A.6.1 Screening
Background verification for candidates before they join and during employment: scaling checks to the role, the information accessed and local law, and the HR records an auditor samples to confirm screening happened.
People controls
Annex A theme 6: controls on people across the employment life cycle, from screening and contracts to awareness training, discipline, remote working and reporting security events.
A.6.2 Terms and conditions of employment
Employment contracts that state the information security responsibilities of staff and of the organization, how they tie to policy acknowledgment, and the signed agreements an auditor samples.
A.6.3 Information security awareness, education and training
Security awareness, education and training for personnel: role-based content, regular policy updates, completion tracking, and how an auditor checks that training reached everyone in scope.
A.6.4 Disciplinary process
A formal, communicated disciplinary process for personnel who breach the information security policy: what it covers, keeping it fair and proportionate, and the evidence an auditor asks for.
A.6.5 Responsibilities after termination or change of employment
Security duties that continue after someone leaves or changes role, such as confidentiality, and how offboarding and role-change procedures define, enforce and communicate them.
A.6.6 Confidentiality or non-disclosure agreements
Confidentiality and non-disclosure agreements that reflect what the organization must protect: deciding which agreements are needed, regular review, signature by staff and other parties, and audit sampling.
A.6.7 Remote working
Security measures for personnel who work remotely: policy, device and connection requirements, physical security at home or in public places, and the evidence that remote work is controlled.
A.6.8 Information security event reporting
A channel for personnel to report observed or suspected information security events promptly, how reports reach incident management, and the records an auditor uses to test that reporting works.
