Most security discussions jump straight to technical controls. But ISO 27001 reminds us that 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘀𝘁𝗮𝗿𝘁𝘀 𝘄𝗶𝘁𝗵 𝗽𝗲𝗼𝗽𝗹𝗲 — long before an employee even joins the company. 

Annex A.6 (People Controls) focuses on making your workforce a security asset rather than a liability. Here are the three critical phases every organization must get right: 

1️⃣  𝗣𝗿𝗶𝗼𝗿 𝘁𝗼 𝗘𝗺𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁: 𝗥𝗶𝘀𝗸-𝗕𝗮𝘀𝗲𝗱 𝗦𝗰𝗿𝗲𝗲𝗻𝗶𝗻𝗴 
It’s not just a basic background check. ISO 27001 requires screening based on the role and sensitivity of the information the person will access. 
。Verify identity, employment history, academic qualifications, and professional references. 
。The higher the risk, the deeper the screening. 
IT ensures hiring people who are both competent and trustworthy. 

2️⃣  𝗗𝘂𝗿𝗶𝗻𝗴 𝗘𝗺𝗽𝗹𝗼𝘆𝗺𝗲𝗻𝘁: 𝗕𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗮 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝘂𝗹𝘁𝘂𝗿𝗲 
This is where many companies fall short — treating security as a once-a-year compliance exercise. 
Annex A.6 emphasizes that employees must understand and apply security policies relevant to their role. 
。Deliver 𝗮𝘄𝗮𝗿𝗲𝗻𝗲𝘀𝘀 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴 (e.g., secure coding, phishing, physical security). 
。Maintain a clear and fair 𝗱𝗶𝘀𝗰𝗶𝗽𝗹𝗶𝗻𝗮𝗿𝘆 𝗽𝗿𝗼𝗰𝗲𝘀𝘀 for policy violations. 
Security must become a habit, not a checkbox. 

3️⃣ 𝗧𝗲𝗿𝗺𝗶𝗻𝗮𝘁𝗶𝗼𝗻 𝗼𝗿 𝗥𝗼𝗹𝗲 𝗖𝗵𝗮𝗻𝗴𝗲: 𝗧𝗵𝗲 𝗙𝗼𝗿𝗴𝗼𝘁𝘁𝗲𝗻 𝗥𝗶𝘀𝗸 
One of the weakest links in many organizations. 
。𝗧𝗶𝗺𝗲𝗹𝘆 𝗿𝗲𝘃𝗼𝗰𝗮𝘁𝗶𝗼𝗻 𝗼𝗳 𝗮𝗰𝗰𝗲𝘀𝘀 𝗿𝗶𝗴𝗵𝘁𝘀 upon termination. 
。𝗣𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 𝗰𝗿𝗲𝗲𝗽 during internal transfers (e.g., Marketing → Product) must be reviewed and cleaned up. 
。Ensure all company assets (devices, data, cards, etc.) are returned and securely wiped. 

A strong off-boarding process is just as important as onboarding. 

𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗶𝘀𝗻’𝘁 𝗷𝘂𝘀𝘁 𝗮𝗻 𝗜𝗧 𝗶𝘀𝘀𝘂𝗲 — 𝗶𝘁’𝘀 𝗮 𝗽𝗲𝗼𝗽𝗹𝗲, 𝗽𝗿𝗼𝗰𝗲𝘀𝘀, 𝗮𝗻𝗱 𝗰𝘂𝗹𝘁𝘂𝗿𝗲 𝗶𝘀𝘀𝘂𝗲. 
When HR, IT, and leadership aren’t aligned, the entire information security program is at risk.