Defining cyber security responsibilities and tasks in employment contracts

Critical
High
Normal
Low

The employment contracts specify the responsibilities of the employee and the organization for cyber security.

Contracts should include e.g.:

  • the employee's legal responsibilities and rights, such as those related to copyright or data protection law
  • the employee's responsibility for following the instructions, e.g. related to the use of hardware and data and the classification of information
  • the employee's or temporary employee's responsibility for processing information received from other companies or other parties
  • measures if the employee or temporary worker violates the safety requirements of the organization
  • continuing obligations after termination of employment
Connected other frameworks and requirements:
7.3: Termination and change of employment
ISO 27001
7.1.2: Terms and conditions of employment
7.3.1: Termination or change of employment responsibilities
ISO 27001
PR.DS-5: Data leak protection
NIST CSF
PR.IP-11: Cybersecurity in human resources
NIST CSF

Maintaining confidentiality agreements

Critical
High
Normal
Low

All employees handling confidential information should sign a confidentiality or non-disclosure agreement before processing confidential information.

The agreement should include e.g.:

  • clear definition of confidential information
  • the expected duration of the commitment
  • the measures required when the agreement is terminated
  • the responsibilities and measures of the parties to prevent unauthorized disclosure of information
  • ownership of information, trade secrets and intangible assets and how this relates to the protection of confidential information
  • the permitted use of confidential information and the parties rights to use the information
  • the right to inspect and supervise activities involving confidential information
Connected other frameworks and requirements:
T10: Salassapito- ja vaitiolositoumukset
7.1.2: Terms and conditions of employment
7.3: Termination and change of employment
ISO 27001
7.3.1: Termination or change of employment responsibilities
ISO 27001
13.2.4: Confidentiality or non-disclosure agreements
ISO 27001

Segregation of information security related duties

Critical
High
Normal
Low

Organisation should have processes for ensuring that conflicting responsibilities are segregated to reduce opportunities for misuse of the organization’s assets.

Care should be taken e.g. in relation to a single person being able to process data without detection. Often also separating the initiation of an event from its authorization is a good practice.

When direct segregation of duties is hard to achieve, the following principles can be utilized:

  • High-level segregation of information security responsibilities
  • Supporting segregation with good monitoring, audit trails and management supervision
Connected other frameworks and requirements:
6.1.2: Segregation of duties
ISO 27001
ID.RA-3: Threat identification
NIST CSF
PR.AC-4: Access permissions and authorizations
NIST CSF
PR.DS-5: Data leak protection
NIST CSF
5.3: Segregation of duties
ISO 27001

Informing about cyber security responsibilities that continue after employment relationship has ended

Critical
High
Normal
Low

The employment contract should distinguish between cyber security responsibilities and obligations that remain in force after the termination of the employment relationship. The employee should also be reminded of these at the end of the employment relationship to ensure compliance.

Connected other frameworks and requirements:
7.3: Termination and change of employment
ISO 27001
7.3.1: Termination or change of employment responsibilities
ISO 27001
PR.DS-5: Data leak protection
NIST CSF
6.5: Responsibilities after termination or change of employment
ISO 27001
No items found.