Control
Background verification checks on all candidates to become personnel should be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks. 

A screening process should be performed for all personnel including full-time, part-time and temporary staff. Where these individuals are contracted through suppliers of services, screening requirements should be included in the contractual agreements between the organization and the suppliers. 

Information on all candidates being considered for positions within the organization should be collected and handled taking into consideration any appropriate legislation existing in the relevant jurisdiction. In some jurisdictions, the organization can be legally required to inform the candidates beforehand about the screening activities. 

Verification should take into consideration all relevant privacy, PII protection and employment-based legislation and should, where permitted, include the following: 

When an individual is hired for a specific information security role, the organization should make sure the candidate: 

Where a job, either on initial appointment or on promotion, involves the person having access to information processing facilities and, in particular, if these involve handling confidential information (e.g. financial information, personal information or health care information) the organization should also consider further, more detailed verifications. 

Procedures should define criteria and limitations for verification reviews (e.g. who is eligible to screen people and how, when and why verification reviews are carried out). 
In situations where verification cannot be completed in a timely manner, mitigating controls should be implemented until the review has been finished, for example: 

Verification checks should be repeated periodically to confirm ongoing suitability of personnel, depending on the criticality of a person’s role. 

Control
The employment contractual agreements should state the personnel’s and the organization’s responsibilities for information security.

The contractual obligations for personnel should take into consideration the organization’s information security policy and relevant topic-specific policies. 

In addition, the following points can be clarified and stated:

a) confidentiality or non-disclosure agreements that personnel who are given access to confidential information should sign prior to being given access to information and other associated assets (see 6.6);

b) legal responsibilities and rights [e.g. regarding copyright laws or data protection legislation (see 5.32 and 5.34)];

c) responsibilities for the classification of information and management of the organization’s information and other associated assets, information processing facilities and information services handled by the personnel (see 5.9 to 5.13); 

d) responsibilities for the handling of information received from interested parties;

e) actions to be taken if personnel disregard the organization’s security requirements (see 6.4).

 Information security roles and responsibilities should be communicated to candidates during the preemployment process.

The organization should ensure that personnel agree to terms and conditions concerning information security. These terms and conditions should be appropriate to the nature and extent of access they will have to the organization’s assets associated with information systems and services. The terms and conditions concerning information security should be reviewed when laws, regulations, the information security policy or topic-specific policies change.

Where appropriate, responsibilities contained within the terms and conditions of employment should continue for a defined period after the end of the employment (see 6.5).

Control
Personnel of the organization and relevant interested parties should receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies and procedures, as relevant for their job function. 

An information security awareness, education and training programme should be established in line with the organization’s information security policy, topic-specific policies and relevant procedures on information security, taking into consideration the organization’s information to be protected and the information security controls that have been implemented to protect the information.

Information security awareness, education and training should take place periodically. Initial awareness, education and training can apply to new personnel and to those who transfer to new positions or roles with substantially different information security requirements.

Personnel’s understanding should be assessed at the end of an awareness, education or training activity to test knowledge transfer and the effectiveness of the awareness, education and training programme.

An information security awareness programme should aim to make personnel aware of their responsibilities for information security and the means by which those responsibilities are discharged. 

The awareness programme should be planned taking into consideration the roles of personnel in the organization, including internal and external personnel (e.g. external consultants, supplier personnel). The activities in the awareness programme should be scheduled over time, preferably regularly, so that the activities are repeated and cover new personnel. It should also be built on lessons learnt from information security incidents. 

The awareness programme should include a number of awareness-raising activities via appropriate physical or virtual channels such as campaigns, booklets, posters, newsletters, websites, information sessions, briefings, e-learning modules and e-mails. 

Information security awareness should cover general aspects such as: 

The organization should identify, prepare and implement an appropriate training plan for technical teams whose roles require specific skill sets and expertise. Technical teams should have the skills for configuring and maintaining the required security level for devices, systems, applications and services. If there are missing skills, the organization should take action and acquire them. 

