ISO 27001 people controls: A.6.1–A.6.8
The eight people controls in Annex A section 6 address the relationship between people and information security throughout their work. They include arrangements before and during work, when responsibilities change and when people leave. The aim is clear expectations and reliable behaviour supported by appropriate organisational processes.
Connect the working relationship end to end
Screening and terms of employment address different questions: suitability checks are not the same as communicated obligations. Awareness, education and training help people understand and perform relevant responsibilities. Disciplinary arrangements, confidentiality obligations and responsibilities after change or termination need appropriate coordination with HR and applicable law.
Remote work and event reporting make the connection with everyday operations especially visible. A person can complete a course and still be unable to report an event if the route is unclear. A confidentiality agreement can exist while access remains inappropriate after a role change. The individual pages examine those gaps.
Use proportionate and lawful arrangements
Control selection follows the organisation’s risks and requirements. Do not assume the same screening, monitoring or employment practice is suitable in every country or for every role. Relevant legal, contractual, privacy and employment considerations need informed review. These pages explain security implementation choices, not universal legal permissions.
Define how HR, managers, security teams and external providers exchange the information needed to act. Include relevant contractors and temporary personnel where the arrangement requires it. Protect sensitive personnel information and avoid collecting more than a justified purpose calls for.
Illustrative examples
A software company hires a contractor for a sensitive project. The organisation establishes suitable expectations, access authority, learning needs and an end-of-engagement route. It does not assume the staffing agency’s general onboarding automatically covers the project’s actual information responsibilities.
A BPO moves part of a service to remote working. It considers the approved working arrangement, support, awareness and reporting route together. Employees receive usable instructions and managers know how to respond to concerns. A signed remote-work form is one piece of evidence, not the whole control.
Evaluate understanding and operation
Useful evidence can include appropriate checks, acknowledged expectations, evaluated learning, completed role-change handovers and tested reporting routes. Focus on the intended outcome. Attendance counts alone do not show competence, and a low reporting count can reflect a reporting barrier rather than excellent security.
Connect these controls to competence, awareness and communication. Management-system requirements and selected people controls reinforce one another, but should not be confused with identical obligations or duplicated paperwork.
Individual controls in this theme
A.6.1 · Make Personnel Screening Proportionate
Personnel screening should establish relevant suitability without becoming an indiscriminate search into private life. This guide explains role-based checks, supplier personnel, incomplete verification and review after changes. IT and construction examples show how access consequences shape proportionate decisions while privacy, employment requirements and ethical boundaries remain part of the process.
A.6.2 · Clarify Employment Security Responsibilities
Employment arrangements should explain both the individual’s and the organisation’s information security responsibilities. This guide connects contractual terms with practical onboarding, role changes and continuing obligations. BPO and software examples show why a signature is only a starting point, and how clear responsibilities help staff recognise permitted actions and routes for help.
A.6.3 · Build Security Awareness That Changes Work
Security learning should prepare people for the decisions their work requires. This guide explains audience needs, induction, regular updates and meaningful effectiveness checks. BPO and manufacturing examples show how to connect awareness with practical action, distinguish course completion from competence and choose learning that supports the organisation’s actual controls.
A.6.4 · Apply a Fair Security Disciplinary Process
A disciplinary process should address verified security-policy violations consistently and proportionately. This guide explains the boundary between investigation, immediate protection and disciplinary decisions. BPO and manufacturing examples show why intent, training and operating conditions matter, and how to maintain accountability without discouraging good-faith reporting or treating every incident as misconduct.
A.6.5 · Manage Security Duties After Role Changes
Security responsibilities do not all end when a person leaves or changes role. This guide explains continuing confidentiality duties, ownership transfer, communication and coordinated closure. Software and construction examples show how to prevent responsibility gaps while distinguishing ongoing obligations from technical access removal and the return of equipment or information.
A.6.6 · Make Confidentiality Agreements Relevant
Confidentiality agreements should reflect the information shared and the relationship in which it is used. This guide explains scope, authorised disclosure, duration, review and operational follow-through. Software and construction examples show why a signed agreement does not replace access controls or resolve an unclear permission to reuse information.
A.6.7 · Protect Information During Remote Work
Remote-working security depends on the information, task and environment rather than the worker’s location alone. This guide examines permitted activities, equipment, physical exposure, support and changing conditions. BPO and construction examples show why secure connectivity cannot protect an overheard conversation or an uncontrolled paper copy, and how to make remote arrangements usable.
A.6.8 · Make Security Events Easy to Report
People should be able to report a security concern without proving an incident first. This guide explains accessible channels, useful initial facts, safe reporting boundaries and feedback. Manufacturing and software examples show how overlooked physical or access concerns reach competent assessors, and why reporting volume alone is a poor measure of programme success.
Why the people controls matter to the business
People are both the strongest and the most variable part of any security arrangement. Technology can be sound and still be undermined by a missed check at hiring, an unclear instruction or an unreported event. The people controls help the organisation set clear expectations from the first contact with a candidate until long after someone leaves. They support customer confidence, since clients want to know who handles their information and how those people are guided. They also lower the cost of incidents caused by error or misuse. Applying them proportionately and lawfully, with HR and managers working together, tends to give better results than adding more technology.
Frequently asked questions
Do people controls apply only to permanent staff?
Consider the relevant working relationships, risks and obligations. Contractors, temporary staff and other personnel can also require suitable arrangements.
Is training completion enough for the people-control category?
No. Learning is one part of the category. Expectations, changes, confidentiality, remote work and reporting address different needs, and learning effectiveness also matters.
Can the same HR process be used globally?
Shared principles can help, but evaluate relevant local law, privacy, contracts and operating conditions before applying identical practices in every location.
Make security work throughout the employment lifecycle
Discuss how new starters, managers, remote workers and departing personnel encounter your security rules. Sterling can help align communicated duties, role-based learning, reporting routes and transition controls with everyday work and the appropriate HR and legal input. Where suitable, the agreed programme can use Effivity ISO & GRC automation software to organise control responsibilities and supporting evidence. Arrange a focused consultation.
Develop control-owner understanding through Sterling Academy’s 93 Annex A Controls training. Training and consulting support implementation; independent certification bodies decide certification outcomes.