Question group
People and HR security
Screening, training and the terms people sign. Customers ask because a supplier's staff reach their data; the evidence is HR records more than technology.
The families
3 families| Family and a typical question | ISO 27001 | Evidence expected |
|---|---|---|
| Background checksAre background checks performed on employees with access to customer data? | 6.1 | The screening procedure scaled to role and data access, and the screening records for the people who will reach the customer's data. |
| Security awareness trainingDo all staff complete security awareness training when they join and every year after? | 6.3 | The training programme outline, completion records for the last cycle, and the phishing exercise results if any are run. |
| Confidentiality terms and leaversDo employees and contractors sign confidentiality or non-disclosure agreements before they start? | 6.6 | The confidentiality clause or agreement template, signed copies for the relevant staff, and the leaver checklist. |