When we talk about security, we think of systems. But every system is used by a person, and a person has a journey: they arrive, they work for a while, then they leave or change role. At every step there is a risk, and at every step something can be done.
That is exactly what ISO 27001 does on the human resources side. Annex A, the standard's list of controls, has a group dedicated to people. The basic idea is simple: an employee's security does not start on the first day of work and does not end on the last.
Before employment
A person's security starts before they walk through the door. Two things matter here.
- Screening the candidate. The standard asks for a check that fits the role. The more sensitive the information the job touches, the more thorough the check can be, from confirming education and experience to a criminal record check where justified. All within the law and with respect for GDPR, not out of curiosity.
- Clear rules in the contract. From the moment of hiring, the person should know what security expectations the company has of them. This includes the confidentiality agreement, that is, the written promise not to take information out of the company.
During employment
The longest stage, and the one where the most is won or lost. Three things keep it healthy.
- Training and awareness. People are not born knowing how to recognise a fake email. Repeated training, in plain terms for each role, is what turns an employee from a vulnerability into a defender. We wrote about this in the article on security culture.
- Clear responsibilities. Everyone has to know what they are allowed to do with information and what they are responsible for. Confusion is the friend of mistakes.
- A process for breaches. When someone breaks the rules, there has to be a fair and known way to respond. Not to scare people, but to make it clear that the rules count the same for everyone.
On leaving or changing role
Here is one of the biggest holes in real companies: former employees who still have an active account and access to systems, months after they left.
- Removing access. Accounts are closed, passwords and access cards are cancelled, on the very day of departure. The same when someone moves to another role and no longer needs the old access.
- Returning assets. Laptop, phone, documents, keys. Everything they received comes back.
- The obligations that remain. Confidentiality does not expire with the contract. On leaving, the person is reminded of what they may not take forward.
The good part is that all of it becomes simple if it is prepared in advance: a short checklist, run at every departure, instead of a scramble through systems when it is already too late.
Why it matters so much
Because the most costly incidents do not come from outside, but from within, often without bad intent. A new, untrained employee who clicks a fake link. An upset colleague who leaves and still has access. A vendor with rights forgotten in the system.
None of these situations is solved with technology. They are solved with care for people, from the first day to after the last. A note: this part is about people as a security element. How you protect employee data under GDPR, the other side of the coin, we covered separately, in the article on employee data protection.
Frequently asked questions
What is human resource security in ISO 27001?
It is the part of the standard that deals with people, because people are both the greatest resource and a security risk. Annex A of ISO 27001 has a group of people controls, organised across three stages: before employment, during employment, and on leaving or changing role. The goal is that everyone knows what they have to protect and that no one is left with access after they no longer need it.
Can I check a candidate's background before hiring them?
Yes, but in moderation and within the law. ISO 27001 asks for a check that fits the role: the more sensitive the information the job touches, the more thorough the check can be. You verify only what is relevant to the job, ask for consent where needed and respect GDPR. You do not look into a person's private life out of curiosity.
What happens to access when an employee leaves?
It must be removed immediately. One of the biggest security holes in companies is a former employee who still has an active account and access to systems. On leaving or changing role, access is removed, equipment is returned and the remaining obligations are reminded, first of all confidentiality. This is prepared in advance, not on the day of departure.
Do I have to be ISO 27001 certified to apply these rules?
No. Certification is useful if customers or a tender require it, but it is not mandatory in order to use the standard. You can take the people controls from Annex A as a common-sense checklist and apply them at your scale, whether you are a small or a large company. The benefit is the same: fewer unpleasant surprises involving people.
Want to set up human resource security to ISO 27001?
We help you take the simple steps, from candidate screening and confidentiality clauses to training and removing access on departure.