Why People Controls Matter in an ISMS
When organisations think about information security, they often jump straight to firewalls, encryption, and access logs. Those technical controls matter, but they only go so far. The uncomfortable truth is that most security incidents trace back to people, not systems. A misconfigured permission, a careless click on a phishing link, or a disgruntled employee walking out with data are all human problems that no firewall can fully prevent.
On this page
ISO 27001:2022 acknowledges this directly. Annex A includes a dedicated category for people controls, labelled A.6. These eight controls address the human dimension of information security across the entire employment lifecycle, from the moment someone is considered for a role to the day they leave the organisation. If you are auditing an ISMS or implementing one, understanding these controls in depth is not optional. They are some of the most frequently misunderstood and poorly implemented controls in the standard.
This guide walks through each of the eight people controls in A.6, explains what they actually require, and gives you the kind of practical audit guidance that comes from real experience sitting across the table from information security managers, HR teams, and IT staff.
Overview of Annex A.6: People Controls
ISO 27001:2022 restructured Annex A significantly from the 2013 version. The new structure groups controls into four categories: organisational controls (A.5), people controls (A.6), physical controls (A.7), and technological controls (A.8). The people controls sit in A.6 and contain exactly eight controls, numbered A.6.1 through to A.6.8.
These controls are not independent checkboxes. They form a logical sequence that follows the employment relationship from start to finish. Understanding that sequence helps auditors see the intent behind each control, not just the words on the page.
For a broader view of how the organisational controls in A.5 work alongside these people controls, the article on Annex A Organisational Controls: A Tour of the 37 Controls in A.5 of ISO 27001 provides useful context.
Exemplar Global Certified Training ProviderRTP No. 310970
A.6.1 Screening
What the Control Requires
A.6.1 requires that background verification checks are carried out on all candidates for employment before they join the organisation. The checks should be proportional to the business requirements, the classification of information they will access, and the risks involved. Relevant legislation must also be considered, particularly privacy laws that govern what an employer can and cannot verify.
What Auditors Should Look For
In practice, this control is often partially implemented. Organisations run police checks for some roles but not others, or they screen permanent employees but skip contractors and third party workers who may have equal or greater access to sensitive systems.
When auditing A.6.1, ask to see the screening policy and then test it against actual hiring records. Look for evidence that the screening criteria are tied to information access levels, not just job seniority. A junior IT administrator with domain admin rights may represent more risk than a senior manager who never touches a system directly.
Common gaps include no screening for contractors, no refresh of checks after significant time has passed, and no documented rationale for what checks apply to which roles. The standard does not prescribe specific checks, so the organisation must be able to justify whatever approach it has taken.
A.6.2 Terms and Conditions of Employment
What the Control Requires
A.6.2 requires that employment contracts and agreements state the responsibilities of employees and other workers in relation to information security. This includes their obligations both during employment and after it ends. Confidentiality requirements, acceptable use, and consequences for breaches should all be addressed.
What Auditors Should Look For
Ask to see a sample of employment contracts, contractor agreements, and any relevant onboarding documentation. Check whether information security obligations are clearly stated, not buried in a general reference to a policy that the employee may never have read.
A common weakness here is that the contract references a security policy but the policy itself is vague or not readily accessible to staff. Another gap is that post-employment obligations, such as returning equipment or maintaining confidentiality of trade secrets, are not explicitly covered.
Also check whether the obligations extend to contractors and third parties. Many organisations have solid employment contracts for permanent staff but weak or non-existent security clauses in contractor agreements. That gap matters because contractors often have significant system access.
A.6.3 Information Security Awareness, Education and Training
What the Control Requires
A.6.3 requires that all personnel receive appropriate awareness education and training, and regular updates on the organisation's information security policies and procedures relevant to their job function. This is one of the most actively audited controls because it is both important and frequently done poorly.
What Auditors Should Look For
Start by asking what training exists and who it applies to. Then test the records. Pull a sample of staff names and check whether they have completed the required training within the required timeframe. Look for evidence that training content is actually updated, not just the same slide deck recycled year after year.
The standard says training should be relevant to job function. That means a developer and a receptionist should not necessarily receive identical training. The developer needs to understand secure coding practices. The receptionist needs to understand social engineering and physical security. Generic annual awareness training that covers everything superficially for everyone is better than nothing, but it rarely satisfies the intent of this control.
Also check whether the organisation tracks completion and follows up on non-completions. Training records with significant gaps, or records that show training was assigned but never completed, are a finding worth raising. The article on Auditing Awareness Under ISO 9001 Clause 7.3: A Practical Guide for Auditors explores similar issues in the quality context and the principles translate directly to ISMS auditing.
A.6.4 Disciplinary Process
What the Control Requires
A.6.4 requires that a formal disciplinary process exists and is communicated to employees. This process should be used to address employees who have committed an information security breach. The control recognises that consequences must be real and known if the organisation expects its security policies to be taken seriously.
