Human Resources Security Policy

Purpose

This Policy makes sure that the people who work for Tidewell IT are suitable for their roles, understand their security duties, and leave the company in an orderly way. People are our strongest control and our largest risk.

Scope

This Policy applies to candidates, employees, contractors, interns, and members of the Management Board, from the first screening until access ends and the equipment is returned.

Policy statements

Screening

1. Identity and references are checked before an offer becomes final, within the limits of Dutch law and in proportion to the role.
2. A Verklaring Omtrent het Gedrag is required for roles with access to customer environments.
3. Screening is repeated when a person moves to a role with wider access.

Terms of employment

1. A signed confidentiality agreement is in place before the person gets access to any system or information.
2. Contracts state the person's security duties and the consequences of a breach, and these duties continue after the contract ends.
3. Contractors and interns sign the same agreement as employees before their first day.

Awareness and training

1. Every starter completes induction awareness in the first 2 weeks.
2. Everyone completes an annual refresher. A phishing simulation runs every quarter, and people who click receive coaching.
3. Completion is recorded in the Training register and reported to the Management Board.

Competence

1. Each role has a description and the competencies it needs, recorded in the Roles register.
2. Gaps between a person's competence and the role are closed with training, coaching, or a change of tasks.
3. The line manager and the HR Lead review competence in the yearly performance conversation.

Change of role and leaving

1. Access changes on the day a role changes. A mover keeps no access that the new role does not need.
2. A leaver's access ends by the end of the last working day, and equipment, badges, and tokens are returned on that day.
3. The HR Lead reminds a leaver of the duty of confidentiality that continues after the contract.
4. Departed staff are removed from mailing lists, shared channels, and customer contact lists on the day they leave.

Board members

1. Members of the Management Board follow annual cyber risk training, as the Cbw requires, and the attendance is recorded.
2. Board members approve the security policies and answer for the resources that the ISMS needs.
3. The Management Board reviews the state of information security at least once a year in the management review.

Roles and responsibilities

The HR Lead owns this Policy and runs screening, contracts, and leaving. The Service Desk Lead provides and removes accounts and equipment. The ISMS Manager arranges the awareness programme. Line managers confirm what each team member needs. The Management Board is accountable for its own training.

Exceptions

An exception needs a written request to the HR Lead that states the reason, the risk, and an end date, and the ISMS Manager must agree. Access to customer environments is never given without screening.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. Reports about screening or training that was missed are raised as Findings in the next internal audit.

Related documents

• Joiner, Mover and Leaver Procedure
• Security Awareness and Training Procedure
• Access Control Policy
• Acceptable Use Policy
• Information Security Policy

Review

The HR Lead reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.