Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Policy

HR Security Policy

Updated on 6 min Reviewed by: Cenedril Editorial
Clause 7.2Clause 7.3A.5.11A.6.1A.6.2A.6.3A.6.4A.6.5A.6.6 ISO 27001NIS2 Art. 21(2)(i)BSI ORP.2BSI ORP.3

The HR Security Policy accompanies every person in your organisation through the entire employment lifecycle — from the first interview to the last working day and beyond. It is the document that ensures security does not remain an IT topic but is considered at every hiring, every training session and every departure.

Six Annex A controls (A 6.1 through A 6.6) cover the full spectrum: screening, employment terms, the awareness programme, disciplinary process, offboarding and confidentiality agreements. BSI IT-Grundschutz dedicates two modules to the topic: ORP.2 (Personnel) and ORP.3 (Awareness and Training). Further down you will find the complete template.

What does this policy cover?

Imagine a new employee starts on Monday. She receives a laptop, VPN access and credentials for three internal systems on day one. Three months later, she has missed the security awareness course. A year later, she changes department but keeps all her old access. Two years later, she leaves the company — the VPN access stays active because HR and IT did not communicate.

The HR security policy prevents exactly this scenario. It defines what is checked before hiring, what happens on the first day, how ongoing training is organised, what happens when rules are broken, and how the departure process works.

Why does it matter?

The biggest risk factor in information security is people. Phishing attacks, social engineering, accidental data disclosure, lost laptops — behind each of these incidents is a person who was either not trained, not screened, or whose access rights were not revoked after departure.

ISO 27001 has given the topic its own control category for exactly this reason: the “People Controls” (A 6.1–6.6). Technical measures protect systems, but only personnel security measures protect the people who operate those systems.

The policy also has a practical side effect: it protects your organisation under employment law. Without documented screening, without confirmed security obligations and without a formal disciplinary process, enforcing consequences for violations becomes difficult.

What is in the template?

The template covers ten sections. Here are the key contents:

  • Pre-employment screening (A 6.1) — Five verification measures (references, CV, qualifications, identity, enhanced checks for sensitive roles), competence and trustworthiness assessment, mitigation when verification is incomplete (delay onboarding, restrict access), periodic re-verification
  • Employment terms (A 6.2) — Six contractual security obligations (confidentiality, legal responsibilities, asset handling, third-party information, consequences, code of conduct), structured onboarding with buddy system and checklist
  • Awareness and training (A 6.3) — Programme content (leadership commitment, rules, personal accountability, basic procedures, contact points, lessons learned), knowledge assessment after every session, four training methods (lectures, mentoring, job rotation, specialist recruitment), training schedule with target group analysis
  • Disciplinary process (A 6.4) — Four assessment criteria (nature/gravity, intent, recurrence, training status), seven escalation levels, positive reinforcement for exemplary behaviour
  • Post-termination obligations (A 6.5) — Role change = termination + re-initiation, offboarding checklist with six steps, communication process to all relevant parties
  • Confidentiality agreements (A 6.6) — Ten content elements, four personnel categories (employees, contractors, service providers, visitors), electronic signatures under eIDAS, register of active NDAs

How to roll it out

  1. 01

    Assess the current state

    Find out how screening, onboarding and offboarding actually work today. In many organisations there is an informal process that is documented nowhere. Ask HR: Is there an onboarding checklist? Are references actually checked? Is an offboarding checklist used for departures? The answers show you how far you are from the template.

  2. 02

    Get HR and IT to the same table

    The policy lives at the interface between HR and IT. HR manages contracts, training and the personnel lifecycle. IT manages access rights and systems. Without a working process between the two — especially for joining, role changes and departures — access rights stay active long after they should have been revoked.

  3. 03

    Set up the training programme

    Define target groups (all personnel, technical teams, leadership), content and frequency. The template requires at least annual refreshers plus initial training on joining. The key: every session ends with a knowledge assessment (quiz, test, practical exercise). Without this evidence, effectiveness remains unproven in an audit.

  4. 04

    Adapt the template and get approval

    Replace placeholders, remove sections that do not apply (e.g. security clearance under the German SÜG if you have no classified areas), and get the policy approved by top management. In Germany: check whether the works council has co-determination rights over monitoring aspects of training (e.g. tracking completion rates).

