EDUCATION, PERSONNEL SECURITY

👥 Security of personnel

Staff controls shall cover staff, contract staff and partners before, during and after work. A man is the most common attack vector (social engineering) and the most powerful line of protection (human firewall). Basically ISO/IEC 27002 Chapter 6 (8 controls), NIST SP 800-53 PS and safety culture practices. Examples are fictional, designed for training.

Legend: codes as 6.3 refers to ISO/IEC 27002:2022 Chapter 6 (Personal) controls. Some (e.g. 5.11) refers to control of another chapter.

What is staff control

ISO 27002:2022 four control themes - Staff highlighted

ISO 27002:2022 control topics Four ISO 27002:2022 control topics. Staff controls (Chapter 6, 8 controls) are highlighted. ISO/IEC 27002:2022 - 4 control topics Organisational chapter 5, 37 controls Staff chapter 6, 8 controls ← this section Physical chapter 7, 14 controls Technological chapter 8, 34 controls Staff control is the smallest theme in number, but applies to each person in the organisation

Human - weakest link and stronger protection: most violations include the human element (error, manipulation or malice). Staff controls therefore cover the entire working cycle, from pre-acceptance to post-departure duties. A well-trained worker becomes a 'human firewall'.

To people, no technique

Personnel controls manage human behaviour and reliability: testing, contracts, training, reporting, discipline. They are complemented by technical controls - the technique does not stop a worker who is deliberately or accidentally acting incorrectly.

Applicable to all

Not only permanent staff - including contract agents, trainees, partners and service providers with access. Control proportionate to the risk of role risk designation.

Relationship with NIS2 and regulatory acts

Article 21 of the NIS2 requires basic cyber-hygiene practices and security training, including management. National laws and regulations also provide for security measures for personnel. Training is a direct regulatory requirement, not only good practice.

Compliance in Latvia - the main requirement is national laws and regulations: National laws and regulations are mandatory regulations in Latvia that determine what is mandatory (in the national cyber security framework, implementing NIS2). Implementing Regulation (EU) 2024/2690 and GDPR complement the requirements. International standards (ISO 27001/27002, COBIT, SABSA, TOGAF, NIST) provide a recognised auditable method for their implementation.

Levels of compliance - from EU law to implementation Three layers: EU legal basis (NIS2, Implementing Regulation 2024/2690, GDPR), national legislation and international enforcement standards (ISO, COBIT, SABSA, TOGAF, NIST). From requirement to implementation: law defines KO, standards - VU EU LEGAL BASIS NIS2 Directive (EU) 2022/2555 Implementing Regulation (EU) 2024/2690 DGPR (EU) 2016/679 transposed nationally National Cybersecurity Law and its subordinates WHAT to do is mandatory, national cybersecurity legal framework introduced by recognised standards INTERNATIONAL IMPLEMENTATION STANDARDS - HOW ISO 27001 / 27002 COBIT SABSA TOGAF NIST CSF / 800-53

Regulatory acts shall determine the result to be achieved. The international standard is a verifiable way to achieve it - without it compliance remains declarative.

Regulatory acts - mandatory requirement

The binding regulation in Latvia provides for security and training measures for staff. Implementation is based on ISO 27002 Chapter 6 and NIST SP 800-50 Rev. 1 (2024) and 800-53 PS - they provide a specific auditable programme.

Implementing Regulation (EU) 2024/2690

The Annex directly requires basic cyber-hygiene practices and security training (including management) and human resources security. This makes awareness and training (6.3) a legal requirement, not a choice.

GDPR - employee data

Inspection of staff (6.1), monitoring and internal threat programme must be balanced with the protection of employees' personal data (GDPR): proportionality, transparency and legal basis. Excessive observation is both a legal and a cultural risk.

Joiner - Mover - Leafer

Life cycle of an employee - before, during and after the employment relationship

An employee's life cycle and personnel control Three stages - entry, working time, departure or change - each with appropriate ISO 6.x controls. Joiner - Mover - Leaver 1. Entry into service (Joiner) 6.1, Personnel inspection 6.2, Conditions of employment 6.6, Confidentiality (NDA) initial training, access assignment by role 2. During the employment relationship (Mover) 6.3. Awareness and training 6.4, Disciplinary procedure 6.8, Event Reporting change of role → access revision (not only add) 3. Termination or change (Lever) 6.5, Obligations after leaving access withdrawn immediately return of assets (5.11) NDA remains valid, knowledge transfer The weakest stage is usually leaving - forgotten withdrawal of access creates'spoku accounts' (orphaned accounts)

Mover - often forgotten stage: changing roles, new rights add, but old ones do not withdraw - over time accumulated excessive privileges (priviilege creep). Periodic review avoids this.

Verification (6.1)

Examination of identity, education and feedback before acceptance, proportionate to the sensitivity of the role and applicable law. Higher risk roles - in-depth testing. Data protection requirements shall be respected.

Onboarding and access

Access on taking up a job shall be granted on the basis of the least privilege and role (RBAC) rather than the copying of the previous employee's account. Initial security training before access to sensitive data.

Offboarding (6.5)

Upon exit, all access (accounts, cards, VPN, keys) shall be immediately withdrawn, recovered and reminiscent of remaining confidentiality obligations. In the case of hateful departure, access shall be withdrawn prior to notification.

