HR Security Procedure Template (ISO 27001)

Template draft. Replace everything in [square brackets] with your own decision, delete what does not describe what you really do, and approve it through your own document control. It is not legal advice and does not make an organisation compliant or certified.

1. Purpose

People are the largest source of both protection and risk in an information security management system. This procedure fixes what Human Resources, line managers and the information security team do before a person joins, while they work, and when they leave or change role, so that every person who touches the Organisation's information is suitable, bound by written duties, trained for their role, supervised fairly and cleanly removed from access when they go.

It carries out the HR Security Policy and applies the same rules to employees, contractors, interns, consultants and temporary staff.

2. Scope

In scope: employees (permanent, fixed term, probationary, part time), interns, trainees, contractors, consultants, agency and temporary staff, and the staff of suppliers who have access to the Organisation's information or premises.
In scope: recruitment, onboarding, the period of employment or engagement, role changes, internal transfers, disciplinary action, resignation, termination, end of contract and retirement, whether on site, remote or hybrid.
Out of scope: general labour law and compensation policy, which belong to the HR manual; this procedure covers only their security aspects.
Where applicable law limits what checks may be done or what may be monitored, the law prevails and Legal reviews the step before use.

3. Terms and definitions

Term	Meaning
Screening	Verification of identity, qualifications, work history and other relevant facts about a candidate or contractor before access is given.
In-scope personnel	Everyone listed in the scope above.
Confidentiality agreement	A signed undertaking not to disclose or misuse the Organisation's or its customers' information, during and after the engagement.
Leaver checklist	The form (Annexure A) that records the return of assets, removal of access and the exit reminders.
Mover	A person who changes role, team, location or contract type inside the Organisation.
Privileged role	A role with administrative, financial, source code or bulk data access, which carries stricter screening and review.
Remote or hybrid worker	Anyone who works outside Organisation premises for [one or more days a week].

4. Roles and Responsibilities

Role	Responsibilities
Head of Human Resources (procedure owner)	Owns this procedure, ensures screening, agreements and exit steps are done and records kept, and runs disciplinary processes with Legal.
HR operations and recruiters	Run screening, issue contracts and agreements, schedule induction, keep personnel records and trigger the joiner, mover and leaver tickets.
Line manager	Defines access need for the role, supervises, confirms training completion, reports behaviour concerns, and signs off the leaver checklist for their staff.
Information security team	Sets screening depth by role, designs and delivers awareness training, tracks completion and advises on disciplinary cases involving security.
IT operations and service desk	Create, change and remove accounts, issue and recover devices and report completion in the ticketing tool.
Facilities and physical security	Issue and recover badges and keys and update site access lists.
Legal counsel	Approves contract wording, advises on screening limits, monitoring, disciplinary and post-employment duties.
Procurement and vendor owners	Apply the third-party requirements in this procedure to contracts and manage contractor onboarding and exit.
In-scope personnel	Follow the terms they sign, complete training, protect information and report events.

Activity	Responsible	Accountable	Consulted	Informed
Pre-employment screening	HR operations and recruiters	Head of Human Resources	Information security team	Line manager
Issue contract and confidentiality agreement	HR operations and recruiters	Head of Human Resources	Legal counsel	Line manager
Joiner access and induction	Line manager	Line manager	IT operations and service desk	Information security team
Awareness and training programme	Information security team	Head of Human Resources	Line manager	In-scope personnel
Disciplinary action for a security breach	Head of Human Resources	Head of Human Resources	Information security team	Line manager
Leaver and mover processing	IT operations and service desk	Line manager	HR operations and recruiters	Information security team
Contractor onboarding and exit	Procurement and vendor owners	Line manager	Information security team	Legal counsel
Remote and hybrid worker approval	Line manager	Head of Human Resources	Information security team	IT operations and service desk

5. Human Resource Security Procedure

5.1 Screening and background verification

Screening is proportionate to the role, the information it can reach and the laws that apply. It is done before an offer becomes unconditional and before any access is given. A candidate is told what will be checked and gives written consent.