The education and training programme should consider different forms [e.g. lectures or self-studies, being mentored by expert staff or consultants (on-the-job training), rotating staff members to follow different activities, recruiting already skilled people and hiring consultants]. It can use different means of delivery including classroom-based, distance learning, web-based, self-paced and others. Technical personnel should keep their knowledge up to date by subscribing to newsletters and magazines or by attending conferences and events aimed at technical and professional improvement. 

Other information
When composing an awareness programme, it is important not only to focus on the ’what’ and ’how’, but also the ’why’, when possible. It is important that personnel understand the aim of information security and the potential effect, positive and negative, on the organization of their own behaviour. Information security awareness, education and training can be part of, or conducted in collaboration with, other activities, for example general information management, ICT, security, privacy or safety training. 

Control
A disciplinary process should be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation.

The disciplinary process should not be initiated without prior verification that an information security policy violation has occurred (see 5.28).

The formal disciplinary process should provide for a graduated response that takes into consideration factors such as: 

The response should take into consideration relevant legal, statutory, regulatory contractual and business requirements as well as other factors as required. The disciplinary process should also be used as a deterrent to prevent personnel and other relevant interested parties from violating the information security policy, topic-specific policies and procedures for information security. Deliberate information security policy violations can require immediate actions.

Control
Information security responsibilities and duties that remain valid after termination or change of employment should be defined, enforced and communicated to relevant personnel and other interested parties.

The process for managing termination or change of employment should define which information security responsibilities and duties should remain valid after termination or change. This can include confidentiality of information, intellectual property and other knowledge obtained, as well as responsibilities contained within any other confidentiality agreement (see 6.6). Responsibilities and duties still valid after termination of employment or contract should be contained in the individual’s terms and conditions of employment (see 6.2), contract or agreement. Other contracts or agreements that continue for a defined period after the end of the individual’s employment can also contain information security responsibilities.

Changes of responsibility or employment should be managed as the termination of the current responsibility or employment combined with the initiation of the new responsibility or employment.

Information security roles and responsibilities held by any individual who leaves or changes job roles should be identified and transferred to another individual.

A process should be established for the communication of the changes and of operating procedures to personnel, other interested parties and relevant contact persons (e.g. to customers and suppliers).

The process for the termination or change of employment should also be applied to external personnel (i.e. suppliers) when a termination occurs of personnel, the contract or the job with the organization, or when there is a change of the job within the organization.

Control
Confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information should be identified, documented, regularly reviewed and signed by personnel and other relevant interested parties.

Confidentiality or non-disclosure agreements should address the requirement to protect confidential information using legally enforceable terms. Confidentiality or non-disclosure agreements are applicable to interested parties and personnel of the organization. Based on an organization’s information security requirements, the terms in the agreements should be determined by taking into consideration the type of information that will be handled, its classification level, its use and the permissible access by the other party. To identify requirements for confidentiality or non-disclosure agreements, the following elements should be considered: 

The organization should take into consideration the compliance with confidentiality and non-disclosure agreements for the jurisdiction to which they apply (see 5.31, 5.32, 5.33, 5.34).

Requirements for confidentiality and non-disclosure agreements should be reviewed periodically and when changes occur that influence these requirements.

Control
Security measures should be implemented when personnel are working remotely to protect information accessed, processed or stored outside the organization’s premises.

Organizations allowing remote working activities should issue a topic-specific policy on remote working that defines the relevant conditions and restrictions. Where deemed applicable, the following matters should be considered: 

a) the provision of suitable equipment and storage furniture for the remote working activities, where the use of privately-owned equipment that is not under the control of the organization is not allowed; 

b) a definition of the work permitted, the classification of information that can be held and the internal systems and services that the remote worker is authorized to access; 

c) the provision of training for those working remotely and those providing support. This should include how to conduct business in a secure manner while working remotely; 

d) the provision of suitable communication equipment, including methods for securing remote access, such as requirements on device screen locks and inactivity timers; the enabling of device location tracking; installation of remote wipe capabilities; 

e) physical security; 

f) rules and guidance on family and visitor access to equipment and information; 

g) the provision of hardware and software support and maintenance; 

h) the provision of insurance; 

i) the procedures for backup and business continuity;

j) audit and security monitoring; 

k) revocation of authority and access rights and the return of equipment when the remote working activities are terminated. 

