Privacy Wiki

• All candidates for employment, contractors and third party users shall be adequately screened,especially for sensitive jobs.
  
• Employees, contractors and third party users of information processing facilities shall sign an agreement on security roles and responsibilities.
  
• Security roles and responsibilities of employees, contractors and third party users should be defined and documented in accordance with the organization's information security policy.
  
• Security roles and responsibilities should include the requirement to:
  

(a) implement and act in accordance with the organization's information security policies;
(b) protect assets from unauthorized access, disclosure, modification, destruction or interference;
© execute particular security processes of activities;
(d) ensure responsibility is assigned to the individual for actions taken; (e) report security events or potential events or other security risks to the organization;

• Security roles and responsibilities shall be defined and clearly communicated to job candidates during the pre-employment process.
  
• Job descriptions can be used to document security roles and responsibilities. Security roles and responsibilities for individuals not engaged via the organization's employment process, e.g. engaged via a third party organization, should also be clearly defined and communicated.
  
• Background verification checks on all candidates for employment, contractors, and third party users shall be carried out in accordance with relevant laws, regulations and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risks.
  
• Procedures should define criteria and limitations for verification checks (who is eligible to screen people, and how, when and why verification checks are carried out).
  
• A screening process should also be carried out for contractors, and third party users. Where contractors are provided through an agency, the contract with the agency should clearly specify the agency's responsibilities for screening and the notification procedures they need to follow if screening has not been completed or if the results give cause for doubt or concern. In the same way, the agreement with the third party should clearly specify all responsibilities and notification procedures for screening.
  
• As part of their contractual obligation, employees, contractors and third party users should agree and sign the terms and conditions of their employment contract, which would state their and the organization's responsibilities for information security.
  
• The terms and conditions of employment should reflect the organization's security policy in addition to clarifying:
  

(a) that all employees, contractors and third party users who are given access to sensitive information should sign a confidentiality or non-disclosure agreement prior to being given access to information processing facilities;
(b) the employee's contractor's and any other user's legal responsibilities and rights; (e.g. copyright laws or data protection legislation);
© responsibilities for the classification of information and management of organizational assets associated with information systems and services handled by the employee, contractor or third party user;
(d) responsibilities of the employee, contractor or third party user for the handling of information received from other companies or external parties;
(e) responsibilities of the organization for the handling of personal information, including personal information created as a result of, or in the course of, employment with the organization;
(f) responsibilities that are extended outside the organization's premises and outside normal working hours;
(g) actions to be taken if the employee, contractor or third-party user disregards the organization's security requirements.

• Management responsibilities should be defined to ensure that security is applied throughout an individual's employment within the organization.
  

• Privacy Set of Rules (SOR)