Annex A.6 People Controls: What an Auditor Tests
A.6 is the smallest theme in Annex A, eight controls covering the employment lifecycle from screening to what happens after someone leaves. Its difficulty is not the number of controls but the evidence: most of what it produces is a record that somebody signed something, and that is a long way from evidence a control works.
A.6 is the smallest theme in Annex A, eight controls covering the employment lifecycle from screening to what happens after someone leaves. Its difficulty is not the number of controls but the evidence: most of what it produces is a record that somebody signed something, and that is a long way from evidence a control works.
The organisation in the worked finding on this page is invented, and so is the finding.
The eight ISO 27001 Annex A.6 people controls, and the shape they make
Six of the eight map onto the employment lifecycle and two sit outside it. The table below is in lifecycle order rather than control order, because that is the order the evidence arrives in.
| Control | What it requires | Where in the lifecycle |
|---|---|---|
| A.6.1 Screening | Background verification checks on candidates, carried out prior to joining and on an ongoing basis, taking applicable laws, regulations and ethics into consideration, and proportional to the business requirements, the classification of the information to be accessed and the perceived risks | Before, and continuing |
| A.6.2 Terms and conditions of employment | The employment agreements to state the personnel’s and the organisation’s responsibilities for information security | On joining |
| A.6.6 Confidentiality or non-disclosure agreements | Agreements reflecting the organisation’s needs for the protection of information, identified, documented, regularly reviewed and signed | On joining, and for others |
| A.6.3 Information security awareness, education and training | Personnel, and relevant interested parties, to receive appropriate awareness, education and training, and regular updates on the organisation’s policies and procedures, as relevant to their job function | Throughout |
| A.6.4 Disciplinary process | A formalised and communicated process for taking action against personnel and other relevant interested parties who have committed an information security policy violation | Throughout |
| A.6.5 Responsibilities after termination or change of employment | Responsibilities and duties that remain valid after termination or change of employment to be defined, enforced and communicated | On leaving or moving |
| A.6.7 Remote working | Security measures to be implemented when personnel work remotely, to protect information accessed, processed or stored outside the organisation’s premises | Outside the lifecycle |
| A.6.8 Information security event reporting | A mechanism through which personnel can report observed or suspected information security events, through appropriate channels, in a timely manner | Outside the lifecycle |
Remember where the control came from. Annex A is a reference set, and a control is on the audit’s agenda because the organisation selected it at Clause 6.1.3 and recorded that in the Statement of Applicability. What that document claims is the first thing to test. On this theme that matters more than it looks, because several of these controls are so obviously necessary that an auditor can forget to check what the organisation actually claimed about them.
Not sure about the course yet?One year of free retraining on the same exam version is included.
Where ISO 27001 Annex A.6 stops and its neighbours begin
This is the distinction the theme turns on, and it decides which requirement a finding cites.
| The control, in Annex A | The neighbouring requirement |
|---|---|
| A.6.3 — personnel receive awareness, education and training relevant to their job function | Clause 7.3 — persons doing work under the organisation’s control are aware of the policy, their contribution to the ISMS, and the implications of not conforming |
| A.6.3 again, on the training side | Clause 7.2 — the organisation determines the necessary competence, ensures people are competent, acts where there is a gap and evaluates the action |
| A.6.2 — the employment agreement states the personnel’s and the organisation’s responsibilities for information security | A.5.2 — information security roles and responsibilities are defined and allocated according to the organisation’s needs. The neighbour is a control, not a clause; Clause 5.3 is about ISMS roles assigned by top management and is a third thing again |
The useful test is what the evidence would have to show. If it would have to show that a person knows something, you are in Clause 7.3. If it would have to show the organisation determined what was needed and then supplied it, you are in Clause 7.2. If it would have to show what an agreement says, you are in A.6.2; if what the organisation allocated to a named person, A.5.2. And if it would have to show that an arrangement exists for the workforce — a scheme, a mechanism, a standing requirement — you are in A.6.
They overlap deliberately, and the same evidence can support findings at both. What is not defensible is citing the control when your evidence is about a person’s awareness, or citing the clause when your evidence is that the organisation never set anything up.
What ISO 27001 Annex A.6 evidence actually looks like
Four kinds of evidence, and a control is not audited until you have corroborated across more than one of them. What you observe is strongest, because nobody prepared it. Records say what happened, and are worth what your choice of sample makes them worth. Documents say what should happen, and become part of your criteria. What people tell you is a lead, and evidence only once corroborated.
Applied to people controls, that produces a specific difficulty. The two kinds A.6 readily supplies are the two weakest, and there is nothing to observe. A screening record, a signed contract, a training completion log and a signed non-disclosure agreement establish that four things were done on paper. Whether the arrangement behind them works is a question none of them answers.
What partly closes the gap is a conversation — not a test, and not a quiz, but a question that would be answered differently by someone who has absorbed the arrangement and someone who has signed a form about it. Remember what an answer is worth. Testimony is a lead, and evidence only once corroborated, so what a conversation gives you is somewhere to point the next record request.
For A.6.7: where do you work, and what do you do differently there? The remote working policy sets out measures; the answer tells you which of them survived contact with somebody’s kitchen table.
For A.6.5, and specifically its change-of-employment half: you moved from another department — what are you still bound by from the old role? Then go and ask what the organisation did to tell them.
None of those is a test of the individual. You are asking a person a question in order to learn something about the organisation, and it is worth saying so before you ask, because an interviewee who thinks they are being examined will answer differently.
Looking for an approved provider?3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP 6039853.