Control
The organization should provide a mechanism for personnel to report observed or suspected information security events through appropriate channels in a timely manner.

Guidance
All personnel and users should be made aware of their responsibility to report information security events as quickly as possible in order to prevent or minimize the effect of information security incidents.
They should also be aware of the procedure for reporting information security events and the point of contact to which the events should be reported. The reporting mechanism should be as easy, accessible and available as possible. Information security events include incidents, breaches and vulnerabilities.
Situations to be considered for information security event reporting include:

Personnel and users should be advised not to attempt to prove suspected information security vulnerabilities. Testing vulnerabilities can be interpreted as a potential misuse of the system and can also cause damage to the information system or service, and it can corrupt or obscure digital evidence. Ultimately, this can result in legal liability for the individual performing the testing.

Control
Security perimeters should be defined and used to protect areas that contain information and other associated assets.

a) defining security perimeters and the siting and strength of each of the perimeters in accordance with the information security requirements related to the assets within the perimeter; 

b) having physically sound perimeters for a building or site containing information processing facilities (i.e. there should be no gaps in the perimeter or areas where a break-in can easily occur). The exterior roofs, walls, ceilings and flooring of the site should be of solid construction and all external doors should be suitably protected against unauthorized access with control mechanisms (e.g. bars, alarms, locks). Doors and windows should be locked when unattended and external protection should be considered for windows, particularly at ground level; ventilation points should also be considered; 

c) alarming, monitoring and testing all fire doors on a security perimeter in conjunction with the walls to establish the required level of resistance in accordance with suitable standards. They should operate in a failsafe manner. 

Control
Secure areas should be protected by appropriate entry controls and access points.

General
Access points such as delivery and loading areas and other points where unauthorized persons can enter the premises should be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access. 
The following guidelines should be considered: 

a) restricting access to sites and buildings to authorized personnel only. The process for the management of access rights to physical areas should include the provision, periodical review, update and revocation of authorizations (see 5.18); 

b) securely maintaining and monitoring a physical logbook or electronic audit trail of all access and protecting all logs (see 5.33) and sensitive authentication information; 

c) establishing and implementing a process and technical mechanisms for the management of access to areas where information is processed or stored. Authentication mechanisms include the use of access cards, biometrics or two-factor authentication such as an access card and secret PIN. Double security doors should be considered for access to sensitive areas; 

d) setting up a reception area monitored by personnel, or other means to control physical access to the site or building; 

e) inspecting and examining personal belongings of personnel and interested parties upon entry and exit; NOTE Local legislation and regulations can exist regarding the possibility of inspecting personal belongings. 

f) requiring all personnel and interested parties to wear some form of visible identification and to immediately notify security personnel if they encounter unescorted visitors and anyone not wearing visible identification. Easily distinguishable badges should be considered to better identify permanent employees, suppliers and visitors; 

g) granting supplier personnel restricted access to secure areas or information processing facilities only when required. This access should be authorized and monitored; 

h) giving special attention to physical access security in the case of buildings holding assets for multiple organizations; 

i) designing physical security measures so that they can be strengthened when the likelihood of physical incidents increases; 

j) securing other entry points such as emergency exits from unauthorized access; 

k) setting up a key management process to ensure the management of the physical keys or authentication information (e.g. lock codes, combination locks to offices, rooms and facilities such as key cabinets) and to ensure a log book or annual key audit and that access to physical keys or authentication information is controlled (see 5.17 for further guidance on authentication information). 

a) authenticating the identity of visitors by an appropriate means; 

b) recording the date and time of entry and departure of visitors; 

c) only granting access for visitors for specific, authorized purposes and with instructions on the security requirements of the area and on emergency procedures; 

d) supervising all visitors, unless an explicit exception is granted. 

a) restricting access to delivery and loading areas from outside of the building to identified and authorized personnel; 

b) designing the delivery and loading areas so that deliveries can be loaded and unloaded without delivery personnel gaining unauthorized access to other parts of the building; 

c) securing the external doors of delivery and loading areas when doors to restricted areas are opened; 

d) inspecting and examining incoming deliveries for explosives, chemicals or other hazardous materials before they are moved from delivery and loading areas; 

e) registering incoming deliveries in accordance with asset management procedures (see 5.9 and 7.10) on entry to the site; 

f) physically segregating incoming and outgoing shipments, where possible;

g) inspecting incoming deliveries for evidence of tampering on the way. If tampering is discovered, it should be immediately reported to security personnel. 

