ISO/IEC 27001:2022 Annex A · 8 controls
People controls
The controls about the people doing the work: before they join, while they are there, and after they leave. Screening, what their contract says about security, whether they have been made aware of what is expected, and what happens when someone does not follow it.
- A.6.1Background checks before hiring
- A.6.2Security duties written into employment terms
- A.6.3Training people to work securely
- A.6.4Consequences when the rules are broken
- A.6.5Duties that outlast someone leaving or moving
- A.6.6Confidentiality agreements
- A.6.7Working securely away from the office
- A.6.8Making it easy for staff to report problems
Every control here needs an applicability decision and a justification in your Statement of Applicability, including the ones you exclude. What certification costs, and which clauses StandardOS covers.
Decide all 8 in one pass
StandardOS pre-fills applicability and a draft justification for every Annex A control from a seven-question profile, keeps each draft marked as unreviewed until you have made it yours, and tracks implementation against each one.