Policy 7230A - Department of Administration

11. Personnel Security
These Personnel Security Non-Mandatory Procedures support the Enterprise Security Policy
(ITEC 7230 Rev 1), and the Acceptable Internet Use Policy (ITEC 1200).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
11. Personnel Security
11.1. Acceptable Usage
11.1.1. Establish Acceptable Usage Baselines (6 sets) (6 sets)
11.2. Personnel Operations
11.2.1. Establish Pre-Hiring Processes (4 sets) (3 sets)
11.2.2. Hire Employees in a Structured Fashion (3 sets) (1 set)
11.2.3. Transfer Employees in a Structure Fashion (4 sets) (2 sets)
11.2.4. Terminate Employees in a Structured Fashion (3 sets) (1 set)
11.3. Maintain Records
11.1. Acceptable Usage
No applicable Non-Mandatory Procedures.
11.2. Personnel Operations
The following are the Non-Mandatory Procedures that support the Personnel
Operations section of the Default Security Requirements:
11.2.1. Establish Pre-Hiring Processes
Since employees will be assigned access to systems and information Agencies
should take steps to ensure appropriate security considerations are taken into
account:
11.2.1.1 Create Access Agreements
To provide documented records that all personnel have, upon hire,
accepted their information security responsibilities, standardized
access agreements are required:
• Formal access agreements specify the expectations placed
upon employees as well as the standards to which they will be
held.
11.2.1.2 Define Positional Roles
Utilizing role-based access methodology allows for the streamlining of
on-boarding processes and the simplification of employee
management which in turn enhances security:
• Define roles within the organization within which personnel
will be placed using additive rather than exclusive roles where
possible.
• Assign standardized account accesses and permissions to each
role.
37