ISO 27001 Annex A
Eight controls that follow a person from offer letter to exit.
Theme 6 is the smallest in Annex A: 8 controls, numbered 6.1 to 6.8. All of them concern people, so the clearest way to run them is along the employee lifecycle: before someone joins, while they work, when they move, and when they leave. Most of the evidence sits in HR and IT records, not in security tools.
Back to ISO 27001 services01 · The lifecycle
One lifecycle, eight controls
Each stage of employment switches on a different set of controls. Two theme 5 controls join them at the exit.
| Stage | Controls in play | What should happen | Record that proves it |
|---|---|---|---|
| Before day one | 6.1, 6.2, 6.6 | Checks matched to the role; contract and confidentiality terms signed | Screening outcome, signed contract and NDA |
| First weeks | 6.3, 6.7, 6.8 | Induction training; remote-work rules accepted; reporting route explained | Training completion, policy acceptance |
| Every year | 6.3, 6.4, 6.8 | Refresher training; reports handled; breaches dealt with fairly | Training records, event reports, case notes where needed |
| Role change | 6.5, with 5.18 | Old access removed, new access granted, duties restated | A mover ticket showing both changes |
| Exit | 6.5, 6.6, with 5.11 and 5.18 | Access off, devices back, continuing duties reminded | Leaver ticket with timestamps, exit acknowledgement |
Contractors and agency staff go through the same stages. An auditor will commonly ask for one contractor in the sample precisely because they are the group most often missed.
02 · Before joining
Before day one: screening, terms and confidentiality
Three controls set the conditions of trust before anyone gets a login.
| Control | What it is for | Typical setup in a software company | What the auditor asks to see |
|---|---|---|---|
| 6.1 Screening | Check that candidates are who they claim, to a depth that fits the role | Identity, education and past-employment checks; deeper checks for admin and finance roles | A screening policy by role, and outcomes for sampled hires |
| 6.2 Terms and conditions of employment | Make security part of the employment deal | A security clause in contracts pointing to the policies | Signed contracts for a sample of staff and contractors |
| 6.6 Confidentiality or non-disclosure agreements | Bind people to keep confidential what needs protecting | A standard NDA, reviewed when the business or data changes | Signed NDAs and the date the template was last reviewed |
Proportionate is the word that matters. A support agent with customer data access may need more checking than a designer with none. Write the depth of check per role, and keep to it. Screening also handles a candidate's personal data, so collect only what the check needs, with the candidate's knowledge, and keep it no longer than your retention rule allows.
03 · While working
While they work: training, remote work and reporting
The everyday controls. They decide whether people notice a problem and say something.
| Control | What it is for | Typical setup in a software company | What the auditor asks to see |
|---|---|---|---|
| 6.3 Information security awareness, education and training | People know the risks and their part in managing them | Induction plus yearly refresher; extra modules for engineers and admins | Completion records and the content, matched to roles |
| 6.7 Remote working | Information stays protected outside the office | A remote-work rule: managed laptop, disk encryption, screen lock, no public sharing of screens | The rule, acceptances, device compliance report |
| 6.8 Information security event reporting | Anyone can report a suspected event quickly | One reporting channel, such as a chat channel or form, explained at induction | Reports received and staff who can say where to report |
Control 6.8 is the front door to the incident process in theme 5. It only works if reporting is easy and nobody is punished for a false alarm. Auditors often test it by asking a few employees, chosen at random, how they would report a suspicious email.
04 · Disciplinary process
When rules are broken: the disciplinary process
Control 6.4 asks for a known, fair process, not for harsh outcomes.
Most companies already have a disciplinary procedure in the HR handbook. The gap is usually that it never mentions security policy breaches. Add them, and agree with HR how a security case is raised and who decides.
- Written down. Part of the HR handbook, with security breaches named.
- Known. Staff are told at induction that it exists.
- Proportionate. Outcomes scale with intent, harm and repetition.
- Consistent. The same breach meets the same response, whoever commits it.
- Recorded. Cases kept in HR files, with access limited.
Auditors rarely ask to read a disciplinary file. They commonly check that the procedure exists, covers security, and is known to staff.
05 · Moving and leaving
Moving and leaving: duties that outlast the role
Control 6.5 covers what still binds someone after a move or exit. Access and devices are handled by 5.18 and 5.11.
| Control | What it is for | Typical setup in a software company | What the auditor asks to see |
|---|---|---|---|
| 6.5 Responsibilities after termination or change of employment | Duties that continue after a move or exit are clear and enforced | Exit letter restating confidentiality; a mover checklist for role changes | Leaver and mover samples with the reminder sent |
- HR records the last working day in the system that feeds the identity provider.
- Access is switched off on that day, or sooner for a hostile exit.
- Devices and tokens come back, and are wiped before reuse.
- The leaver receives a written reminder of what stays confidential.
- The ticket closes with timestamps for each step.
06 · What auditors sample
What the auditor pulls, and where it goes wrong
Expect a sample of joiners, movers and leavers from the audit period, traced through HR and IT.
- Leaver access outlives the leaver. The identity provider shows a sign-in after the last working day.
- Training that is all one size. Engineers and admins get the same module as everyone else.
- Contractors outside the process. No screening record and no NDA for agency staff.
- Remote rules with no proof. A policy exists, but nothing shows laptops are encrypted.
- Mover access never trimmed. A person who changed teams keeps rights from both.
Sources: ISO/IEC 27001:2022 Annex A control numbers and names; ISO/IEC 27002:2022 for the purpose of the people controls, described in our own words; the Digital Personal Data Protection Act, 2023, for the handling of candidate data. The standards are copyrighted and are not reproduced here.
Questions about the people controls
Do we need a background check for every hire?
You need a check matched to each role, written down and followed.
The control asks for screening that is proportionate to the role, the information it touches and the risk. Set the depth per role group, and make sure each hire's record shows the check that role requires.
Are contractors covered by the people controls?
Yes, whenever they handle information in scope.
Contractors, interns and agency staff with access need screening, confidentiality terms, training and offboarding like employees. When an agency does the screening, put the duty in its contract and keep its confirmation.
How is event reporting different from incident management?
6.8 is the reporting route; theme 5 handles what happens next.
Control 6.8 makes sure anyone can raise a concern quickly. Controls 5.24 to 5.28 cover how the security team assesses, responds to and learns from what was raised.
We have no office. Does remote working still need a policy?
More than ever: it is your main working environment.
For a fully remote team, control 6.7 carries much of what offices would normally handle. The rule should cover managed devices, encryption, screen locks, home networks and working in public places, with device reports as proof.
Make the employee lifecycle audit-ready.
An ISO 27001 gap analysis traces a sample of your joiners, movers and leavers through HR and IT, and shows where the record breaks.