards, but still rely on outdated security protocols or lack support for basic protections like MFA.
Another common issue is access sprawl: giving employees more permissions than they need “just in case.” It may help in the short term but makes lateral attacks easier. The best approach is one where IT, HR and compliance teams work together — not separately — to close these gaps.
Why it’s Hard to Fix but Worth it
Upgrading payroll is tough. Legacy systems, limited budgets and staffing gaps all slow progress. But the risk of doing nothing keeps growing. As more agencies move to cloud-based systems, there’s a real opportunity to rethink not just how payroll works but how it’s secured. Modern platforms offer stronger baselines and make it easier to adopt tools like MFA, encryption, and behavioral monitoring.
At its core, payroll is personal. It touches every employee in the agency. When it breaks down, people feel it fast.
That’s why cybersecurity shouldn’t stop at the perimeter or the server room. It needs to extend into the systems that keep the government workforce running. Treat payroll like the critical system it is, and you’ll be protecting more than just data. You’ll be protecting trust.
Linda Jones, SHRM-CP, is the Vice President of Administration and a Board Member at Software Solutions Inc., where she has provided leadership for nearly 20 years. In her role, Linda oversees human resources, facilities management, vendor negotiations, and special projects.