Policy 7230A - Department of Administration

11. Personnel Security
These Personnel Security Non-Mandatory Baselines support the Enterprise Security Policy
(ITEC 7230 Rev 1), and the Acceptable Internet Use Policy (ITEC 1200).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
11. Personnel Security
11.1. Acceptable Usage
11.1.1. Establish Acceptable Usage Baselines (6 sets) (6 sets)
11.2. Personnel Operations
11.2.1. Establish Pre-Hiring Processes (4 sets) (3 sets)
11.2.2. Hire Employees in a Structured Fashion (3 sets) (1 set)
11.2.3. Transfer Employees in a Structure Fashion (4 sets) (2 sets)
11.2.4. Terminate Employees in a Structured Fashion (3 sets) (1 set)
11.3. Maintain Records
11.1. Acceptable Usage
No applicable Non-Mandatory Baselines.
11.2. Personnel Operations
The following are the Non-Mandatory Baselines that support the Acceptable Usage
section of the Default Security Requirements:
11.2.1. Establish Pre-Hiring Processes
Since employees will be assigned access to systems and information, steps
should be taken to ensure appropriate security considerations are taken into
account:
11.2.1.a Positional Role
• Role definition should be based partially on employee
position:
o Senior management.
o Middle management.
o Senior non-management.
o Non-management.
• Role definition should be based partially on employee
responsibility:
o Administrative staff.
o Non-administrative staff.
• Role definition should be based partially on employee access
requirements:
o Read access.
o Write access.
o Edit access.
o Delete access.
33