ISO 27001 People Controls Explored

Like all Annex A controls, you must consider each one in your Statement of Applicability and justify any exclusions. In practice, very few organisations exclude People Controls because they apply wherever you have staff, contractors, or others with access to your information. Even one-person businesses need to consider most of them, because the controls cover relationships with third parties as well as direct employees.

Start with A.6.2 (terms and conditions of employment) and A.6.6 (confidentiality agreements), because these are usually already partly in place in your existing employment contracts and just need reviewing to confirm the security clauses are present. After that, A.6.3 (awareness, education and training) is usually where most of the new work sits, because formal annual security training isn’t something most SMEs have run before. The remaining controls tend to follow on naturally once these foundations are set.

In larger organisations, HR usually owns most of the People Controls in partnership with IT and information security. In smaller businesses where there’s no dedicated HR function, ownership often sits with the business owner or operations lead, supported by external HR advice if needed. What matters for audit isn’t who owns them but that ownership is documented and the controls are actually being run consistently.

The standard requires training at planned intervals, which most organisations interpret as annually as a minimum. Refresher training after major incidents, significant policy changes, or new threats (such as a wave of phishing attacks affecting your sector) is good practice. Induction training for new starters should happen as part of onboarding, not weeks or months after they’ve started accessing systems.

Auditors will ask for records showing who completed which training and when. This can be as simple as an LMS export, a signed register, or an email with attached training slides and a list of attendees. The format doesn’t matter; the consistency does. Auditors will sometimes ask staff what they remember from the training, so the content also needs to be substantive enough to actually stick.

Not necessarily. The standard requires screening proportionate to the risk of the role and the sensitivity of the information involved. For most SME roles, that means reference checks, right-to-work verification, and confirming employment history. Formal criminal records checks (DBS in the UK) are appropriate for roles handling particularly sensitive data or where regulation requires them. The principle is to match the depth of screening to the level of trust the role requires.

A.6.6 (confidentiality and non-disclosure agreements) and A.6.3 (awareness training) explicitly cover non-employees with access to your information. This means your contractors, freelancers, and third-party staff who handle your data should sign appropriate NDAs and receive (or evidence) appropriate security training. The depth of training needed for a contractor accessing data for two weeks is different from a permanent employee, but the principle of “everyone with access has appropriate awareness” applies to both.

Yes – A.6.7 specifically covers remote working. The control requires that information accessed outside the office is appropriately protected, which usually means a remote working policy covering VPN use, encryption, rules around personal devices, and expectations around physical security in home environments. For SMEs that are predominantly remote or hybrid, A.6.7 is one of the most important People Controls and worth getting right early.

Clause 7 covers the management system requirements around resources, competence, awareness, and communication – it’s about what the ISMS as a whole needs to support its operation. People Controls (A.6) are the specific operational practices that implement those requirements at an individual level. Clause 7 says the organisation must ensure people are competent and aware; A.6 specifies how that’s achieved through training, contracts, screening, and disciplinary processes.

The breach should be handled through your formal disciplinary process (A.6.4), with the response proportionate to the severity. Auditors aren’t looking for harsh punishment; they’re looking for evidence that you take breaches seriously, that there’s a documented process, and that staff understand the consequences exist. A.6.4 also serves a deterrent function – the existence of a formal process reinforces that security policies are genuinely required, not just guidance.