  5. 05

    Operationalise the offboarding process

    The template’s offboarding checklist contains six steps: return assets, revoke logical access, revoke physical access, knowledge transfer, remind of confidentiality obligations, update emergency plans. Turn this into a binding process with clear ownership — HR initiates, IT executes, line manager confirms.

Where it goes wrong in practice

From audit experience, sorted by frequency:

1. No screening records. Screening may have happened, but there is no documentation. In an audit, only what is provable counts. Without written reference checks and identity verification, the screening is considered not performed.

2. Awareness training without knowledge test. The training happened, there is an attendance list — but no evidence that the content was understood. A short test at the end of every session is the simplest way to document effectiveness.

3. Offboarding gaps. The laptop came back, but the VPN is still active. Or: the email address is deactivated, but the cloud storage account is still live. Offboarding fails almost always because of poor coordination between HR and IT.

4. External contractors without equivalent obligations. The IT service provider has full system access, but the contract contains no information security obligations. Auditors check this specifically — especially for providers with privileged access.

5. Disciplinary process exists only on paper. The policy describes seven escalation levels, but nobody has ever used them. That is not necessarily a problem (ideally you never need them). But there must be a named process owner, and line managers must know how to escalate an incident.

6. NDAs signed but never reviewed. The confidentiality agreement was signed on joining and never touched again. The template requires a register of all active NDAs and periodic review — especially relevant when roles change or new information categories are introduced.

Template: HR Security Policy

Full policy text

HR Security Policy & Procedures

.md · EN.md · DE

Document control
Owner: [POLICY_OWNER_ROLE, e.g. Information Security Officer]
Approved by: [APPROVER_NAME_AND_ROLE]
Version: [VERSION]
Effective date: [EFFECTIVE_DATE]
Next review: [NEXT_REVIEW_DATE]

1. Legal/Regulatory Basis

ISO/IEC 27001:2022 / ISO/IEC 27002:2022, Annex A — People Controls:

  • A 6.1 — Screening
  • A 6.2 — Terms and Conditions of Employment
  • A 6.3 — Information Security Awareness, Education and Training
  • A 6.4 — Disciplinary Process
  • A 6.5 — Responsibilities After Termination or Change of Employment
  • A 6.6 — Confidentiality or Non-Disclosure Agreements

BSI IT-Grundschutz:

  • ORP.2.A7 (Verification of Trustworthiness), ORP.2.A13 (Security Vetting)
  • ORP.2.A1 (Onboarding), ORP.2.A4 (External Personnel), ORP.2.A5 (NDAs), ORP.2.A14 (Duties & Responsibilities)
  • ORP.3 (Awareness & Training Programme)
  • ISMS.1.A8 (Handling of Security Incidents)
  • ORP.2.A2 (Offboarding Procedures)
  • CON.9.A9 (Confidentiality Agreements)

Additional jurisdiction-specific laws — in particular labour law, data protection law (GDPR), security vetting legislation and works council co-determination rules — are listed in the Legal Register and incorporated by reference.

2. Purpose & Scope

This policy establishes the information security requirements for personnel management at [YOUR_ORGANISATION_NAME]. It covers all phases of the employment lifecycle — from pre-employment screening through onboarding, ongoing awareness and training, to termination or change of responsibilities.

This policy applies to:

  • All employees (permanent, temporary, part-time)
  • External personnel (contractors, consultants, temporary staff)
  • Third-party service providers with access to organisational information or systems

The objective is to ensure that all personnel understand their information security responsibilities and are suitable for the roles they perform, thereby reducing the risk of human-related security incidents.

3. Pre-Employment Screening (A 6.1)

Background verification checks on all candidates for employment are carried out prior to joining [YOUR_ORGANISATION_NAME]. The screening process is performed for all personnel including full-time, part-time and temporary staff. Where individuals are contracted through suppliers of services, screening requirements are included in the contractual agreements between the organisation and the suppliers. The depth of screening is proportionate to the sensitivity of the role, the classification of information to be accessed and applicable legal requirements.

Information on all candidates is collected and handled taking into consideration applicable privacy and data protection legislation. Where required by law, candidates are informed beforehand about the screening activities.

