ISO 27001 Annex A people controls

ISO 27001:2022 Annex A 6 holds eight people controls covering the whole working life: screening and terms before someone starts, awareness, discipline, confidentiality, remote working and reporting while they work, and responsibilities that continue after they leave. None is new in 2022, but remote working and event reporting moved into this theme.

The requirement in plain English

The people theme is the smallest in Annex A. Read it in the order of someone’s time with you.

Before they start. Candidates are screened before joining, in proportion to the role, the information they will see and the risks, and within what employment and data protection law allow (ISO 27001:2022 Annex A 6.1). Employment terms state their security responsibilities and yours (ISO 27001:2022 Annex A 6.2).

While they work. People receive security awareness, education and training suited to their role, with regular updates (ISO 27001:2022 Annex A 6.3). This sits alongside the awareness requirement in clause 7 (ISO 27001:2022 7.3). A formal, communicated disciplinary process covers security breaches (ISO 27001:2022 Annex A 6.4). Confidentiality or non-disclosure agreements reflect what you need protected and are reviewed (ISO 27001:2022 Annex A 6.6). Remote workers have security measures suited to where they work (ISO 27001:2022 Annex A 6.7). Everyone has a way to report suspected security events quickly (ISO 27001:2022 Annex A 6.8).

After they leave or change role. Security duties that continue after leaving, such as confidentiality, are defined, communicated and enforced (ISO 27001:2022 Annex A 6.5). The returning of assets (ISO 27001:2022 Annex A 5.11) and removal of access rights (ISO 27001:2022 Annex A 5.18) sit in the organisational theme but are tested together with this one.

In the 2013 edition remote working sat with mobile devices and event reporting sat with incident management. The 2022 edition moved both here, because both depend on what people do.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 20-person fintech, fully remote across the UK, runs one joiners, movers and leavers checklist owned by its operations lead.

Before an offer is confirmed, every hire has identity and right-to-work checks and references; roles with access to production or customer funds also get a criminal record check where the law allows it for the role. The contract and the staff handbook state security duties, confidentiality during and after employment, and that breaches go through the disciplinary procedure.

In their first week every new starter reads the security and acceptable use policies, confirms them, and completes a 30-minute awareness session that covers phishing, reporting, handling customer data and working from home. Refreshers run each year and after any policy change. Engineers get secure development training on top. A phishing simulation runs each quarter, and its results shape the next session.

Remote working rules cover screen privacy, home Wi-Fi, locking devices and printing. Staff report anything suspicious through one channel, and the reporting route is on the first page of the handbook.

When someone leaves, HR’s exit date triggers the leaver checklist: access removed on the last day, equipment returned and wiped, and a reminder of continuing confidentiality.

Evidence an auditor expects

Screening records: a sample of recent joiners, checked against the screening policy for the role.
Employment and contractor terms: security and confidentiality clauses, including for contractors.
Awareness and training records: who completed what and when; the auditor also asks a member of staff how they would report a suspicious email.
Disciplinary process: documented and communicated; the auditor may ask whether it has been used for a security breach.
Confidentiality agreements: signed, current and reviewed against what needs protecting.
Remote working rules: the policy and evidence people know it.
Leaver records: the auditor samples leavers and compares access removal and asset return dates with the leaving date.

Common mistakes

Leavers removed late

HR updates the payroll system, nobody tells IT, and accounts stay active for weeks. This is one of the most common findings. Make the leaving date trigger access removal, and check a sample each quarter.

Screening that ignores contractors

Employees are screened, but contractors with the same production access are not. Apply the same rule to anyone with that access, through their contract or agency.

Awareness measured only by attendance

A completion rate of 100% says nothing about whether people would spot a phishing email. Add a measure of behaviour, such as simulation results or the number of reported events.

No route for reporting

The policy says “report security events” but not where or to whom. Name one channel and test that people know it.

Confidentiality that ends at the door

Agreements cover employment but say nothing about duties after leaving. Define what continues, for how long, and remind leavers.

How Sted helps

For the ISO 27001 Annex A people controls Sted’s knowledge base carries the Human Resources Security Policy (POL-HRS) with its Joiners Movers Leavers Record (REC-JML) and Role Security Profile Record (REC-RSIP), the Remote and Teleworking Policy (POL-RTP) with its Remote and Teleworking Framework Record (REC-RTC), Teleworking Arrangement Record (REC-TAR) and Remote and Teleworking Review Record (REC-RTR), and the Social Engineering Policy (POL-SEP) with its Social Engineering Simulation Record (REC-SIM).
Records are part of the Full Management System plan.
Training in Sted is the person’s own attestation, on the current approved version, that they are aware of and understand the document and accept their role in it; nobody can complete it for someone else.
Administrators and Policy and Process Owners see a training register of every person’s training across documents, filterable by status and document.
Training is completed against a specific approved version; a new version asks people to train again.
Re-issuing training on an unchanged version is not available yet.
Sted does not connect to your cloud, code or HR systems to collect evidence automatically; you record it.

Sted records policies, read-and-confirm training and joiner and leaver records. It does not screen candidates or remove anyone’s access to your systems; your people do that and record it.

Training and awareness programme: planning induction and refresher training.
Access reviews: catching leavers and movers whose access was missed.
Support, competence, awareness and documented information: the clause 7 awareness duty this theme backs up.
Annex A organisational controls: asset return and access removal for leavers.
Training in Sted: how people confirm they have read each approved policy.

Frequently asked questions

Do contractors count for the ISO 27001 people controls?

Yes, where they work under your control or handle your information. Screening, confidentiality terms, awareness and leaving arrangements should cover contractors and agency staff in proportion to their access, usually through the contract with them or their agency.

How often should security awareness training happen?

The standard says regular updates, not a frequency. An induction session plus a refresher at least once a year is the common pattern, with extra sessions when a policy changes or after an incident shows a gap.