GV.RR-04: Cybersecurity is included in human resources practices

Subcategory is new to this version of the framework and incorporates the following item from the previous version: PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening).

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)

Ex2: Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions

Ex3: Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles

Ex4: Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles

NIST Special Publication 800-53 Revision 5.2.0

PM-13: Security and Privacy Workforce

Establish a security and privacy workforce development and improvement program.

PS-1: Policy and Procedures

Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: [Assignment (one or more): organization-level, mission/business process-level, system-level] personnel security policy that: Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and Procedures to facilitate the implementation…

PS-7: External Personnel Security

Establish personnel security requirements, including security roles and responsibilities for external providers; Require external providers to comply with personnel security policies and procedures established by the organization; Document personnel security requirements; Require external providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or…

PS-9: Position Descriptions

Incorporate security and privacy roles and responsibilities into organizational position descriptions.

NIST SP 800-171 Revision 3.0

03.15.01: Policy and Procedures

Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI. Review and update policies and procedures [Assignment: organization-defined frequency].

Cloud Controls Matrix v4.0

HRS-01: Background Screening Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for background verification of all new employees (including but not limited to remote employees, contractors, and third parties) according to local laws, regulations, ethics, and contractual constraints and proportional to the data classification to be accessed, the business requirements, and acceptable risk. Review and…

HRS-05: Asset returns

Establish and document procedures for the return of organization-owned assets by terminated employees.

HRS-06: Employment Termination

Establish, document, and communicate to all personnel the procedures outlining the roles and responsibilities concerning changes in employment.

HRS-07: Employment Agreement Process

Employees sign the employee agreement prior to being granted access to organizational information systems, resources and assets.

HRS-08: Employment Agreement Content

The organization includes within the employment agreements provisions and/or terms for adherence to established information governance and security policies.

HRS-10: Non-Disclosure Agreements

Identify, document, and review, at planned intervals, requirements for non-disclosure/confidentiality agreements reflecting the organization's needs for the protection of data and operational details.

IAM-07: User Access Changes and Revocation

De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.

Critical Security Controls Version 8.1

6.1: Establish an Access Granting Process

Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights grant, or role change of a user.

6.2: Establish an Access Revoking Process

Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.