ISO 27001 Annex : A.7.2 During Employment

ISO 27001 Annex : A.7.2 During Employment Its objective is to make sure that employees and contractors are conscious of and fulfill their information security responsibilities.

A.7.2.1 Management Responsibilities

Control- Management should mandate all employees and contractors to exercise information security in accordance with established policies and procedures set by the organization.

Implementation Guidance- Responsibilities for management should include ensuring employees and contractors are:

Are adequately briefed about information security role and responsibilities before given access to confidential information or information systems;
Shall provide proper guidelines stating the information security expectations from their roles in the organization.
Motivated to comply with the organization’s information security policies;
Achieving the level of information security awareness relevant to their organizational positions and responsibilities;
comply with the terms and conditions of employment, including the information security policy of the organization and the relevant working methods;
Seek to have relevant qualifications and expertise, and are regularly trained;
An anonymous reporting platform is provided to report breaches of information security policies or procedures (“whistleblowing”). Management should demonstrate, and serve as a role model for, information security policies, procedures, and controls.

Other Information- If employees and contractors are not made aware of their responsibility for information security, they may cause significant damage to the organization. Motivated personnel are likely to be more professional and trigger fewer accidents related to information security.

Poor management can cause staff to feel undervalued, resulting in a negative impact on the organization’s information security. Poor management, for example, can lead to neglecting information security or, potential misuse of the assets of an organization.

To win in the market place you must first win in the workplace

– Doug Conant

A well said verse which address the employees positive attitude towards his work and the organization. Speaking about employment in every organization will raise awareness of the roles and responsibilities of preserving and protecting the confidentiality of the organization’s assets.

Annex 7.2 of the Standard ISO 27001 addresses various activities and implications of organizational infringements. At Infosavvy , we have experienced trainers who can provide you with a better insight into the information security in the business and can help you learn about safeguards to protect your business. We qualify for one of the highest information security certificates IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification)

A.7.2.2 Information Security Awareness, Education and Training

Control- All company workers and, where necessary, contractors will receive adequate awareness education and training, as well as daily updates on organizational policies and procedures, as applicable to their job function.

Implementation Guidance- An information security awareness program will strive to make workers and, where appropriate, contractors aware of their information security responsibilities and the instances where those responsibilities will be discharged.

In line with the information security policies and related procedures of the organization, and, information security awareness plan should be introduced, taking into account the information to be protected of the organization and the controls to be carried out to guard the information. The awareness plan will include a range of awareness-raising events, such as promotions and booklet issuance or newsletter launches.

The awareness program should be organized in the context of the roles of the employees in the organization and, if necessary, the expected awareness of contractors. the activities in the awareness program, ideally annually, will be scheduled over time so that new workers and contractors can be identified and replicated. The awareness program should also be frequently updated so that it conforms to the organizational policies and procedures and draws on lessons learned from events in the area of information security.

Awareness training should be carried out as required by the information security awareness program of the organization. Awareness training may take advantage of multiple distribution platforms, including classroom-based, distance learning, web-based, self-paced, and others.

Information security training and curriculum will also cover key aspects such as:

– To state the commitment of management to information security across the organization;

– The need to become familiar with the relevant rules and regulations on information security, as specified in policies, guidelines, laws, regulations, contracts, and agreements;

– Personal accountability of own acts and inactions and overall responsibility for securing or protecting organizational and external information;

– Basic procedures (e.g. reporting of security incidents) and baseline controls (e.g. password security, malware controls and clear desks);

– Contact points and tools for additional knowledge and guidance on information security issues, including more information security awareness and training materials.

Information security awareness and training should take place on a regular basis. Initial education and training refers to those who transition to new positions or roles with significantly different information security criteria, not just to new beginnings, but should take place before the role is active.

In order to implement education and training efficiently, the organization must establish an education and training program. The plan will be consistent with the information security policies and procedures of the organization, taking into account the information to be protected and the safeguards that have been implemented in place to protect the information. The curriculum should consider various forms of education and preparation, e.g. seminars or self-study.

Other Information- When designing an awareness plan, it is important not only to concentrate on ‘what’ and ‘how,’ but also on ‘why.’ It is crucial for employees to understand the purpose of information security and the possible positive and negative effects on the organization from their own behavior.

Awareness, training, and awareness can be part of other training programs, such as general IT or general security training, or in collaboration with them. Awareness, education, and training programs should be necessary and suitable for the duties, responsibilities, and skills of the person.

At the conclusion of an awareness, education, and training course for testing knowledge transfer, and evaluation of employee comprehension may be carried out.

Also Read : ISO 27001 Annex : A.7 Human Resource Security

A.7.2.3 Disciplinary Process

Control- A formal and informed administrative process will be in place to take action against employees who have committed an information security breach.

Implmentation Guidance- Legal proceedings should not be conducted without prior verification that an information security violation has occurred.

The systematic disciplinary process will ensure correct and fair treatment for employees suspected of breaching information security. The standard disciplinary process will allow for a graduated response that takes into account factors such as the extent and severity of the violation and its effect on business, whether or not it is either a primary or repeat incident, whether or not the perpetrator was adequately educated, applicable regulations, business contracts and other factors as appropriate.

The disciplinary method can also be seen as a barrier to prevent employees from breaching the information security policies and procedures of the organization and other violations of information security. Deliberate infringements may require immediate action.

Other Information-The disciplinary process can also become a motivation or encouragement if appropriate measures are defined for extraordinary actions with regard to information security.

Questions related to this topic

What should security awareness training include?
What are the controls ISO 27001 Annex : A.7.2 During Employment?
How do you implement a security awareness program?
What is the purpose of security policy awareness training?
What are security policy requirements?
What is ISO 27001 Annex : A.7.2 During Employment?
What are the benefits of ISO 27001 Annex : A.7.2 During Employment?

ISO 27001 Requirements

Clause 4.1 Understanding the organization and its context

Clause 4.2 Understanding the needs and expectations of interested parties
Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement

ISO 27001 Annex A Controls

About ISO 27002

This Blog Article is posted by
Infosavvy, 5B 306 Riverside Greens, Panvel, Raigad 410206 Maharashtra, India

Contact us – www.infocerts.com

https://goo.gl/maps/mHkyURHmeFXyGiVw5

Upcoming Training :- ISO27001 LA T. D.:-Coming soon.. ISO42001 LI T. D.:-16th,17th Nov 2024.