3. Human Resource Security

This category addresses the need to ensure that employees, contractors, and third-party users understand their information security responsibilities and are suitable for the roles they are considered for. It covers security measures that should be taken during the pre-employment, employment, and termination or change of employment phases to protect the organization's information assets.

Controls (A.7):

• A.7.1.1: Screening

• A.7.1.2: Terms and Conditions of Employment

• A.7.2.1: Management Responsibilities

• A.7.2.2: Information Security Awareness, Education, and Training

• A.7.2.3: Disciplinary Process

• A.7.3.1: Termination or Change of Employment Responsibilities

Control A.7.1.1: Screening

Audit Questions:

• Are background checks conducted on all new hires and contractors?

• What criteria are used for screening employees based on their role and access level?

• Can you provide evidence of recent screenings?

Common Non-Conformities (NC):

• Lack of documented screening procedures.

• Inconsistent application of background checks.

• Insufficient screening criteria.

Control A.7.1.2: Terms and Conditions of Employment

Audit Questions:

• Are information security responsibilities included in the terms and conditions of employment?

• How are these terms communicated and enforced?

Common Non-Conformities (NC):

• Information security responsibilities not included in employment terms.

• Employees unaware of their information security responsibilities.

• Lack of enforcement of these terms.

Control A.7.2.1: Management Responsibilities

Audit Questions:

• How do managers ensure that employees understand and fulfill their information security responsibilities?

• Are there regular reviews of employee performance related to information security?

Common Non-Conformities (NC):

• Managers not held accountable for ensuring employee compliance with information security.

• Lack of performance reviews related to information security.

Control A.7.2.2: Information Security Awareness, Education, and Training

Audit Questions:

• Are employees provided with regular information security awareness and training programs?

• How is the effectiveness of these programs measured?

Common Non-Conformities (NC):

• No regular information security training programs.

• Training programs not tailored to specific roles and responsibilities.

• Lack of measurement of training effectiveness.

Control A.7.2.3: Disciplinary Process

Audit Questions:

• Is there a documented disciplinary process for information security breaches?

• How is this process communicated to employees?

Common Non-Conformities (NC):

• Lack of a documented disciplinary process.

• Employees unaware of the consequences of information security breaches.

• Inconsistent application of disciplinary measures.

Control A.7.3.1: Termination or Change of Employment Responsibilities

Audit Questions:

• What procedures are in place for ensuring the secure termination or change of employment?

• Are there documented processes for revoking access and retrieving company assets?

Common Non-Conformities (NC):

• Lack of procedures for secure termination or change of employment.

• Access not revoked promptly.

• Company assets not retrieved in a timely manner.