Internal comms tool security checklist: what IT should check before approving one

An internal comms tool security checklist is the set of questions IT uses to decide whether a platform that reads employee data and sends messages in the company’s name is safe to approve. These tools touch more than most. They read names, roles, locations and phone numbers from the HRIS, send on the company’s behalf, and increasingly use AI to draft.

The request usually arrives with a deadline, because HR has a rollout coming. This playbook gives you the checklist and the order to work through it. For the buyer’s side of the same decision, see our guide to choosing an internal communications platform.

Why do security reviews of comms tools drag on?

Security reviews of comms tools drag on when IT hears about the purchase late and then chases the vendor for evidence one question at a time.

• HR picks the tool first. IT hears about it after the demo, with a launch date already set.
• Evidence arrives in pieces. A questionnaire goes out, answers trickle back, and each one raises another question.
• The data flows aren’t mapped. Nobody has written down which HRIS fields the tool reads or where messages are stored.
• AI features are new ground. Few review templates cover what an AI drafting tool can see and send.

What does a fast, safe approval look like?

A fast, safe approval is one where IT has every answer and document it needs in the first week, and can name the risks it accepted.

• Certification reports in hand, not just logos on a website.
• Sign-in set up through your own identity provider, with admin roles agreed.
• A list of which employee fields the tool reads, and why.
• Data location and encryption confirmed in writing.
• A clear answer on what the AI can access and whether anything sends without a person approving it.
• A named owner on the HR side for permissions and approvals.

The internal comms tool security checklist, in 6 steps

Work through these in order. The first two settle most of the risk, and the rest confirm the details.

Step 1 (day 1): Ask for certifications and the trust center

Ask for current SOC 2 and ISO 27001 reports and the vendor’s GDPR position. Logos aren’t evidence. A trust center where you can request documents such as policies, a sub-processor list and internal assessment results saves weeks of back and forth.

Step 2 (days 1 to 3): Check identity and access

Confirm the tool supports single sign-on through your identity provider over SAML or OAuth, and whether it offers two-factor authentication and SCIM provisioning. Then look at roles: who can draft, who can approve and who can send to which audiences.

Step 3 (days 3 to 5): Map the data

List the HRIS and directory fields the tool will read, such as name, role, location, manager, start date and mobile number. Ask where the data is stored, whether it’s encrypted in transit and at rest, and which regions it can stay in. Ask for a written data list if the vendor has one.

Step 4 (days 3 to 5): Review the integrations

Check how the tool connects to your HRIS, Active Directory, email, Teams and Slack. Standard APIs you can monitor and revoke beat spreadsheet uploads and shared accounts. A vendor should publish which systems it supports, as ChangeEngine does on its HRIS and channel integrations page. Check, too, whether anything needs installing on devices or hosting on your side.

Step 5 (week 1): Ask how the AI is governed

If the tool drafts with AI, ask what data the model can see, where content is generated, whether your data is used to train models, and whether anything can send without a person approving it. Ask for the vendor’s AI privacy documentation in writing.

Step 6 (week 2): Agree the operating rules, then approve

Write down who owns admin access, how approvals work, how consent and opt-outs are handled for messages to personal phones, and what happens to your data if you leave. Record the risks you accepted, then approve.

Which questions should you send the vendor?

Send the vendor every question in one go, before the first call, so the answers shape the review instead of dripping into it.

• Can you share current SOC 2 and ISO 27001 reports and your sub-processor list?
• Do you support SSO over SAML or OAuth, two-factor authentication and SCIM?
• Which HRIS and directory fields do you read, and can we limit them?
• Where is our data stored, and is it encrypted in transit and at rest?
• What can your AI features access, and can anything send without approval?
• Is there anything to install on employee devices?
• What does your SLA cover, and do you hold cyber insurance?

How do you show the review was done properly?

A good review leaves a record: the evidence you collected, the answers you got and the risks you accepted.

Keep the certification reports, questionnaire answers and data map with the approval, and note the dates, because certifications and reports expire. Set a reminder to check again at renewal, and whenever the vendor adds a feature that reads new data or uses AI in a new way.

Agree with HR who reviews admin access each quarter. Permissions tend to drift as people change roles, so a short regular check matters more than a long one-off review.

Common worries, and what to do about them

“HR needs this live next month.”

Then send the questions on day one. A vendor with a trust center and standard answers can close the evidence part of a review fast. If they can’t, that tells you something too.

“We can’t have messages going to personal phones.”

That’s a policy question as much as a security one. Agree the rules with HR and legal: consent, opt-outs, quiet hours and what content is allowed by text. Some sectors restrict it, so settle this before the tool is configured.

“AI tools could leak employee data.”

Ask exactly what the AI can see and where it runs. Look for content generated inside the vendor’s environment, actions limited to the signed-in user’s permissions, and a person approving before anything sends.

How ChangeEngine answers the checklist

ChangeEngine is SOC 2 and ISO 27001 certified and GDPR compliant, with documentation ready in its Trust Center.

Single sign-on runs over SAML or OAuth with optional two-factor authentication, and SCIM provisioning is supported. Data is encrypted in transit and at rest, with data residency in the US, EU or Canada, and content is generated inside your ChangeEngine environment. Role-based permissions and approval steps decide who can draft, approve and send, and the ChangeEngine MCP acts with the signed-in user’s permissions, so nothing sends without an approval.

Integrations run through standard APIs to Workday, ADP, BambooHR, UKG and 75+ other HRIS, plus Active Directory, Outlook, Teams, Slack and SharePoint. There’s nothing to install on devices, no app to push and nothing to host. Request documents such as the sub-processor list, AI privacy FAQ and network diagram from the ChangeEngine Trust Center, and see the full IT view on the ChangeEngine for IT page.