3.1 Verification Measures

  • References: Availability of satisfactory character and professional references is verified (e.g. one professional, one personal reference).
  • Curriculum Vitae: The applicant's CV is reviewed for completeness, plausibility and correctness. Gaps or inconsistencies are clarified.
  • Qualifications: Claimed academic and professional qualifications are confirmed through original certificates, transcripts or direct verification with issuing institutions.
  • Identity Verification: Independent identity verification is carried out using a government-issued photo ID (passport, national ID card).
  • Enhanced Verification: For roles involving access to highly sensitive or classified information — including on promotion — additional checks are conducted (e.g. credit checks, criminal record checks, security clearance as per the applicable Security Clearance Act where relevant).

3.2 Competence & Trustworthiness

  • Competence Assessment: Candidates demonstrate that they possess the necessary competence to fulfil the security responsibilities of the role, particularly for positions with elevated access privileges.
  • Trustworthiness Assessment: The overall trustworthiness of the candidate is evaluated, especially for critical or sensitive roles. This includes assessing the plausibility and consistency of all submitted documentation.

3.3 Mitigation When Verification Is Incomplete

  • Delayed Onboarding: If background verification cannot be completed before the intended start date, onboarding is postponed until results are available.
  • Restricted Asset Deployment: Deployment of corporate assets (laptops, access badges, keys) is delayed until verification is complete.
  • Reduced Access: The new employee is onboarded with restricted access rights until verification results are satisfactory.
  • Termination: If verification results are unsatisfactory, [YOUR_ORGANISATION_NAME] reserves the right to terminate the employment relationship in accordance with applicable law.

3.4 Periodic Re-Verification

Verification checks are repeated periodically to confirm ongoing suitability of personnel, depending on the criticality of a person's role.

4. Terms & Conditions of Employment (A 6.2)

Employment contracts and agreements for all personnel at [YOUR_ORGANISATION_NAME] clearly state the individual's and the organisation's responsibilities for information security. These obligations are communicated and acknowledged before access to information or systems is granted. Information security roles and responsibilities are communicated to candidates during the pre-employment process.

4.1 Contractual Security Obligations

  • Confidentiality & Non-Disclosure: All personnel sign a confidentiality or non-disclosure agreement before being granted access to [YOUR_ORGANISATION_NAME]'s information assets. This agreement remains in effect during and after employment (see Section 8 on Confidentiality Agreements).
  • Legal Responsibilities: Personnel are informed of their legal responsibilities and rights regarding copyright, data protection legislation and other applicable regulations.
  • Asset & Classification Responsibilities: The employment terms specify the individual's responsibilities for handling information according to the organisation's classification scheme and for proper management of assigned assets.
  • Third-Party Information: Responsibilities for handling information received from or on behalf of interested parties (customers, partners, regulators) are documented in the employment agreement.
  • Consequences of Non-Compliance: The terms clearly state the actions to be taken if personnel disregard the organisation's security requirements, including reference to the disciplinary process.
  • Code of Conduct: A code of conduct covering information security and privacy responsibilities is provided to all personnel. Acknowledgement of the code is documented.

4.2 Onboarding Process

Upon joining, all new employees and external personnel receive a structured onboarding that includes:

  • Presentation of applicable policies, guidelines and procedures
  • Assignment of an onboarding mentor ("buddy") who serves as initial point of contact
  • Completion of a mandatory onboarding checklist covering security topics
  • Initial information security awareness briefing

4.3 Continuity & Review

Where appropriate, responsibilities contained within the terms and conditions of employment continue for a defined period after the end of the employment (see Section 7 on Termination below). The terms and conditions concerning information security are reviewed when laws, regulations, the information security policy or topic-specific policies change.

Where personnel are provided through an external party (e.g. through a supplier), the external party is required to enter into contractual agreements on behalf of the contracted individual that include equivalent information security obligations.

5. Information Security Awareness, Education & Training (A 6.3)

All personnel of [YOUR_ORGANISATION_NAME] receive appropriate information security awareness, education and training, and are kept informed of relevant updates to the organisation's policies and procedures. The awareness, education and training programme is established in line with the organisation's information security policy and relevant topic-specific policies, taking into consideration the information to be protected and the controls that have been implemented.

Initial awareness, education and training applies to new personnel and to those who transfer to new positions or roles with substantially different information security requirements. The programme takes place periodically thereafter.