Check	Standard roles	Privileged and sensitive roles	Evidence
Identity and address	Yes	Yes	Government identity document, verified
Education and qualifications	Highest degree	All relevant qualifications	Institution confirmation
Employment history	[Last 2 employers]	[Last 5 years, all employers]	Written reference or employer confirmation
Professional references	[1]	[2]	Recorded call or reply
Criminal record check	Where allowed by law and relevant	Yes, where allowed by law	Result held by HR only
Financial or credit check	No	[For finance and treasury roles, where allowed]	Result held by HR only
Conflict of interest declaration	At joining	At joining and annually	Signed declaration
Sanctions and watch lists	No	[For roles with cross-border authority]	Search record

DefineThe line manager and the information security team assign a screening level when the vacancy is approved. Output: level on the requisition.
ConsentHR operations obtains written consent and explains how the results are used and kept.
VerifyHR operations or an approved screening provider completes the checks. Target: within [10 working days]; providers are bound by a data protection agreement.
DecideHR reviews the results. A discrepancy is raised with the candidate, who may explain. A material finding is decided by the Head of Human Resources with the information security team and Legal.
RecordKeep outcome and evidence in the personnel file, restricted to HR. Offer letters and access requests cannot be raised until screening is marked complete.
RepeatRe-screen privileged roles every [3 years], and on promotion to a more sensitive role.

Note. Contractors and agency staff are screened to the same level as employees in the same role, by the agency under contract, with proof supplied before the first day.

5.2 Confidentiality agreements

Every in-scope person signs a confidentiality agreement before access begins, whether as a clause in the contract or a separate document.
The agreement defines confidential information (including customer information, personal data, source code, security design and commercial terms), the permitted use, return and deletion duties, and that the duty continues for [3 years, or indefinitely for trade secrets and personal data] after the engagement ends.
It states that the person may report wrongdoing to the authorities and that the Organisation's information may not be moved to personal accounts or services.
Agreements with external parties are signed by an authorised signatory of the Organisation, with Legal approval of any variation from the template.
Signed agreements are held on the personnel or vendor file and are reviewed every [2 years] or when law changes.

5.3 Terms and conditions of employment

Contracts and engagement terms state the person's information security duties and the consequences of breaching them. They are explained at offer stage, and the person signs before the start date.

Term	Content
Duty to comply	Compliance with the Information Security Policy, the Acceptable Usage Policy and procedures that apply to the role.
Ownership	Work produced and intellectual property belong to the Organisation as the law permits.
Personal data	Handling of personal data under the Data Protection and Privacy Procedure.
Monitoring notice	The Organisation monitors use of its systems, networks and devices within the law, and the person consents to it.
Return of assets	Return of devices, badges, documents and data on request or at exit.
Reporting	Duty to report incidents, weaknesses and suspected misuse promptly.
Disciplinary consequences	A breach may lead to action under the disciplinary section.
Post-employment duties	Continued confidentiality and return obligations.

5.4 During employment: awareness and training

Information security awareness and training is a duty of the role and not optional. The programme is described in detail in the training programme section; the minimums are below.

Audience	Training	When	Evidence
Every joiner	Induction on policies, acceptable use, reporting, passwords and multi-factor authentication, phishing, data handling	Within [5 working days] of joining, before full access	Attendance and test score
All staff	Annual refresher and test	Every [12 months]	Learning platform report
All staff	Phishing simulation and short targeted lesson	[Quarterly]	Click and report rates
Privileged users and administrators	Secure administration, logging, change control, social engineering	At role start and every [12 months]	Course record
Developers	Secure coding and privacy by design	At joining and every [12 months]	Course record
Customer-facing teams	Identity verification, impersonation fraud, safe handling of customer data	At joining and every [12 months]	Course record
Managers	Duties for supervision, reporting, joiner mover leaver steps	At promotion and every [24 months]	Course record
Contractors and suppliers' staff	Induction on rules for visitors and third parties	Before first access	Signed acknowledgement

5.5 During employment: supervision and wellbeing

Line managers hold a short conversation about security responsibilities at induction, at the end of probation and in each yearly appraisal; the discussion is noted.
Managers watch for signs that raise insider risk, such as unexplained access to data outside the role, large downloads before resignation, or conflict with colleagues, and report them to HR and the information security team without accusing anyone.
Role changes, long absence and resignation trigger an access review within [5 working days].
Speaking up is protected: a person who reports an event in good faith is not penalised.

5.6 Third parties and contractors

ContractBefore engagement, Procurement includes in the contract the confidentiality terms, security obligations, right to audit, screening duty, breach notification within [24 hours], return and deletion of data, and flow-down to sub-contractors.
ScreenThe supplier confirms in writing that its staff have been screened to the Organisation's level and provides evidence for privileged access.
SponsorA named employee sponsors each contractor, requests access for a fixed term, and is accountable for their conduct.
InductThe contractor completes induction and signs the acceptable use acknowledgement before access.
SuperviseAccess is least privilege, monitored, and re-approved every [90 days] or at the end of the task.
ExitAt end, the sponsor completes the leaver checklist; accounts are removed on the last day and the supplier confirms deletion of data within [15 working days].

