Employee information should be published according to a business purpose and an appropriate privacy boundary. Roles and expertise can help customers, while personal numbers, detailed schedules and internal approval chains may add avoidable exposure. Review the combination of details available across company pages and staff posts rather than blaming employees for maintaining professional visibility.
01
Identify information that supports a sensitive request
Public role descriptions may reveal who approves invoices, manages payroll or controls accounts. An attacker can combine that context with a real supplier name to make an instruction plausible. NIST's phishing guidance emphasizes verification; reducing exposed detail should support that process rather than replace it with an assumption that hidden information makes a request safe.
02
Set clear, proportionate publication standards
Explain what information is appropriate for staff biographies, event posts and recruitment materials. Ask employees to remove specific unnecessary details with a clear reason and an approved alternative. Keep personal accounts under their owners' control. Provide business contact routes and a way to obtain permission before publishing client names, screenshots or internal documents.
- Review public staff pages for personal contact information.
- Remove unnecessary descriptions of privileged access or approvals.
- Check screenshots for calendars, badges and internal identifiers.
- Train staff to verify unusual requests through known channels.
03
Example of a recruitment post
A team shares a photograph of its workspace to attract applicants. Before posting, review visible whiteboards, screen content and access badges. Use an approved image that still conveys the workplace without revealing customer names or internal details. This makes the publication safer without asking everyone to stop sharing ordinary professional achievements.
Frequently asked questions
Should employees hide their job titles?
Not automatically. Titles often serve a legitimate purpose. Focus on unnecessary sensitive detail and ensure business processes remain secure even when an outsider knows who holds a role.
Can a company prevent every targeted scam this way?
No. Some relevant information is public or unavoidable. Combine sensible publication standards with authentication, independent verification and a supportive process for reporting suspicious messages without blame.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.