What is personnel security?

What it covers

In ISO 27001:2022, personnel security sits mainly in the people theme of Annex A, controls 6.1 to 6.8. The 2013 edition called this area human resource security. SOC 2 covers the same ground across several criteria, including people and competence in CC1 and granting and removing access in CC6. NIST SP 800-171 has a short personnel security family on screening and on protecting systems when people leave or transfer.

• Before joining. Background checks proportionate to the role, and security duties written into contracts and confidentiality agreements.
• During employment. Security awareness training, policy acknowledgement, a disciplinary process, and rules for remote working.
• On leaving or moving. Access removed on time, equipment returned, and continuing confidentiality duties confirmed.

Screening where the law allows

ISO 27001 control 6.1 asks for background checks that take account of applicable laws, regulations and ethics, and that are proportionate to the role and the information it can access. That wording matters because screening rules differ widely by country. Criminal record checks, for example, are restricted in many jurisdictions and often limited to specific roles.

A company with staff in several countries usually defines a screening standard per country and per role level, approved by legal or HR, and applies it consistently.

What auditors sample

Auditors pick a sample of joiners and leavers from the audit period and trace each one. For joiners they look for a signed contract or confidentiality agreement, evidence of screening, completed training and policy acknowledgements. For leavers they compare the leaving date with the date access was removed from each in-scope system.

Late access removal turns up in audit after audit. The fix is usually to trigger offboarding from the HR system, so access removal starts on the leaving date rather than when someone remembers.

Related terms

Access review

A periodic check, usually quarterly, that every user’s access to systems still matches their role, with removals recorded. One of the first pieces of evidence a SOC 2 or ISO 27001 auditor samples.

Policy acknowledgement

A recorded confirmation that a person has read and accepted a policy. Auditors sample acknowledgements to check that policies are communicated, not just written.

Annex A

The list of 93 reference controls in ISO 27001:2022, grouped into organisational, people, physical and technological themes. You select from it and justify every exclusion in the Statement of Applicability.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

ISMS

Information security management system: the scope, policies, risk process, controls and reviews that ISO 27001 certifies. The certificate covers the management system, not a product.