Content library
TISAX: Information security
2.1.2: Staff compliance with information security policies

How to fill the requirement

TISAX: Information security

2.1.2: Staff compliance with information security policies

Task name
Priority
Status
Theme
Policy
Other requirements
General security guidelines for staff
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Security guidelines
23
requirements

Task is fulfilling also these other security requirements

T11: Turvallisuuskoulutus ja -tietoisuus
Katakri
4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
TiHL
29. Processing under the authority of the controller or processor
GDPR
9.4.4: Use of privileged utility programs
ISO27 Full
11.2.7: Secure disposal or re-use of equipment
ISO27 Full
1. Task description

Personnel must have security guidelines that deal with e.g. the following topics:

  • Using and updating mobile devices
  • Storing and backing up data
  • Privacy
  • Using email
  • Handling of printouts, papers and files
  • Reporting incidents
  • Scam prevention
Defining cyber security responsibilities and tasks in employment contracts
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
18
requirements

Task is fulfilling also these other security requirements

7.1.2: Terms and conditions of employment
ISO27 Full
7.3: Termination and change of employment
ISO27 Full
7.3.1: Termination or change of employment responsibilities
ISO27 Full
PR.DS-5: Data leak protection
NIST
PR.IP-11: Cybersecurity in human resources
NIST
1. Task description

The employment contracts specify the responsibilities of the employee and the organization for cyber security.

Contracts should include e.g.:

  • the employee's legal responsibilities and rights, such as those related to copyright or data protection law
  • the employee's responsibility for following the instructions, e.g. related to the use of hardware and data and the classification of information
  • the employee's or temporary employee's responsibility for processing information received from other companies or other parties
  • measures if the employee or temporary worker violates the safety requirements of the organization
  • continuing obligations after termination of employment
Maintaining confidentiality agreements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
21
requirements

Task is fulfilling also these other security requirements

T10: Salassapito- ja vaitiolositoumukset
Katakri
7.1.2: Terms and conditions of employment
ISO27 Full
7.3: Termination and change of employment
ISO27 Full
7.3.1: Termination or change of employment responsibilities
ISO27 Full
13.2.4: Confidentiality or non-disclosure agreements
ISO27 Full
1. Task description

All employees handling confidential information should sign a confidentiality or non-disclosure agreement before processing confidential information.

The confidentiality commitment should include, among other things:

  • a clear definition of confidential information
  • the expected duration of the commitment
  • required actions when the commitment is terminated
  • the responsibilities and actions of signatories to prevent unauthorized disclosure of information
  • ownership of information, trade secrets, and intellectual property and how this relates to the protection of confidential information
  • permissible use of confidential information and the signatory's rights to use the information
  • the right to audit and monitor activities involving confidential information

The requirements and needs for confidentiality agreements are reviewed and updated at regular intervals.

Ensuring necessary aspects in personnel's non-disclosure or confidentiality agreements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
2
requirements

Task is fulfilling also these other security requirements

2.1.2: Staff compliance with information security policies
TISAX
6.1.2: Non-disclosure agreement management
TISAX
1. Task description

Organization's confidentiality or non-disclosure agreements continue beyond the employment contract or order.

Organization also has defined a procedure handling violations of the personnel obligations.

No items found.