Control
Physical security for offices, rooms and facilities should be designed and implemented.

a) siting critical facilities to avoid access by the public; 

b) where applicable, ensuring buildings are unobtrusive and give minimum indication of their purpose, with no obvious signs, outside or inside the building, identifying the presence of information processing activities; 

c) configuring facilities to prevent confidential information or activities from being visible and audible from the outside. Electromagnetic shielding should also be considered as appropriate; 

d) not making directories, internal telephone books and online accessible maps identifying locations of confidential information processing facilities readily available to any unauthorized person. 

Control
Premises should be continuously monitored for unauthorized physical access.

Physical premises should be monitored by surveillance systems, which can include guards, intruder alarms, video monitoring systems such as closed-circuit television and physical security information management software either managed internally or by a monitoring service provider. 

Access to buildings that house critical systems should be continuously monitored to detect unauthorized access or suspicious behaviour by: 

The design of monitoring systems should be kept confidential because disclosure can facilitate undetected break-ins. 
Monitoring systems should be protected from unauthorized access in order to prevent surveillance information, such as video feeds, from being accessed by unauthorized persons or systems being disabled remotely. 

The alarm system control panel should be placed in an alarmed zone and, for safety alarms, in a place that allows an easy exit route for the person who sets the alarm. The control panel and the detectors should have tamperproof mechanisms. The system should regularly be tested to ensure that it is working as intended, particularly if its components are battery powered. 

Any monitoring and recording mechanism should be used taking into consideration local laws and regulations including data protection and PII protection legislation, especially regarding the monitoring of personnel and recorded video retention periods. 

Control
Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure should be designed and implemented.

Risk assessments to identify the potential consequences of physical and environmental threats should be performed prior to beginning critical operations at a physical site, and at regular intervals. Necessary safeguards should be implemented and changes to threats should be monitored. Specialist advice should be obtained on how to manage risks arising from physical and environmental threats such as fire, flood, earthquake, explosion, civil unrest, toxic waste, environmental emissions and other forms of natural disaster or disaster caused by human beings.

Physical premises location and construction should take account of:

a) fire: installing and configuring systems able to detect fires at an early stage to send alarms or trigger fire suppression systems in order to prevent fire damage to storage media and to related information processing systems. Fire suppression should be performed using the most appropriate substance with regard to the surrounding environment (e.g. gas in confined spaces);

b) flooding: installing systems able to detect flooding at an early stage under the floors of areas containing storage media or information processing systems. Water pumps or equivalent means should be readily made available in case flooding occurs;

c) electrical surges: adopting systems able to protect both server and client information systems against electrical surges or similar events to minimize the consequences of such events;

d) explosives and weapons: performing random inspections for the presence of explosives or weapons on personnel, vehicles or goods entering sensitive information processing facilities.

Control
Security measures for working in secure areas should be designed and implemented.

Guidance
The security measures for working in secure areas should apply to all personnel and cover all activities taking place in the secure area.
The following guidelines should be considered:

Control
Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities should be defined and appropriately enforced.

The organization should establish and communicate a topic-specific policy on clear desk and clear screen to all relevant interested parties. The following guidelines should be considered:

a) locking away sensitive or critical business information (e.g. on paper or on electronic storage media) (ideally in a safe, cabinet or other form of security furniture) when not required, especially when the office is vacated;

b) protecting user endpoint devices by key locks or other security means when not in use or unattended;

c) leaving user endpoint devices logged off or protected with a screen and keyboard locking mechanism controlled by a user authentication mechanism when unattended. All computers and systems should be configured with a timeout or automatic logout feature;

d) making the originator collect outputs from printers or multi-function devices immediately. The use of printers with an authentication function, so the originators are the only ones who can get their printouts and only when standing next to the printer;

e) securely storing documents and removable storage media containing sensitive information and, when no longer required, discarding them using secure disposal mechanisms;

f) establishing and communicating rules and guidance for the configuration of pop-ups on screens (e.g. turning off the new email and messaging pop-ups, if possible, during presentations, screen sharing or in a public area);

g) clearing sensitive or critical information on whiteboards and other types of display when no longer required. The organization should have procedures in place when vacating facilities including conducting a final sweep prior to leaving to ensure the organization’s assets are not left behind (e.g. documents fallen behind drawers or furniture).

