The employment contracts specify the responsibilities of the employee and the organization for cyber security.
Contracts should include e.g.:
All employees handling confidential information should sign a confidentiality or non-disclosure agreement before processing confidential information.
The agreement should include e.g.:
Organisation should have processes for ensuring that conflicting responsibilities are segregated to reduce opportunities for misuse of the organization’s assets.
Care should be taken e.g. in relation to a single person being able to process data without detection. Often also separating the initiation of an event from its authorization is a good practice.
When direct segregation of duties is hard to achieve, the following principles can be utilized:
The employment contract should distinguish between cyber security responsibilities and obligations that remain in force after the termination of the employment relationship. The employee should also be reminded of these at the end of the employment relationship to ensure compliance.