HR Security Policy

1. Purpose

People handle most of the Organisation's information, so people are both its strongest control and a common cause of loss. This policy sets the security requirements that apply before, during and at the end of employment or engagement, so that the right people are chosen, know what is expected of them, are held to it fairly, and leave without taking information or access with them.

The step-by-step actions, forms and time targets are in the HR Security Procedure.

2. Scope

• In scope: employees on permanent, fixed-term, probationary and part-time contracts; directors; interns and trainees; contractors, consultants and agency workers; and anyone else given access to information assets.
• In scope: every stage from recruitment and offer through onboarding, employment, role change, long absence, resignation, dismissal, retirement and the period after exit during which confidentiality duties continue.
• Out of scope: general employment law matters such as pay, leave and grievances, which are in the HR manual. This policy covers only their security aspects.

3. Terms and definitions

4. Roles and Responsibilities

5. Policy Statements

5.1 Before employment: screening

• No offer becomes unconditional and no access to non-public systems is given until the screening required for the role is complete.
• Screening is proportionate to the role and the law. It is applied equally to employees, contractors and agency staff, and where an agency provides staff its contract must require equivalent checks.
• Candidates are told in advance which checks will be done, and the Organisation collects only what it needs. Screening results are kept confidential within HR and are held in line with the Organisation's data protection duties under the Digital Personal Data Protection Act, 2023 and its Rules [confirm the current requirement].
• A check that gives an adverse or unclear result is reviewed by HR with the hiring manager and Legal before any decision, and the candidate is given a fair chance to explain.

5.2 Screening levels

5.3 Terms and conditions of employment

• Every contract or engagement letter includes the employee's duty to comply with the Information Security Policy and related policies, a confidentiality clause that continues after exit for [2 years] (and indefinitely for trade secrets and personal data), and a clause on ownership of work product.
• Contracts state the consequences of a security breach, the right of the Organisation to monitor its systems in line with law, and the requirement to return assets and information on exit.
• A signed confidentiality undertaking and acceptance of the Acceptable Usage Policy are conditions of starting work.
• Contractors and suppliers are bound by equivalent terms in their agreements before access is granted.

5.4 During employment: awareness and training

• Every new joiner completes security induction within [5 working days] of starting and before being given access to Confidential systems.
• All people repeat security awareness training at least [every 12 months], with the completion rate reported to top management. Role-specific training is given to administrators, developers, HR, finance and anyone handling customer data.
• Phishing and social engineering exercises are run at least [twice a year]. People who repeatedly fail get additional coaching, not punishment, unless behaviour is reckless.
• Training completion is recorded and linked to access: a person overdue by more than [30 days] has non-essential access suspended after warning.

5.5 Management responsibilities

• Managers make sure staff follow policy, lead by example, and give time for training.
• Managers report resignation, role change, leave of absence and concerns about behaviour to HR promptly, within [1 working day].
• Managers do not share credentials with team members or ask staff to bypass controls to meet a deadline.

5.6 Disciplinary process

A formal, fair and documented process applies to breaches of information security rules. The response is proportionate to the intent, the harm and whether it is a repeat. Employees are told of the allegation, given a chance to respond, and may be accompanied as the HR manual provides. Evidence is preserved before action is taken.

5.7 Reporting security concerns

Everyone must report suspected incidents, weaknesses and policy breaches without delay, through [the incident reporting channel]. No one is penalised for reporting in good faith. Anonymous reporting is available through [the whistleblowing channel].

5.8 Role change and long absence

• A change of role triggers a review of all access within [2 working days]; permissions of the old role are removed.
• For absences longer than [30 days], other than approved leave with remote access needs, access to sensitive systems is suspended until return.
• Re-screening is applied when a person moves into a sensitive role.

5.9 Termination and exit

• The exit checklist is completed for every leaver: return of devices, badges, keys, tokens and documents; removal of access at the agreed time; handover of work and passwords held in shared vaults; reminder of continuing confidentiality duties; and removal of personal data from Organisation devices.
• A leaver's accounts are disabled at the end of the last working day, or at once for dismissal or a security concern. Mailboxes are redirected or archived for [90 days].
• Leavers who held Restricted access are told in writing of their continuing obligations and monitored for unusual activity in their final [30 days] where lawful.
• Where a leaver has not returned assets, HR and Finance follow up within [10 working days] and Legal is informed if recovery fails.

5.10 Contractors, interns and third-party staff

People who are not employees follow all the same rules. The sponsoring manager is responsible for their onboarding, their access end date, and their exit. Supplier-provided staff are covered by the supplier agreement, and the supplier must tell the Organisation on the day a worker leaves the assignment.

5.11 Protection of personnel data

HR records, screening files and investigation papers are classified [Confidential], stored in an access-controlled system, accessible only to named HR staff, and retained only for the periods in the records schedule. Monitoring of employee activity is limited to what is disclosed in the Acceptable Usage Policy and permitted by law.

6. Compliance and monitoring

The Head of HR reports [quarterly] to top management on the measures below. Internal audit samples joiner and leaver files at least [once a year] for completeness.

7. Records and evidence

• Screening consent and outcomes, contracts and undertakings: kept for the employment period plus [7 years].
• Training attendance and results: [3 years].
• Joiner, mover and leaver tickets and exit checklists: [3 years].
• Disciplinary records for security matters: as the HR records schedule provides, normally [6 years].

8. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

9. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

10. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• HR Security Procedure
• Access Control Policy
• Acceptable Usage Policy
• Information Security Policy
• Supplier Relationship Management Policy
• Mobile Device and Teleworking Policy