Content library
TISAX: Information security
2.1.2: Staff compliance with information security policies

Requirement description

Objective: Organizations are subject to legislation, regulations and internal policies. Already when hiring staff, it must be ensured that employees commit to compliance with the policies and are aware of the consequences of misconduct.

Requirements (must): A non-disclosure obligation is in effect.
An obligation to comply with the information security policies is in effect.

Requirements (should): A non-disclosure obligation beyond the employment contract or order is in effect.
Information security aspects are considered in the employment contracts of the staff.
A procedure for handling violations of said obligations is described.

How to fill the requirement

TISAX: Information security

2.1.2: Staff compliance with information security policies

Task name
Priority
Status
Theme
Policy
Other requirements
General security guidelines for staff
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Security guidelines
30
requirements

Examples of other requirements this task affects

29. Processing under the authority of the controller or processor
GDPR
8.3.2: Disposal of media
ISO 27001
9.4.4: Use of privileged utility programs
ISO 27001
11.2.7: Secure disposal or re-use of equipment
ISO 27001
12.1.1: Documented operating procedures
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
General security guidelines for staff
1. Task description

Personnel must have security guidelines that deal with e.g. the following topics:

  • Using and updating mobile devices
  • Storing and backing up data
  • Privacy
  • Using email
  • Handling of printouts, papers and files
  • Reporting incidents
  • Scam prevention
Defining cyber security responsibilities and tasks in employment contracts
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
21
requirements

Examples of other requirements this task affects

7.3: Termination and change of employment
ISO 27001
7.1.2: Terms and conditions of employment
ISO 27001
7.3.1: Termination or change of employment responsibilities
ISO 27001
PR.DS-5: Data leak protection
NIST
PR.IP-11: Cybersecurity in human resources
NIST
See all related requirements and other information from tasks own page.
Go to >
Defining cyber security responsibilities and tasks in employment contracts
1. Task description

The employment contracts specify the responsibilities of the employee and the organization for cyber security.

Contracts should include e.g.:

  • the employee's legal responsibilities and rights, such as those related to copyright or data protection law
  • the employee's responsibility for following the instructions, e.g. related to the use of hardware and data and the classification of information
  • the employee's or temporary employee's responsibility for processing information received from other companies or other parties
  • measures if the employee or temporary worker violates the safety requirements of the organization
  • continuing obligations after termination of employment
Maintaining confidentiality agreements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
24
requirements

Examples of other requirements this task affects

7.3: Termination and change of employment
ISO 27001
7.1.2: Terms and conditions of employment
ISO 27001
7.3.1: Termination or change of employment responsibilities
ISO 27001
13.2.4: Confidentiality or non-disclosure agreements
ISO 27001
T10: Salassapito- ja vaitiolositoumukset
Katakri
See all related requirements and other information from tasks own page.
Go to >
Maintaining confidentiality agreements
1. Task description

All employees handling confidential information should sign a confidentiality or non-disclosure agreement before processing confidential information.

The confidentiality commitment should include, among other things:

  • a clear definition of confidential information
  • the expected duration of the commitment
  • required actions when the commitment is terminated
  • the responsibilities and actions of signatories to prevent unauthorized disclosure of information
  • ownership of information, trade secrets, and intellectual property and how this relates to the protection of confidential information
  • permissible use of confidential information and the signatory's rights to use the information
  • the right to audit and monitor activities involving confidential information

The requirements and needs for confidentiality agreements are reviewed and updated at regular intervals.

Ensuring necessary aspects in personnel's non-disclosure or confidentiality agreements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
2
requirements

Examples of other requirements this task affects

2.1.2: Staff compliance with information security policies
TISAX
6.1.2: Non-disclosure agreement management
TISAX
See all related requirements and other information from tasks own page.
Go to >
Ensuring necessary aspects in personnel's non-disclosure or confidentiality agreements
1. Task description

Organization's confidentiality or non-disclosure agreements continue beyond the employment contract or order.

Organization also has defined a procedure handling violations of the personnel obligations.

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Universal cyber compliance language model: Comply with confidence and least effort

In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.

Security frameworks tend to share the common core. All frameworks cover basic topics like risk management, backup, malware, personnel awareness or access management in their respective sections.
Cyberday’s universal cyber security language technology creates you a single security plan and ensures you implement the common parts of frameworks just once. You focus on implementing your plan, we automate the compliance part - for current and upcoming frameworks.
Start your free trial
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.