IPA IP 2020 Question 84

Making no request of the companies work is outsourced to — ISMS human resource controls must also reach the outside staff who handle the organisation's information.

The human resource security controls of an ISMS (ISO/IEC 27001 Annex A) cover the whole employment cycle: screening before employment, terms and conditions, awareness and training, a disciplinary process during employment, and responsibilities that remain valid after termination. Outsourced staff who access the organisation's information pose the same risks, so security requirements must be agreed with the contractor too, typically in the contract.

Answer (c)

Why not others:

• •(a) — background verification of candidates in line with laws, regulations and ethics is the control before employment, so it is appropriate
• •(b) — a formal disciplinary process for security violations, made known to employees, is a control during employment, so it is appropriate
• •(d) — defining, communicating and enforcing security duties that stay valid after leaving is the control at termination, so it is appropriate

Key rule: Personnel security covers before, during and after employment, and extends to contractors: a leak through an outsourcee is still the organisation's leak.

Security · AI-written, may contain errors