A worked ISO 27001 finding on Annex A.6.7
Linfield Dairy processes and distributes chilled products from three sites, with a commercial and finance function that has worked partly from home since long before certification.
| Statement | The checks the organisation requires of remote working arrangements are not performed, and the equipment restriction is not applied. |
|---|---|
| Objective evidence | The remote working procedure requires each person approved to work remotely to hold a signed remote working agreement, to use only equipment issued by the organisation, and to have their home working arrangement checked against a five-point list at approval and annually thereafter. Approvals for the period were examined. Thirty-one people are recorded as approved. Signed agreements are on file for all thirty-one. Nineteen of the thirty-one have no record of any check, at approval or since; the remaining twelve have a check recorded at approval and none since, the earliest more than three years old. The human resources manager confirmed that the annual check has never been scheduled and that the five-point list is not held by anyone as a task. Two of the thirty-one confirmed that they routinely use a personal computer for work involving customer pricing data, which the procedure does not permit. |
| Requirement | ISO/IEC 27001 Annex A.6.7 requires security measures to be implemented when personnel are working remotely, to protect information accessed, processed or stored outside the organisation’s premises. The organisation’s remote working procedure, section 4, sets the measures by which it does so: a signed remote working agreement, use of organisation-issued equipment only, and a five-point check of the working arrangement at approval and annually thereafter. |
| Grade | Major — the check the organisation determined its remote working requires has never been performed for a majority of the approved population and has never been repeated for anyone, and nothing owns it, so the continuing half of the control is not operating at all rather than operating imperfectly. The two people using personal computers are recorded because they show the equipment restriction is not holding either; the grade does not rest on them. |
Where the criteria came from matters here as much as anywhere. Nothing in that finding rests on a view about how often a home working arrangement ought to be checked, or about whether personal computers should be allowed. Both came from the organisation’s own procedure. An auditor who supplies either from experience has written a requirement that does not exist, and the auditee is entitled to say so.
One discipline in writing any of these. Record what you were told as fact where it establishes how far the failure reaches; do not write your own diagnosis of why it happened. Causes are the organisation’s to establish under Clause 10.2, and supplying one hands the auditee something to argue about instead of something to answer. The human resources manager’s account that nothing owns the annual check is recorded because it establishes reach — it explains why the gap covers everybody rather than a few. The finding does not go on to say the procedure was written without thought for who would run it.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
Major or minor in ISO 27001 Annex A.6
Grade on evidence and reach. Two features of this theme shape where the line falls.
These controls apply to a population, so a failure that reaches the whole workforce is systemic almost by definition. A missing arrangement is usually a major; a missing record for some of the people covered by an arrangement that exists is usually a minor.
Several of them are contractual, which cuts both ways. A term that exists but is never referred to again is weak evidence of a working control, and a term that is missing cannot be fixed retrospectively for the people already employed under it.
And keep the opportunity for improvement in its place. If a requirement is unmet, it is a nonconformity, however sympathetic the reason; if it is met and could be done better, that is advice the organisation may take or leave. People controls attract the confusion more than most, because it feels harsher to raise a finding about a person than about a firewall. It is not about the person.
Two things ISO 27001 Annex A.6 is not
It is not the human resources audit. You are not testing whether recruitment is well run, whether the training catalogue is good, or whether the disciplinary process is fair. You are testing whether information security is inside those arrangements. Straying past that line is the commonest way an auditor loses the room in this theme, and it is outside the audit scope besides.
And it is not evidence of culture. Auditors are sometimes tempted to write findings about attitude — that people do not take security seriously, that awareness is poor in spirit. There is no requirement of that kind to cite, and a finding built on an impression cannot survive the closing meeting. If the culture is genuinely weak, it will show up as something specific and evidenced: an arrangement absent, records missing across a population, a mechanism nobody can name.
ISO 27001 Annex A.6: what does each people control require?
Pick a control to see what it requires and where it sits in the employment lifecycle.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the table in this article. All eight A.6 controls are carried over from the previous edition; none is new in 2022.
Frequently asked questions about ISO 27001 Annex A.6
How many controls are in ISO 27001 Annex A.6?
Eight, the smallest of the four themes: screening, terms and conditions, awareness and training, disciplinary process, responsibilities after termination or change of employment, confidentiality agreements, remote working, and information security event reporting.
Are any ISO 27001 Annex A.6 controls new in the 2022 revision?
No. All eleven new controls sit in A.5, A.7 and A.8. A.6 was formed by regrouping the human resources security controls of the previous edition into the people theme, and A.6.7 remote working and A.6.8 event reporting were brought in from other domains rather than newly created.
Is an awareness gap an Annex A.6.3 finding or an ISO 27001 Clause 7.3 finding?
It depends on what the evidence shows. If the organisation has no awareness arrangement, or one that does not reach a group it covers, that is A.6.3. If an arrangement exists and a person cannot say what the policy requires of them, that is Clause 7.3. The same visit can produce both, and they answer to different people.
Does ISO 27001 Annex A.6.1 require screening for everyone?
The control asks for background verification checks on candidates, prior to joining and on an ongoing basis, taking applicable laws, regulations and ethics into consideration, and proportional to the business requirements, the classification of the information to be accessed and the perceived risks. Proportionality is built into the control rather than being an exception to it.
What does ISO 27001 Annex A.6.8 require?
A mechanism through which personnel can report observed or suspected information security events, through appropriate channels, in a timely manner. It is about the reporting route rather than about what happens to a report once it arrives, which is where the A.5.24 to A.5.27 incident controls take over.
The other three ISO 27001 Annex A themes
the A.5 organizational controls
the A.8 technological controls
For the requirements these controls sit alongside, the clause map for lead auditors sets out Clauses 4 to 10 with the failure that belongs at each sub-clause.
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is 2889. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply