A.7

In ISO/IEC 27001, human resources (HR) security refers to the controls that are put in place to protect the organisations information assets from security risks associated with its employees, contractors, and other third-party workers. This includes risks related to the recruitment, training, and management of staff, as well as risks related to the termination of staff.

Human resources security controls typically include the following:

  1. Background checking: Conducting background checks on new employees and contractors to ensure they are suitable for the position and do not pose a security risk.
  2. Job role definition: Defining the security responsibilities of each job role and ensuring that employees understand their responsibilities and obligations.
  3. Security awareness training: Providing security awareness training to all employees and contractors to ensure they understand their responsibilities and are aware of the latest threats and vulnerabilities.
  4. Access controls: Restricting access to the organisations information assets to only those employees who need it to perform their job duties.
  5. Exit management: Managing the process of terminating employees or contractors, including the return of company property and the revocation of access to company systems.
  6. Incident management: Having incident management processes in place to detect and respond to security incidents, in which employees might be involved.
  7. Non-disclosure agreements: Requiring employees and contractors to sign non-disclosure agreements to prevent the unauthorised disclosure of confidential information.

It's important to remember that human resources security is not just a one-time process but rather an ongoing effort, that should be part of the overall ISMS. It should be integrated with the other controls and process, such as access control, incident management and compliance.

Regular review of the human resources security controls, should be conducted, and updated as necessary, to make sure it is still effective and relevant. Also, it is important to communicate and create a security culture in the organisation that promotes compliance with the HR security controls.

‍

More from our security wiki

Continuous learning for your organisation, our knowledge base to help you grow

Cyber Essentials Self Assessment: Password-Based Authentication
This security wiki provides guidelines for implementing password-based authentication practices within your organisation. Follow these recommendations to enhance the security of user accounts and protect against unauthorised access.
Cyber Essentials Self Assessment: Administrative Accounts
This security wiki provides guidelines for the proper management and control of administrative accounts within your organisation. Follow these recommendations to establish secure administrative account practices.
Cyber Essentials Self Assessment: Malware Protection
This security wiki provides guidelines for implementing malware protection measures across your organisation's devices. Follow these recommendations to safeguard your desktop computers, laptops, tablets, and mobile phones from malware threats.
Cyber Essentials Self Assessment: Security Update Management
This security wiki provides guidelines for effective security update management to ensure that your organisation's devices and software remain protected against known vulnerabilities. Follow the recommendations below to establish a robust security update management process.
Cyber Essentials Self Assessment: Device Locking
This security wiki provides guidelines for implementing device locking mechanisms to enhance the security of your organisation's devices. Follow the recommendations below to protect against unauthorised access to software and services.
Cyber Essentials Self Assessment: Secure Configuration
This security wiki provides guidelines for achieving secure configuration of devices and services within your organisation. Follow the recommendations below to minimise potential vulnerabilities and enhance the overall security posture.
Now we're partners, you have unlocked:
Threat reports
1 Vuln scan
Security Wiki
Templates
Cyber Essentials logoCyber Essentials logo
©Periculo
Your Security Partner