5.1 Awareness Programme Content

The awareness programme covers general aspects including:

  • Management Commitment: The awareness programme communicates management's commitment to information security. Leadership actively supports and visibly champions security initiatives.
  • Rules & Obligations: Personnel are made familiar with all applicable information security rules, policies and their personal obligations for compliance.
  • Personal Accountability: The programme emphasises personal accountability for one's own actions and inactions and the responsibility to protect organisational information.
  • Basic Security Procedures: Basic security procedures (password management, clean desk, screen locking, phishing awareness, social engineering) and baseline controls relevant to the individual's role are covered.
  • Contact Points: Contact points and resources for additional information, advice and reporting (e.g. Information Security Officer, IT Helpdesk, incident reporting channels) are communicated.
  • Lessons Learned: Relevant lessons learned from past information security incidents (anonymised) are incorporated into the awareness programme to illustrate real-world risks and consequences.
  • Knowledge Assessment: At the end of awareness or training activities, a knowledge assessment (quiz, test or practical exercise) is conducted to verify the effectiveness of the training.

The programme includes awareness-raising activities via appropriate channels such as campaigns, booklets, posters, newsletters, websites, information sessions, briefings, e-learning modules and emails. The programme focuses not only on the "what" and "how", but also the "why" — it is important that personnel understand the aim of information security and the potential effect of their own behaviour on the organisation.

The training programme incorporates anonymised incident examples to illustrate real-world scenarios. Training covers incident reporting procedures, vulnerability recognition and threat awareness to enable personnel to identify and escalate potential security events effectively.

5.2 Education & Training Methods

The organisation identifies, prepares and implements an appropriate training plan for technical teams whose roles require specific skill sets and expertise. The education and training programme consists of the following forms:

  • Lectures & Self-Study: Structured training sessions (in-person or online) and self-study materials are provided. E-learning modules are acceptable where they include interactive elements and assessments.
  • Mentoring & On-the-Job Training: Expert staff or external consultants provide mentoring and on-the-job training for personnel in specialised security roles.
  • Job Rotation: Where feasible, staff are rotated through different activities to broaden their understanding of information security across the organisation.
  • Specialist Recruitment: For highly specialised security functions, the organisation recruits skilled professionals or engages external consultants with the required expertise.

Training and education can use different means of delivery including classroom-based, distance learning, web-based, self-paced and other formats. Information security awareness, education and training can be part of, or conducted in collaboration with, other activities (e.g. general information management, ICT, safety training).

5.3 Continuous Professional Development

  • Information Sources: The organisation subscribes to relevant security newsletters, bulletins and professional publications to stay informed about emerging threats and best practices.
  • Conferences & Events: Key personnel (ISOs, IT security staff) attend relevant conferences, workshops and professional events to maintain and improve their competencies.

5.4 Training Schedule & Records

The organisation maintains a training schedule that defines:

  • Target groups and their specific training needs (based on a target group analysis)
  • Training frequency (initial onboarding training plus periodic refresher, at least annually)
  • Training content and delivery method per target group
  • Responsibility for training delivery and coordination

Records of all training activities (attendance, completion, assessment results) are maintained as evidence for audit purposes. The learning outcomes are measured and evaluated (quantitatively and qualitatively) to determine whether the programme's objectives have been achieved. The results feed into the improvement of the awareness and training offering.

6. Disciplinary Process (A 6.4)

A formal disciplinary process is established and communicated to all personnel of [YOUR_ORGANISATION_NAME]. This process is not initiated without prior verification that an information security policy violation has occurred. The disciplinary process also serves as a deterrent to prevent personnel from violating the information security policy and related procedures.

6.1 Assessment Criteria

Before initiating disciplinary action, the following factors are assessed:

  • Nature & Gravity: The nature and gravity of the breach and its impact on the organisation are evaluated, including potential business, legal and reputational consequences.
  • Intent: Whether the offence was intentional (malicious or deliberate disregard) or unintentional (negligent, accidental, due to insufficient training).
  • Recurrence: Whether this is a first offence or a repeated violation by the same individual.
  • Training Status: Whether the individual had received adequate training and was aware of the relevant policies and their obligations at the time of the breach.

