Requirement
In addition to the subcontrols in the ECC control 1-9-3, cybersecurity requirements in human resources prior to employment, during employment and after termination/separation must include at least the following:
Sub-Controls
1-2-1-1
Requirement: Screening and vetting candidates in jobs related to data handling.
1-2-1-2
Requirement: A signed agreement by personnel pledging to not use social media, communication applications or personal cloud storage to create, store or share the organization's data, with the exception of secure communication applications approved by relevant authorities.
References
- ECC – 2:2024 equivalent: 1-9-3
