Scope Enterprise Active

Human Resource Security

To cultivate a security-conscious workforce and manage human-related risks.

Domain ID
DOM-025
Domain Code
HRS
Business Owner
Human Resources

Domain Overview

HRS · Full Domain Profile
Short Overview

Establishes the processes for securing the workforce through screening, obligations, lifecycle management, and ethical standards.

Description

Focuses on managing the human element of security, including employee lifecycle security (hiring and offboarding), and managing insider risk.

Why This Domain Matters

Disgruntled employees, negligent behavior, and insufficient screening create insider risks that are often overlooked by organizations focused on external threats.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        HRS · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        4 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        HRS-001 Personnel Screening & Verification Establishes personnel screening includin...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        HRS-002 Confidentiality & Employment Obligations Establishes confidentiality and employme...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        HRS-003 Personnel Lifecycle Security Management Establishes personnel lifecycle security...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        HRS-004 Employee Code of Conduct & Ethics Establishes code of conduct including et...
        Administrative
        Detective
        		 Medium Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        40 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        HRS-001-R001 Screening Policy The organization shall establish a perso... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R002 Background Verification The organization shall conduct backgroun... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R003 Identity Verification The organization shall verify the identi... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R004 Employment Eligibility The organization shall verify the employ... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R005 Screening Approval The organization shall approve personnel... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R006 Re-screening Requirements The organization shall establish re-scre... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R007 Screening Exceptions The organization shall manage exceptions... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R008 Screening Documentation The organization shall maintain comprehe... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R009 Screening Review The organization shall conduct periodic... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-001-R010 Continuous Improvement The organization shall establish a conti... HRS-001 Personnel Screening & Verifica... Human Resources, Security, Legal, Compliance View ↗
        HRS-002-R001 Confidentiality Agreements The organization shall require all perso... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R002 Employment Obligations The organization shall define and docume... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R003 Acceptable Use Acknowledgement The organization shall require all perso... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R004 Intellectual Property Protection The organization shall require all perso... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R005 Policy Acceptance The organization shall require all perso... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R006 Periodic Renewal The organization shall periodically rene... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R007 Obligation Monitoring The organization shall monitor complianc... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R008 Documentation The organization shall maintain comprehe... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R009 Obligation Review The organization shall conduct periodic... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-002-R010 Continuous Improvement The organization shall establish a conti... HRS-002 Confidentiality & Employment O... Human Resources, Legal, Information Security, Compliance View ↗
        HRS-003-R001 Recruitment Security The organization shall establish recruit... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R002 Onboarding Security The organization shall establish onboard... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R003 Security Responsibilities The organization shall ensure all person... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R004 Job Description Security Requirements The organization shall include security... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R005 Role Change Management The organization shall manage security w... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R006 Personnel Transfer Management The organization shall manage security w... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R007 Termination Security The organization shall establish termina... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R008 Exit Activities The organization shall establish exit ac... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R009 Post-Employment Obligations The organization shall define and commun... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-003-R010 Continuous Improvement The organization shall establish a conti... HRS-003 Personnel Lifecycle Security M... Human Resources, Information Security, Hiring Managers, IT Operations View ↗
        HRS-004-R001 Code of Conduct Framework The organization shall establish a code... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R002 Ethical Behaviour The organization shall define and commun... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R003 Information Security Responsibilities The organization shall include informati... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R004 Privacy Responsibilities The organization shall include privacy r... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R005 Acceptable Behaviour The organization shall define acceptable... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R006 Policy Compliance The organization shall require all perso... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R007 Violation Reporting The organization shall establish process... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R008 Disciplinary Process The organization shall establish a disci... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R009 Periodic Review The organization shall conduct periodic... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗
        HRS-004-R010 Continuous Improvement The organization shall establish a conti... HRS-004 Employee Code of Conduct & Eth... Human Resources, Legal, Compliance, Information Security, Ethics/Compliance View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED ISO 27001 (Clause 7.2) Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (PR.AT) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        COBIT2019 COBIT (APO07) COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →
        NIST80053 NIST SP 800-53 (PS) NIST SP 800-53 Rev. 5 presents control f...
        NIST
        Control Catalog
        		 vRev. 5 View →
        PCI-DSS PCI DSS (Requirement 12) PCI DSS is an industry security standard...
        PCI
        Standard
        		 v4 View →
        GDPR GDPR (Article 32) The General Data Protection Regulation i...
        EU
        Regulation
        		 vCurrent View →