iso 27001 2013 a7 human resource security part 1- by software development company in india

iFour ConsultancyAnnexure A Control: 7 Human Resource Security

eCommerce solution provider India http://www.ifourtechnolab.com

1

Human Resource SecurityAs specified in numerous sources, people are said to be the weakest links in any security system.ISO 27001:2013 classifies this annexure control into following 3 control objectives:A7.1: Prior to employmentA7.2: During employmentA7.3: Termination and change of employmentEnsure that employees comply with security policies designed to protect firm, clients and workforce.Make employees aware of these company policies and procedures.Work with management to investigate and address violations in these rules.



2

Human Resource Security(continued)

Topics that serve the purpose of HR security policy:All employees who hold a temporary, fixed term or open contract, must comply with information security policy.All employees who accept their terms and conditions of employment i.e. sign a formal undertaking should abide to data protection policy.A disciplinary process shall be initiated in case employee violates these policies.Depending upon the information security requirements, company has the right to undertake additional background checks or tests to verify the suitability.The need and the method for reporting security incidents will be informed to employees.Employees leaving the organization will have their access privileges terminated and they should return all information assets and equipment.



3

A7.1 Prior to employment

Objective: To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.SubsectionsA 7.1.1: ScreeningA 7.1.2: Terms of conditions and employmentJob description should clearly articulate security roles and responsibilities.Sensitive jobs hiring should include adequate level of screening.Security roles and responsibilities mentioned in job description should determineValidation of referencesAppropriate level of background checks


eCommerce solution provider India http://www.ifourtechnolab.com4

Control: Background verification checks on All candidates for employmentContractorsThird party users should be carried out in accordance with relevant laws, regulations and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risks.Verification checks should consider privacy, protection of personal data and include these factors:Availability of acceptable character references: i.e. 1 business and 1 personal reference.Completeness and Accuracy check of applicants CV.Confirmation of academic and professional qualifications claimed by applicant.Identity check independently i.e. verification of Passport, PAN and other documentsDetailed checks Credit checks and Criminal record checks.A 7.1.1 Screening



A 7.1.1 Screening (Continued)If a job on initial appointment involves person having access to information processing facilities which include sensitive information, then organization should perform detailed checks.Criteria and Limitations for verification checks should be defined by procedures.Who is eligible to screen people?How will be verification checks be carried out?When will be the verification checks carried out?Contract with contractors and 3rd party users include roles and responsibilities for screening and notification procedures.



A 7.1.1 Screening (Continued)Different types of screening tests performed:



A 7.1.2 Terms and Conditions of employment

Control: As part of their contractual obligation, employees, contractors and third party users should agree and sign the terms and conditions of their employment contract, which should state their and the organizations responsibilities for information security.Terms and conditions should specify these points:All employees, contractors and 3rd party users should sign a confidentiality, non-disclosure agreement prior to being given access to information processing facilities.Responsibilities of the employee, contractor or third party user for the handling of information received from other companies or external parties.Responsibilities that are extended outside the organizations premises and outside normal working hours, e.g. in the case of work from home.Actions to be taken if the employee, contractor or third party user disregards the organizations security requirements.



Objective: To protect the organizations interests as part of the process of changing or terminating employment.Responsibilities should be in place to ensure an employees, contractors or third party users exit from the organization is managed.Return of all equipment and the removal of all access rights are completed when any of these leave the organization.Change of responsibilities and employments within an organization should be managed as the termination of the respective responsibility or employment.Subsection:A 7.3.1: Termination or change of employment responsibilities

A 7.3 Termination and change of employment


eCommerce solution provider India - http://www.ifourtechnolab.com9

Control: Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, communicated to the employee or contractor and enforced.HR function is generally responsible for the overall termination process and works together with the supervising manager of internal person who is leaving, to manage information security aspects.There should be a process that validates that all the institution's assets are returned at termination.There should be a process that ensures access to information assets are removed at the time of termination.

A 7.3.1 Termination and change of employment responsibilities


eCommerce solution provider India - http://www.ifourtechnolab.com10

Referenceshttp://policy.monash.edu.au/policy-bank/management/its/security-framework/chapter11.htmlhttp://smallbusiness.chron.com/role-hr-play-enforcing-security-policy-39619.htmlhttps://spaces.internet2.edu/display/2014infosecurityguide/Human+Resources+Securityhttps://www.york.ac.uk/about/departments/support-and-admin/information-services/information-policy/index/information-security%E2%80%93human-resources-policy/#tab-1http://slideplayer.com/slide/8852128/


eCommerce solution provider India - http://www.ifourtechnolab.com

11

iso 27001 2013 a7 human resource security part 1- by software development company in india

Software