5.7 Disciplinary action

A breach of information security rules is handled fairly, consistently and with proof. The response depends on harm, intent, and history, and is decided by Human Resources with the line manager, the information security team and, where needed, Legal.

Level	Examples	Typical response	Decided by
1: Minor, unintentional	Leaving a screen unlocked, late training, sharing a non-sensitive file by the wrong channel	Coaching, reminder in writing, retraining	Line manager
2: Moderate or repeated	Repeated clean-desk failures, sharing a password, using unapproved cloud storage for work files, ignoring a phishing report duty	Formal written warning, retraining, temporary reduction in access	Line manager and HR
3: Serious	Bypassing a control on purpose, unauthorised access to personal data, installing unapproved software that causes an incident, failure to report a known breach	Final warning, suspension of access, removal of privileges, financial recovery where allowed	Head of Human Resources and senior management
4: Gross or criminal	Deliberate theft or sale of data, sabotage, fraud, helping an attacker, deliberate disclosure of customer data	Suspension, termination, referral to the authorities, legal action	Senior management and Legal

ReportThe information security team or manager gives HR a factual note and any evidence preserved under the Incident Management Procedure.
AssessHR checks the facts, including the person's version, within [10 working days]. Actions that could prejudice the case, such as account suspension, can be taken at once by the information security team where risk is high.
HearThe person is told of the allegation, shown the evidence and given a chance to respond, with the right to be accompanied where policy provides.
DecideThe responsible decision-maker sets the response from the table, recording reasons.
ApplyHR issues the outcome in writing; IT applies access changes; the personnel file is updated.
LearnIf a weakness in process or training contributed, the information security team raises a corrective action.

5.8 Separation, termination or change of employment

The same discipline applies to every exit and every change of role, whether friendly or hostile. HR raises the ticket when a resignation is received or a termination is decided, not on the last day. Timelines run from the notice date, and for high-risk exits access is removed before the person is told.

Step	Owner	When
Raise leaver or mover ticket in the ticketing tool with the last working day	HR operations	Within [1 working day] of notice
Review pending work, files and delegations; assign owners for shared mailboxes and documents	Line manager	Before the last [5 working days]
Collect devices, tokens, badges, keys, documents and other assets	Line manager and Facilities	On or before the last day
Disable accounts, remote access and multi-factor tokens; revoke application and supplier-portal access	IT operations and service desk	At the end of the last working day, or immediately for high-risk exits
Reset shared passwords and rotate keys the person knew	IT operations and service desk	Within [1 working day] after exit
Transfer or archive mailbox and files; set auto-reply	IT operations and service desk	Within [5 working days]
Remind of continuing confidentiality duties and obtain a signed exit declaration that no information is retained	HR operations	At exit interview
Notify affected suppliers and customers where the person had named contact rights	Line manager	On the last day
Delete accounts after the retention period	IT operations and service desk	After [90 days]

Movers keep only the access needed in the new role. Old access is removed on the transfer date, not carried over, and the new access is approved by the new manager.
A leaver's device is wiped only after any data needed by the business is copied and a legal hold, if any, is checked.
A leaver who is under investigation has accounts preserved under legal hold, with access disabled.
Exits are reviewed monthly: the information security team compares HR leaver data with active directory accounts to catch missed removals.

5.9 Information security awareness programme

The awareness programme builds behaviour change, not only attendance. It runs a yearly plan approved by the Head of Human Resources and the information security team, with a calendar of campaigns.

Component	Content and method	Frequency	Measure
Induction	Live or recorded session with a short test	At joining	Pass mark [80 percent]
Annual refresher	Online module updated for current threats	[12 months]	Completion [98 percent]
Phishing simulation	Realistic messages by difficulty, with immediate coaching on click	[Quarterly]	Click rate below [5 percent]; report rate above [60 percent]
Campaigns	Posters, newsletters, tips tied to events such as password day or tax season fraud	[Monthly]	Reach and quiz results
Role-based training	As in the training table	[12 months]	Completion
Lessons from incidents	Short anonymised case notes from real events	After each significant incident	Feedback
Leadership briefing	Threat picture and decisions needed	[6 months]	Attendance

Staff who miss training are reminded at [15 days] and [30 days]; at [45 days] their manager and HR are told and access to sensitive systems may be limited until done. Training content is reviewed each year and after any incident that shows a gap.

5.10 Remote and hybrid worker security

Remote work is a privilege approved by the manager and recorded by HR. The home or other location becomes an extension of the Organisation's environment and is treated with the same care. The Mobile Device and Teleworking Policy sets the rules; the steps below make them operational.