Control
Equipment should be sited securely and protected.

a) siting equipment to minimize unnecessary access into work areas and to avoid unauthorized access;

b) carefully positioning information processing facilities handling sensitive data to reduce the risk of information being viewed by unauthorized persons during their use;

c) adopting controls to minimize the risk of potential physical and environmental threats [e.g. theft, fire, explosives, smoke, water (or water supply failure), dust, vibration, chemical effects, electrical supply interference, communications interference, electromagnetic radiation and vandalism];

d) establishing guidelines for eating, drinking and smoking in proximity to information processing facilities; e) monitoring environmental conditions, such as temperature and humidity, for conditions which can adversely affect the operation of information processing facilities;

f) applying lightning protection to all buildings and fitting lightning protection filters to all incoming power and communications lines;

g) considering the use of special protection methods, such as keyboard membranes, for equipment in industrial environments; 

h) protecting equipment processing confidential information to minimize the risk of information leakage due to electromagnetic emanation;

i) physically separating information processing facilities managed by the organization from those not managed by the organization.

Control
Off-site assets should be protected.

a) not leaving equipment and storage media taken off premises unattended in public and unsecured places; 

b) observing manufacturers’ instructions for protecting equipment at all times (e.g. protection against exposure to strong electromagnetic fields, water, heat, humidity, dust); 

c) when off-premises equipment is transferred among different individuals or interested parties, maintaining a log that defines the chain of custody for the equipment including at least names and organizations of those who are responsible for the equipment. Information that does not need to be transferred with the asset should be securely deleted before the transfer; 

d) where necessary and practical, requiring authorization for equipment and media to be removed from the organization’s premises and keeping a record of such removals in order to maintain an audit trail (see 5.14); 

e) protecting against viewing information on a device (e.g. mobile or laptop) on public transport, and the risks associated with shoulder surfing; 

f) implementing location tracking and ability for remote wiping of devices. 

Permanent installation of equipment outside the organization’s premises [such as antennas and automated teller machines (ATMs)] can be subject to higher risk of damage, theft or eavesdropping. These risks can vary considerably between locations and should be taken into account in determining the most appropriate measures. The following guidelines should be considered when siting this equipment outside of the organization’s premises: 

Control
Storage media should be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements.

a) establishing a topic-specific policy on the management of removable storage media and communicating such topic- specific policy to anyone who uses or handles removable storage media;

b) where necessary and practical, requiring authorization for storage media to be removed from the organization and keeping a record of such removals in order to maintain an audit trail;

c) storing all storage media in a safe, secure environment according to their information classification and protecting them against environmental threats (such as heat, moisture, humidity, electronic field or ageing), in accordance with manufacturers’ specifications;

d) if information confidentiality or integrity are important considerations, using cryptographic techniques to protect information on removable storage media;

e) to mitigate the risk of storage media degrading while stored information is still needed, transferring the information to fresh storage media before becoming unreadable; f) storing multiple copies of valuable information on separate storage media to further reduce the risk of coincidental information damage or loss;

g) considering the registration of removable storage media to limit the chance for information loss;

h) only enabling removable storage media ports [e.g. secure digital (SD) card slots and universal serial bus (USB) ports] if there is an organizational reason for their use;

i) where there is a need to use removable storage media, monitoring the transfer of information to such storage media;

j) information can be vulnerable to unauthorized access, misuse or corruption during physical transport, for instance when sending storage media via the postal service or via courier.

