Control Objectives: Human Resources management

Analyze and evaluate training records to improve the training program.

Assign and staff all roles appropriately.

Assign the role of asset physical security to applicable controls.

Assign the role of logical access control to applicable controls.

Assign the role of the Quality Management committee to applicable controls.

Communicate organizational security policies and security procedures as a part of security awareness.

Communicate security awareness and the internal control framework to all interested personnel and affected parties.

Conduct cross-training or staff backup training to minimize dependency on critical individuals.

Conduct secure coding and development training for developers.

Conduct staff performance reviews, as necessary.

Conduct tests and evaluate training.

Document all training in a training record.

Document and communicate role descriptions to all applicable personnel.

Employ individuals who have the appropriate staff qualifications, staff clearances, and staff competencies.

Establish and implement training plans.

Establish and maintain Information Technology staff security clearance level criteria.

Establish and maintain a Code of Conduct as a part of the Terms and Conditions of employment.

Establish and maintain a personnel health and safety policy.

Establish and maintain a personnel security program.

Establish and maintain a security awareness program.

Establish and maintain a travel program for all personnel.

Establish and maintain an education methodology.

Establish and maintain high level operational roles and responsibilities.

Establish and maintain onboarding procedures for new hires.

Establish and maintain personnel screening procedures.

Establish and maintain personnel status change and termination procedures.

Establish and maintain relationships with key stakeholders, business functions, and leadership outside the Information Technology staff.

Establish and maintain security clearance procedures.

Establish and maintain the Information Technology staff structure in line with the Strategic Information Technology Plan.

Establish job categorization criteria, job recruitment criteria, and promotion criteria.

Evaluate Information Technology personnel job performance.

Evaluate the Information Technology staffing requirements regularly.

Human Resources management

Identify and define all key Information Technology roles.

Implement a sanctions process for personnel who fail to comply to the organizational compliance program.

Implement personnel supervisory practices.

Implement segregation of duties in roles and responsibilities.

Issue devices with secure configurations to individuals traveling to locations deemed to be of risk.

Monitor and measure the effectiveness of security awareness.

Notify all interested personnel and affected parties when personnel status changes or an individual is terminated.

Notify designated personnel when a formal personnel sanctions process is initiated.

Perform personnel screening procedures, as necessary.

Perform security clearance procedures, as necessary.

Place Information Technology operations in a position to support the business model.

Require personnel to acknowledge, through writing their signature, that they have read and understand the organization's security policies.

Retrain all personnel annually or as appropriate.

Review and update staff position risk designations, as necessary.

Review organizational personnel successes.

Review the current published guidance and awareness and training programs.

Scan devices for malicious code when an individual returns from locations deemed to be of risk.

Tailor training to be taught at each person's level of responsibility.

Tailor training to meet published guidance on the subject being taught.

Train all new hires, as necessary.

Train all personnel and third parties on how to recognize and report security incidents.

Train all personnel and third parties, as necessary.

Use automated mechanisms in the training environment, where appropriate.