6.2 Escalation Levels

Depending on the severity and circumstances, disciplinary measures include (in order of escalation):

  • Verbal warning and documented discussion
  • Written warning with documented corrective actions
  • Temporary suspension of access rights
  • Mandatory additional training
  • Formal disciplinary hearing
  • Termination of employment or contract (in accordance with labour law)
  • Legal proceedings (in cases of criminal activity)

Deliberate information security policy violations require immediate action. The disciplinary process complies with applicable national labour law, statutory, regulatory and contractual requirements. Legal counsel and/or HR are involved in all formal disciplinary actions.

6.3 Additional Provisions

  • Identity Protection: Where possible, the identity of individuals subject to disciplinary action is protected in line with applicable data protection requirements.
  • Positive Reinforcement: When individuals demonstrate excellent behaviour with regard to information security, they can be rewarded to promote information security awareness and encourage good behaviour.

7. Responsibilities After Termination or Change of Employment (A 6.5)

The process for managing termination or change of employment at [YOUR_ORGANISATION_NAME] defines which information security responsibilities and duties remain valid after termination or change. This includes confidentiality of information, intellectual property and other knowledge obtained, as well as responsibilities contained within any other confidentiality agreement. Responsibilities still valid after termination of employment or contract are contained in the individual's terms and conditions of employment.

  • Change as Termination + Re-Initiation: Changes of responsibility or employment within the organisation are managed as a combination of a termination of the old assignment and initiation of the new one. This ensures that access rights, asset assignments and security responsibilities are properly updated.
  • Role Transfer: When a person leaves a position, all information security roles and responsibilities assigned to that individual are identified and transferred to a designated successor. The organisation maintains up-to-date emergency and continuity plans reflecting current personnel assignments.
  • Communication of Changes: A communication process is established to notify all relevant parties (HR, IT, facilities, management, external partners) of changes to personnel and their access rights.
  • External Personnel: The termination or change process also applies to external personnel (contractors, consultants, supplier staff). In the case of personnel provided through an external party, the termination process is undertaken by the external party in accordance with the contract between the organisation and the external party.

The human resources function is responsible for the overall termination process and works together with the supervising manager to manage the information security aspects of the relevant procedures.

7.1 Offboarding Checklist

Upon departure, the following steps are completed:

  • Return of all corporate assets (laptop, mobile devices, access badges, keys, parking permits)
  • Revocation of all logical access rights (user accounts, VPN, email, cloud services)
  • Revocation of physical access rights (building access, secure areas)
  • Knowledge transfer and handover documentation
  • Reminder of continuing obligations (confidentiality agreements, non-compete clauses)
  • Update of emergency plans, distribution lists and organisational charts

8. Confidentiality & Non-Disclosure Agreements (A 6.6)

Confidentiality or non-disclosure agreements (NDAs) reflecting [YOUR_ORGANISATION_NAME]'s requirements for the protection of information are identified, documented, regularly reviewed and signed by all relevant personnel and external parties before they are granted access to confidential information. The agreements address the requirement to protect confidential information using legally enforceable terms. Based on the organisation's information security requirements, the terms in the agreements are determined by taking into consideration the type of information handled, its classification level, its use and the permissible access by the other party.

8.1 Agreement Content

Each confidentiality agreement addresses the following elements, as applicable:

  • Scope of Protected Information: A clear definition of the information to be protected, including categories, classification levels and examples.
  • Duration: The expected duration of the agreement, including whether it is indefinite or time-limited, and the period of obligations after the end of the employment or contractual relationship.
  • Termination Actions: Required actions when the agreement is terminated, including secure return or destruction of confidential materials.
  • Disclosure Prevention: Responsibilities and actions of the signatory to prevent unauthorised disclosure of information (e.g. need-to-know principle, secure storage, encryption requirements).
  • Intellectual Property: Ownership of information, trade secrets and intellectual property and how these relate to the protection of confidential information.
  • Permitted Use: The permitted use of confidential information and the rights of the signatory to use information within the boundaries of the agreement.
  • Audit & Monitoring Rights: The right of the organisation to audit and monitor activities that involve confidential information.
  • Breach Notification: The process for notification and reporting of unauthorised disclosure or suspected breaches of confidentiality.
  • Return & Destruction: Terms for the return or certified destruction of information at agreement cessation, including digital and physical copies.
  • Non-Compliance Consequences: Expected actions in case of non-compliance with the agreement, including potential legal remedies and liability.