Area	Requirement	Check
Device	Organisation-issued and managed laptop or approved device under the Mobile Device Management Procedure: full-disk encryption, endpoint protection, automatic patching, screen lock after [5 minutes]	Device compliance report
Network	Private home network with a strong password, up to date router and no default administrator credentials; no public wi-fi without the VPN	Self-attestation at setup, reminder yearly
Access	Multi-factor authentication, VPN or secure access gateway, no shared accounts, no use by family members	Access gateway logs
Workspace	Screen not visible to others; calls out of earshot; devices locked when away; paper kept to a minimum and locked away	Self-attestation
Data	Work data stays in approved systems; no copies to personal devices, personal email, or unapproved cloud storage; printing at home prohibited unless approved	Data loss prevention alerts
Collaboration	Only approved meeting and chat tools; recordings stored per policy	Tool audit
Travel	Privacy filter, no unattended devices, hotel safe for hardware; extra care at borders; report loss at once	Travel briefing
Incidents	Lost or stolen device reported within [1 hour] of discovery to the service desk	Incident register

The manager and employee complete a remote work declaration (checklist) before the first remote day and every [12 months].
Working from outside the country needs prior approval of HR and the information security team, because of data transfer, legal and access risks.
Remote workers are included in training, phishing tests and access reviews on the same terms as on-site staff.

5.11 Security in role changes and promotions

When a person moves to a more sensitive role, screening and training for that role are completed before access is granted. Segregation of duties is checked: a person must not hold both sides of a control, such as requesting and approving their own access or developing and releasing to production unreviewed.

6. Measures

Measure	Target	How measured
Joiners with screening completed before access	[100 percent]	HR file against account creation date
Signed confidentiality agreement before start	[100 percent]	Personnel file check
Induction security training within 5 working days	[95 percent]	Learning platform
Annual refresher completion	[98 percent]	Learning platform
Leaver accounts disabled by the last working day	[100 percent]	HR list against directory
Assets returned by last day	[98 percent]	Leaver checklist
Phishing report rate	[60 percent]	Simulation report
Disciplinary cases closed within 30 working days	[90 percent]	HR case log
Contractors with signed agreement and sponsor	[100 percent]	Contractor register

7. Records and evidence

Record	Where kept	Retention
Screening results and consent	HR restricted folder	[Employment plus 7 years, or the period set by law]
Signed contracts and confidentiality agreements	HR file	[Employment plus 7 years]
Training and test records	Learning platform	[3 years after leaving]
Disciplinary files	HR restricted folder	[Per law, minimum 5 years]
Leaver checklists and access removal tickets	Ticketing tool and HR file	[3 years]
Contractor register and agreements	Procurement repository	[Contract term plus 6 years]
Remote work declarations	HR file	[Employment plus 1 year]

Annexure A: Leaver and mover checklist

Item	Owner	Done (initials and date)	Notes
Resignation or termination notice received; last working day set	HR operations
Handover of work and delegation of mailbox complete	Line manager
Laptop, phone, tokens, keys, badge and documents returned	Line manager / Facilities
Network, email, VPN and multi-factor accounts disabled	IT operations
Application and supplier-portal access removed	IT operations
Shared passwords and keys changed	IT operations
Cloud storage and files transferred; personal items removed from devices	IT operations
Building access list updated	Facilities
Confidentiality reminder given and exit declaration signed	HR operations
Customers and suppliers told of the new contact	Line manager
Account deletion date set	IT operations

Annexure B: Pre-employment screening record

Candidate / contractor	Role and screening level	Consent date	Identity	Education	Employment history	References	Other checks	Result and decision date
Example: [name]	Developer, standard	[date]	Verified	Verified	Verified	1 received	Not required	Cleared [date]

Annexure C: Remote work declaration

Statement	Confirmed (yes or no)
My device is Organisation-issued and managed, or approved in writing
My home network uses a strong password and an updated router
I work in a place where screens and conversations cannot be seen or heard by others
I will not store work data on personal devices or personal accounts
I will report loss, theft or suspected compromise within [1 hour]
Employee name, manager, date and signature

8. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

9. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

10. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Reference	Title
A.6.1	Screening
A.6.2	Terms and conditions of employment
A.6.3	Information security awareness, education and training
A.6.4	Disciplinary process
A.6.5	Responsibilities after termination or change of employment
A.6.6	Confidentiality or non-disclosure agreements
A.6.7	Remote working
A.5.11	Return of assets