Human Resources Security Policy
Security across the employee lifecycle and personnel management
Purpose
Establish standards for managing the security of employees, contractors and third parties, protecting assets and proprietary information and ensuring regulatory compliance. It reinforces individual accountability for internal control and ensures organizational integrity.
Objectives
- Verify the background of candidates and employees according to their risk and access level.
- Ensure everyone understands their information security responsibilities.
- Information security training: general annual training and role-specific training.
- Protect proprietary information during and after employment.
- Maintain security continuity through role changes or terminations.
- Define legal responsibilities and actions in response to non-compliance.
- Evaluate performance and establish incentives that promote compliance and appropriate conduct.
Scope
Applies to all employees, contractors, vendors and third parties with access to the organization's facilities, systems or information.
Standards
Talent Acquisition
- Every vacancy is documented with its level of access to information or systems, which is used to define the required pre-employment screening.
- Validation of the candidate's documents and information before continuing the process.
- Socio-family study and security screening, proportional to the risk of the position.
- Occupational medical exams in accordance with current labor regulations.
Background Checks
- Mandatory for all candidates, proportional to the role and risk.
Terms of Employment
- Integrate security responsibilities into contracts, including the Employee Clauses and the position's Job Description.
- Review and update terms according to policy or role changes.
- Define penalties for non-compliance, including legal and disciplinary ones.
Training and Awareness
- Annual security training for everyone.
- Role-specific training for staff with privileged access, updated regularly.
- Onboarding talk for every new employee, in accordance with the Awareness Procedure.
Confidentiality Agreements
- Signed by employees, contractors and third parties, with clear consequences for breaches.
Access Registration and Provisioning
- Registration of the employee in the HR system and definition of their profile in the roles and responsibilities matrix.
- Automatic first access in the identity provider (IdP) based on the HR registration.
- Secure first-access activation by the employee before their onboarding talk.
Role Changes and Terminations
- Review security roles and responsibilities.
- Revoke unnecessary access and privileges.
- Ensure all organizational assets are returned and accounted for.
- On offboarding, automatic deprovisioning of all credentials and access in the IdP.
Performance Evaluation and Incentives
- Measure the fulfillment of internal control responsibilities.
- Implement corrective actions and disciplinary measures in case of non-compliance.
- Align incentives and rewards with responsibilities and standards of conduct, reviewing them periodically.
Sanctions Process
- Establish clear procedures for violations of security policies or negligence, including possible terminations.
Related Documents
- Talent Acquisition Procedure
- Employee Clauses
- Terms and Conditions for Employees
- Awareness Management Policy
- Awareness Procedure
- Access Management Policy
Monitoring and Review
- HR periodically reviews background checks, contracts, training and exit processes.
- Regular audits, self-assessments and checks ensure compliance.
- Measure training effectiveness through tests, surveys and feedback.
- Evaluate and update policies annually according to threats, regulations and organizational changes.
- Periodically review incentives and pressure on targets to maintain a balanced, effective internal control environment.