8.2 Applicability

Confidentiality agreements are required for:

  • All employees at the time of hiring (as part of the employment contract or as a separate agreement)
  • External personnel (contractors, consultants, temporary workers) before they access organisational information
  • Third-party service providers and business partners as part of contractual arrangements
  • Visitors who require access to sensitive areas or information (project-specific NDAs)

8.3 Signing Process

[YOUR_ORGANISATION_NAME] uses an advanced electronic signature process (e.g. in accordance with eIDAS Article 26) to obtain legally binding signatures on confidentiality agreements. The process includes identity verification, cryptographic document integrity protection and a tamper-evident audit trail capturing all signing events including timestamps and device information. Signed agreements are automatically archived as compliance records within the document management system.

8.4 Compliance & Review

The organisation takes into consideration the compliance with confidentiality and non-disclosure agreements for the jurisdiction(s) to which they apply. Requirements for confidentiality and non-disclosure agreements are reviewed periodically and when changes occur that influence these requirements. A register of all active confidentiality agreements is maintained to ensure agreements remain current and adequate.

9. Roles & Responsibilities

  • Top Management: Provides resources, sets the tone, and ensures this policy is enforced across the organisation.
  • Human Resources (HR): Implements screening, manages employment contracts, coordinates onboarding/offboarding, maintains training records.
  • Information Security Officer (ISO): Defines security requirements for personnel, designs awareness programme, monitors compliance, escalates breaches.
  • Line Managers: Ensure their team members comply with this policy, support training participation, initiate disciplinary process when needed.
  • IT Department: Manages logical access provisioning and revocation in coordination with HR.
  • All Personnel: Comply with this policy, participate in training, report security incidents and protect organisational information.

10. Review & Maintenance

This policy is reviewed:

  • At least annually as part of the ISMS management review cycle.
  • After significant organisational changes (restructuring, mergers, changes in applicable law).
  • After significant security incidents involving personnel.
  • When changes in the threat landscape require updated personnel security measures.

Sources

ISO 27001 Controls Covered

Clause 7.2 Competence Clause 7.3 Awareness A.5.11 Return of assets A.6.1 Screening A.6.2 Terms and conditions of employment A.6.3 Information security awareness, education and training A.6.4 Disciplinary process A.6.5 Responsibilities after termination or change of employment A.6.6 Confidentiality or non-disclosure agreements

Frequently asked questions

Do I really need to screen every applicant?

Yes. ISO 27001, A 6.1 requires background verification for all candidates — including part-time and temporary staff. The depth of screening is proportionate to the role: references, CV verification and identity checks are the minimum. Enhanced checks (credit history, criminal record, security clearance) apply to roles with access to highly sensitive data.

What is the buddy in the onboarding process?

Our template provides for an onboarding mentor (“buddy”) as the first point of contact for new hires. The buddy answers everyday questions, explains internal processes and makes sure security topics do not get lost in the information overload of the first working day. ISO does not mandate a buddy — but in practice it is one of the most effective measures against onboarding gaps.

Is one annual training session enough?

That is the minimum. A 6.3 requires initial training on joining and periodic refreshers. Annual is the floor, but the template also recommends event-driven training (after incidents, when new threats emerge) and knowledge assessments at the end of every session. A quiz or test is the simplest way to demonstrate effectiveness — and auditors ask for it.

What does the disciplinary process contain?

The template defines seven escalation levels: from a verbal warning through temporary access suspension and mandatory retraining to termination and legal proceedings. Before any measure, four criteria are assessed: nature and gravity of the breach, intent, recurrence and training status. Without this assessment, any disciplinary action becomes legally vulnerable.

Do I need the policy for external contractors too?

Yes. The template explicitly covers contractors, consultants and temporary workers. For external personnel provided through service providers, equivalent information security obligations must be included in the supplier contract. Auditors check this specifically — especially for IT service providers with system access.

What happens when someone leaves?

The template contains an offboarding checklist with six steps: return assets, revoke logical access, revoke physical access, knowledge transfer, remind of continuing confidentiality obligations, update emergency plans. Additionally, every internal role change is treated as a termination of the old assignment plus initiation of the new one — so no rights are left behind.