People cause, and prevent, most security incidents. An HR security policy makes sure the right people join, understand their duties while they work for you, and leave without taking access or data with them.
In ISO 27001:2013, this was Annex A.7 “Human resource security”. The 2022 edition moved it into a dedicated theme called People controls (section 6). This guide explains each control and how to put it into practice with your HR team.
Free tool: Need a starting point? Our security policy generator creates 7 information security policies aligned with ISO 27001, the DPDP Act and CERT-In.
Mapping: A.7 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.7.1.1 Screening | 6.1 Screening |
| A.7.1.2 Terms and conditions of employment | 6.2 Terms and conditions of employment |
| A.7.2.1 Management responsibilities | 5.4 Management responsibilities |
| A.7.2.2 Awareness, education and training | 6.3 Information security awareness, education and training |
| A.7.2.3 Disciplinary process | 6.4 Disciplinary process |
| A.7.3.1 Termination or change of employment responsibilities | 6.5 Responsibilities after termination or change of employment |
| A.13.2.4 Confidentiality or non-disclosure agreements | 6.6 Confidentiality or non-disclosure agreements |
Before employment
6.1 Screening
Check candidates before they join, in proportion to the role and the information they will access. Typical checks include identity, education, previous employment and references. For sensitive roles, such as finance or system administration, you may add criminal record or credit checks.
However, screening must follow local law and the candidate’s consent. In India, for example, collecting personal data for background checks falls under the DPDP Act, so tell candidates what you collect and why. Also screen contractors, either directly or through the agency’s contract.
6.2 Terms and conditions of employment
Next, write security duties into contracts. The employment agreement should cover:
- confidentiality and acceptable use of information;
- the employee’s responsibility to follow security policies;
- ownership of intellectual property;
- duties that continue after employment ends;
- consequences of breaching security rules.
During employment
5.4 Management responsibilities
Managers must require their teams to follow security policies. In practice, this means leading by example, giving people time for training and acting when rules are broken. As a result, security becomes part of normal work, not an IT side project.
6.3 Awareness, education and training
Then give everyone training that fits their role:
- Induction: basic rules, reporting incidents and phishing awareness before system access.
- Annual refresher: updates on policies and current threats.
- Role-based training: secure coding for developers, fraud awareness for finance, privacy for HR.
- Ongoing reminders: phishing simulations, short videos and posters.
Keep attendance and test records. Auditors will ask for them, and they also show where people struggle.
6.4 Disciplinary process
You need a formal, fair process for security breaches. It should consider intent, impact and whether the breach was repeated. For example, clicking a phishing link once should lead to coaching, not dismissal. On the other hand, deliberately stealing customer data is gross misconduct. Make sure HR and legal approve the process.
Leaving or changing roles
6.5 Responsibilities after termination or change of employment
This control covers two risks: leavers who keep access, and movers who collect access over time. Therefore, agree a joint HR and IT process:
- HR notifies IT of every leaver and mover, ideally automatically.
- IT removes or adjusts access by the last working day.
- The employee returns laptops, tokens, badges and documents (control 5.11).
- HR reminds the leaver of ongoing confidentiality duties.
- The manager confirms that handover of knowledge and data is complete.
6.6 Confidentiality or non-disclosure agreements
Finally, use NDAs with employees, contractors and third parties who handle confidential information. Review the templates regularly, and keep signed copies.
HR security policy checklist
- Screening rules exist for each role category and follow local law.
- Contracts include confidentiality and security duties.
- Every new joiner completes security training before getting access.
- Annual training completion is above an agreed target, such as 95%.
- A documented disciplinary process covers security breaches.
- Leavers lose access by their last day, with evidence.
- Signed NDAs are on file for staff and contractors.
What auditors usually find
The most common finding is late access removal. For instance, an auditor compares the HR leaver list with active accounts and finds former staff still enabled. Another frequent gap is training records that are missing for contractors.
FAQ
Does ISO 27001 require background checks?
It requires screening proportionate to the risk and allowed by law. The exact checks are your decision.
Who owns the HR security policy?
Usually HR owns it, with input from the ISMS manager and legal.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