International practice

ISO/IEC 27002:2022 Chapter 6 - 8 Staff Control

Link between ISO Chapter 6 and NIST PS ISO 27002 chapter 6 8 staff control link to NIST SP 800-53 PS family and SP 800-50 training. Personnel controls in international standards ISO/IEC 27002 chapter 6, 8 controls 6.1 - 6.8 NIST SP 800-53 PS family, PS-1 - PS-9 Personnel Security NIST SP 800-50 Rev.1 awareness and training + Article 21 NIS2 Control cards between themselves - one requirement often meets several standards
6.1Staff screening
6.2Conditions of employment
6.3Awareness, education and training
6.4Disciplinary procedure
6.5Obligations after termination
6.6Confidentiality agreements (NDA)
6.7Remote Work
6.8Reporting of security events

NIST SP 800-53 PS family

Personnel Security: Risk classification of PS-2 role, PS-3 verification, PS-4 termination, PS-5 transfer, PS-6 access arrangement, PS-7 external personnel, PS-8 sanctions. Directly maps to ISO 6.x.

Attributes (2022)

Each control has attributes (type, CIA property, cyber security concept, operational capabilities) for filtering and mapping against other frameworks - as in other ISO 27002 topics.

Choice by Risk

Controls shall be selected following a risk assessment and included in the Application Declaration (SoA) in agreement with organisational security. See 'Organic Security' guide.

ISO 6.3 / NIST SP 800-50 Rev.1

Awareness, training, education - the way to a safety culture

Differences in awareness, training and education Three levels - awareness for all, training by role, education for professionals - within a safety culture. Consciousness → Training → Education → Culture Safety culture - safety becomes a habit, not a rule Awareness for all staff Knows that safety is important phishing, passwords posters, short modules Training by role PRASE for a specific task developers, administrators practical exercises Education professionals ISRAEL, why and how certificates, advanced courses professional development

Culture is a goal, not a poster: security culture means that safe action is a default, incidents are reported without fear, and management sets an example. It shall be composed consistently over time and not of one-off training per year.

Role-based

The content is adapted to the role of: developers - safe coding, management - risk decisions and fraud, support - social engineering. General 'one for all' training is inefficient.

Pishing simulations

Controlled phishing training measures real behavior and teaches to recognize. The aim is learning, not punishing - the 'captured' at once micro-learning, not public shame.

Measuring efficiency

Training without measurement is a formality. Follow the reporting level, phishing clicks and reporting indicators, the number of incidents - and adjust the program according to the results.

Social engineering and internal threats

Human factor - manipulation from outside and risk from inside

Social engineering and internal threat types At the top of social engineering techniques, at the bottom three types of internal threat - malicious, negligent, compromised. Human Factor - Two Directions Social engineering (manipulation from outside) Fishing e-mail, SMS, calls Anti-excise fictional reason, role Steiga and Authority 'driver', 'immediate' Drifting USB,'Award' Inside risk (inside) Abuse deliberate damage sabotage, data theft hostile departure Negligence negligence, laziness bypassed policy for convenience most common type Compromised access data stolen account taken victim, not guilty

Most internal threats are not abusive: the most frequent is the negligent employee who makes mistakes or circumvents the control due to convenience. Training, convenient security tools and innocent reporting are therefore more effective than a culture of suspicion.

Protection against manipulation

Training to recognize hurry, authority and curiosity tricks. Procedures for sensitive actions (e.g. changes in payments through a separate channel). 'Stop and Test' culture. Technically - MFA and e-mail filters.

Internal threat indicators

Unusual data download, access outside role or working time, frustration before leaving. Discovered by behavioural analysis (UEBA), magazines and the minimum principle of privilege - not by all supervision.

Balance with privacy

The internal threat programme respects employees' privacy and law - supervision proportionate, transparent and documented. Excessive observation undermines trust and culture by increasing risk.

ISO 6.8 / 6.4 / 6.7

Event reporting, discipline and remote work

Security Events Reporting Flow A flow from the observation of the event to the response and feedback, with the foundation of an innocent culture. Event reporting (6.8) - the sooner, the less damage 1. Pamana employee 2. Report one channel, fast 3. Triage assessed, classified 4 incident process Link 5 thanks feedback urges rereporting - the rapporteur sees this important Just culture report without penalty fear for honest mistakes → more and faster messages; punishment only for malice or intentional violation

Rapid reporting limits damage: if the employee is afraid to report 'I click on the link', the attacker gets hours or days. Easy reporting channel and blameless culture (6.8) are the cheapest and most effective control of early detection.

Event reporting (6.8)

Clear, easily accessible channel (button in e-mail, one number), known to all. Report suspicions, not just confirmed incidents. Speed more important than perfection - details specify triage.

Disciplinary process (6.4)

Formal, fair and proportionate proceedings in case of infringements - known in advance, consistently applied. This discourages intentional violations without creating a culture of fear for honest mistakes.

Remote work (6.7)

Home and public environments pose new risks: screen insight, unsafe networks, private devices, family access. Control - VPN, screen privacy, individual work devices, clear remote work policy.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

NDA
Non-Disclosure Agreement - the confidentiality agreement.
RBAC
Role-Based Access Control - access by role.
UEBA
User and Entity Behavior Analytics - detection of behavioural abnormalities (internal threats).
SoA
Statement of Applicability - the declaration of applicability.
CIA
Confidentiality, Integrity, Availability - confidentiality, integrity, accessibility.
PS
Personnel Security - NIST SP 800-53 staff security controls family.
MFA
Multi-Factor Authentication - multifactor authentication.