Secure reuse or disposal
Procedures for the secure reuse or disposal of storage media should be established to minimize the risk of confidential information leakage to unauthorized persons. The procedures for secure reuse or disposal of storage media containing confidential information should be proportional to the sensitivity of that information. The following items should be considered: 

a) if storage media containing confidential information need to be reused within the organization, securely deleting data or formatting the storage media before reuse (see 8.10);

b) disposing of storage media containing confidential information securely when not needed anymore (e.g. by destroying, shredding or securely deleting the content);

c) having procedures in place to identify the items that can require secure disposal;

d) many organizations offer collection and disposal services for storage media. Care should be taken in selecting a suitable external party supplier with adequate controls and experience;

e) logging the disposal of sensitive items in order to maintain an audit trail;

f) when accumulating storage media for disposal, giving consideration to the aggregation effect, which can cause a large quantity of non-sensitive information to become sensitive.

A risk assessment should be performed on damaged devices containing sensitive data to determine whether the items should be physically destroyed rather than sent for repair or discarded (see 7.14).

Control
Information processing facilities should be protected from power failures and other disruptions caused by failures in supporting utilities.

a) ensure equipment supporting the utilities is configured, operated and maintained in accordance with the relevant manufacturer’s specifications;

b) ensure utilities are appraised regularly for their capacity to meet business growth and interactions with other supporting utilities;

c) ensure equipment supporting the utilities is inspected and tested regularly to ensure their proper functioning;

d) if necessary, raise alarms to detect utilities malfunctions;

e) if necessary, ensure utilities have multiple feeds with diverse physical routing;

f) ensure equipment supporting the utilities is on a separate network from the information processing facilities if connected to a network;

g) ensure equipment supporting the utilities is connected to the internet only when needed and only in a secure manner.

Emergency lighting and communications should be provided. Emergency switches and valves to cut off power, water, gas or other utilities should be located near emergency exits or equipment rooms. Emergency contact details should be recorded and available to personnel in the event of an outage.

Control
Cables carrying power, data or supporting information services should be protected from interception, interference or damage. 

a) power and telecommunications lines into information processing facilities being underground where possible, or subject to adequate alternative protection, such as floor cable protector and utility pole; if cables are underground, protecting them from accidental cuts (e.g. with armoured conduits or signals of presence); 

b) segregating power cables from communications cables to prevent interference; 

c) for sensitive or critical systems, further controls to consider include: 

d) labelling cables at each end with sufficient source and destination details to enable the physical identification and inspection of the cable. 

Specialist advice should be sought on how to manage risks arising from cabling incidents or malfunctions. 

Control
Equipment should be maintained correctly to ensure availability, integrity and confidentiality of information.

a) maintaining equipment in accordance with the supplier’s recommended service frequency and specifications;

b) implementing and monitoring of a maintenance programme by the organization;

c) only authorized maintenance personnel carrying out repairs and maintenance on equipment;

d) keeping records of all suspected or actual faults, and of all preventive and corrective maintenance;

e) implementing appropriate controls when equipment is scheduled for maintenance, taking into account whether this maintenance is performed by personnel on site or external to the organization; subjecting the maintenance personnel to a suitable confidentiality agreement;

f) supervising maintenance personnel when carrying out maintenance on site;

g) authorizing and controlling access for remote maintenance;

h) applying security measures for assets off-premises (see 7.9) if equipment containing information is taken off premises for maintenance;

i) complying with all maintenance requirements imposed by insurance;

j) before putting equipment back into operation after maintenance, inspecting it to ensure that the equipment has not been tampered with and is functioning properly;

k) applying measures for secure disposal or re-use of equipment (see 7.14) if it is determined that equipment is to be disposed of. 

Control
Items of equipment containing storage media should be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use.

Equipment should be verified to ensure whether or not storage media is contained prior to disposal or re-use.

Storage media containing confidential or copyrighted information should be physically destroyed or the information should be destroyed, deleted or overwritten using techniques to make the original information non-retrievable rather than using the standard delete function. See 7.10 for detailed guidance on secure disposal of storage media and 8.10 for guidance on information deletion.

Labels and markings identifying the organization or indicating the classification, owner, system or network, should be removed prior to disposal, including reselling or donating to charity.

The organization should consider the removal of security controls such as access controls or surveillance equipment at the end of lease or when moving out of premises. This depends on factors such as: