Personnel security
Catalog reference
Make sure staff and direct suppliers understand and accept their security responsibilities, follow the standard cyber hygiene practices, and that privileged users, and management body members, know and keep to their roles. Hire qualified people with reference checks, screening, certificate validation or written tests. Review staff assignments to security roles at least once a year. Where necessary for the role, verify the background of staff and of direct suppliers before they take up duties, with criteria for the roles that need it. Write down in contracts the security duties that continue after the employment ends or changes, such as confidentiality. Keep a disciplinary process for breaches of the security policy, communicate it, and review it on a schedule and after legal changes or major changes. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.
Narrative — how we satisfy this requirement
No narrative yet. Add one.