Security and Risk Management · Topic 4 of 7
Policies, Personnel Security and Awareness
Policies, standards, procedures and guidelines; hiring, onboarding, transfer and termination controls; and building awareness, training and education programs.
- 3 min
- Policy, standard, baseline, procedure and guideline: only guidelines are optional.
- Screen candidates proportionally; use agreements for acceptable use and confidentiality.
- Remove access at transfer and promptly at termination.
What it is
People and documents carry security into daily work. Policy documentation tells everyone what is required. Personnel security controls risk across the employment lifecycle. Awareness, training and education make sure people know what to do and why.
How it works
The documentation hierarchy
| Document | Nature | Example |
|---|---|---|
| Policy | High-level management intent; mandatory | "All sensitive data must be encrypted in transit" |
| Standard | Specific mandatory requirement | "Use TLS 1.2 or higher" |
| Baseline | Minimum configuration level for a system type | Hardened server build |
| Procedure | Step-by-step instructions; mandatory | How to request a certificate |
| Guideline | Recommended practice; not mandatory | Tips for choosing passphrases |
Policies are approved by senior management, reviewed regularly and rarely changed in detail; technical specifics belong in standards and procedures so they can change faster.
Personnel security across the lifecycle
| Stage | Controls |
|---|---|
| Candidate screening and hiring | Background and reference checks proportional to the role, as the law allows |
| Employment agreements | Acceptable use, non-disclosure and conflict of interest agreements |
| Onboarding | Least-privilege access, training, policy acknowledgement |
| Transfers | Remove access from the old role before or when adding the new one, avoiding privilege creep |
| Termination | Disable access promptly, recover assets, exit interview; for hostile terminations, revoke access at or before notification |
| Vendors, consultants and contractors | Contracts with security requirements, limited and time-bound access, oversight |
Supporting controls
- Separation of duties: no one person completes a sensitive task alone.
- Job rotation: detects fraud and spreads knowledge.
- Mandatory vacations: give time to detect irregularities.
- Least privilege and need to know: only the access the job requires.
- Compliance policy and privacy policy: tell staff and customers how data is handled.
When a user changes role, removing old access is the step that prevents privilege creep. Periodic reviews catch what was missed.
Awareness, training and education
| Level | Goal | Audience | Method |
|---|---|---|---|
| Awareness | Keep security in mind | Everyone | Short, repeated messages, posters, phishing simulations |
| Training | Teach skills for a role | Specific roles | Courses, labs, hands-on practice |
| Education | Build deep understanding and careers | Security professionals | Degrees, certifications |
Good programs are tailored to roles, use varied methods (gamification, social engineering exercises, security champions), cover emerging topics (for example misinformation and AI risks) and are measured. Review content regularly so it stays relevant.
Measuring program effectiveness
Track results, not attendance: phishing click and report rates, incidents caused by human error, policy violations, and time to report suspicious activity.
How the exam asks about this
- "Which document contains mandatory step-by-step instructions?" A procedure.
- "An employee kept rights from three previous roles." Remove access at transfer and review periodically.
- "Short, repeated messages for all staff." Awareness.
What to remember for the exam
- Policy, standard, baseline, procedure and guideline: only guidelines are optional.
- Screen candidates proportionally; use agreements for acceptable use and confidentiality.
- Remove access at transfer and promptly at termination.
- Separation of duties, job rotation and mandatory vacations reduce fraud.
- Awareness for all, training for roles, education for careers; measure behaviour.
Counting training completions does not show that behaviour changed. Measure outcomes such as phishing report rates.
Common mistakes
Putting technical detail in policies. It belongs in standards and procedures.
Leaving access after role changes. Privilege creep follows.
Confusing awareness with training.
Check yourself
Which policy document is recommended but not mandatory?
A guideline.
What control prevents privilege creep when someone changes jobs?
Removing access tied to the old role at transfer, backed by periodic access reviews.
How does mandatory vacation help security?
Someone else performs the duties, which can reveal fraud or irregularities.
Topic 4 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.