6.2 Terms and conditions of employment
Requires employment contractual agreements to state what the individual and the organisation are each responsible for with respect to information security.
5
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Signed acceptance records for personnel in scope, including those who joined before the current clause set · Policy repository / GRC workspace
- Evidence of update where responsibilities changed, and communication of the change · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Employment contracts and contractor agreements containing the information security responsibilities of both parties · Vendor register / contract repository
- Evidence the clauses cover confidentiality, acceptable use, return of assets and obligations continuing after employment · Document repository
- Equivalent terms for non employees with access, such as contractors, temporary staff and volunteers · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Current contract template compliant while long serving employees remain on terms containing nothing about information security
- Agency and outsourced personnel covered by a contract between the organisation and the agency, with nothing binding the individual
- Terms reference a policy by name that the individual is never given
- No record of signature, so acceptance cannot be evidenced when it is needed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.1 Screening · 6.3 Information security awareness, education and training