What Auditors Should Look For
Ask whether a disciplinary process exists for information security breaches specifically, or whether information security breaches are handled under a general misconduct policy. Either approach can work, but the process must be documented, applied consistently, and communicated to staff.
Look for evidence that employees actually know the process exists. If you ask staff in interviews whether they are aware of the consequences of a security breach, and they give you blank looks, that is a gap in communication regardless of what the policy document says.
One thing to probe is whether the process has actually been used. Organisations with mature security cultures will typically have examples of minor breaches that triggered a formal response. Organisations where the process exists only on paper tend to have no such examples. That is not automatically a nonconformity, but it warrants further questioning.
A.6.5 Responsibilities After Termination or Change of Employment
What the Control Requires
A.6.5 requires that information security responsibilities and duties that remain valid after termination or change of employment are defined, communicated, and enforced. This covers both people who leave the organisation and people who move to a different role within it.
What Auditors Should Look For
The most obvious test for this control is to check what happens when someone leaves. Ask the HR or IT team to walk you through the offboarding process. You want to see that access is revoked promptly, that equipment is returned, and that any ongoing confidentiality obligations are communicated in writing at the point of departure.
Prompt access revocation is a common failure point. In many organisations, IT access is not removed until days or weeks after someone has left. Ask for evidence of recent departures and check the timestamps on access revocation records against the departure dates.
Role changes are often overlooked entirely. When someone moves from a standard user role to a privileged administrator role, or vice versa, their access rights and responsibilities change. Check whether the organisation has a process for reviewing and updating access when roles change, not just when people leave.
A.6.6 Confidentiality or Non-Disclosure Agreements
What the Control Requires
A.6.6 requires that requirements for confidentiality or non-disclosure agreements reflecting the organisation's needs for the protection of information are identified, documented, regularly reviewed, and signed by personnel and other relevant interested parties.
What Auditors Should Look For
Ask to see the standard NDA or confidentiality agreement template. Then check whether it has been signed by a representative sample of staff, contractors, and relevant third parties. Pay attention to whether the agreement is a standalone document or embedded in the employment contract, as either approach is acceptable provided the obligations are clear.
Check the review date on the template. Confidentiality agreements that have not been reviewed for several years may not reflect current data classification requirements or legislative changes. Also check whether the agreements cover the specific categories of information the organisation handles, not just a generic reference to confidential information.
A practical audit question to ask: what happens when a contractor's agreement expires but they continue working for the organisation? Is a new agreement signed, or does the original agreement cover the extended engagement? The answer often reveals whether the process is genuinely managed or just done once and forgotten.
A.6.7 Remote Working
What the Control Requires
A.6.7 requires that security measures are implemented when personnel work remotely to protect information accessed, processed, or stored outside the organisation's premises. This control became significantly more relevant after widespread adoption of remote work arrangements, and it is now one of the more actively scrutinised controls in certification audits.
What Auditors Should Look For
Start by asking whether the organisation has a remote working policy. Then test whether the policy reflects the actual security risks of remote work, including use of personal devices, home networks, physical security of screens and documents, and access to cloud services.
Look for evidence that the policy is enforced, not just distributed. Ask how the organisation knows that remote workers are complying. Common controls include endpoint protection on remote devices, VPN requirements, screen lock policies, and restrictions on printing or downloading sensitive documents to local storage.
Interview a remote worker if possible. Ask them what security measures they follow when working from home. The gap between what the policy says and what staff actually do is often significant. If a staff member tells you they regularly work from a cafe and connects to public Wi-Fi without a VPN, that is a finding regardless of what the remote working policy says.
Also check whether the organisation has addressed the physical security dimension of remote work. Are staff expected to use privacy screens in public places? Are they instructed not to discuss sensitive matters in shared spaces? These physical controls are easy to overlook but they matter.
A.6.8 Information Security Event Reporting
What the Control Requires
A.6.8 requires that the organisation provides a mechanism for personnel to report observed or suspected information security events through appropriate channels as quickly as possible. The control recognises that the people closest to day to day operations are often the first to notice something is wrong, and the organisation needs to make it easy for them to raise the alarm.
What Auditors Should Look For
Ask how staff report a suspected security incident. The process should be simple, well communicated, and genuinely accessible. If the answer is that staff should email the IT helpdesk and then hope for the best, that is not a robust reporting mechanism.
Check whether the reporting channel is documented in the security awareness training. Staff who do not know how to report an event will not report it. Ask a sample of staff in interviews what they would do if they received a suspicious email or noticed that a colleague had left a sensitive document on a printer. Their answers will tell you more than any policy document.
Also check what happens after an event is reported. Is there a log of reported events? Are events triaged and responded to within a defined timeframe? A reporting mechanism that receives reports but never acts on them, or that has no record of any events ever being reported, is a red flag. Either nothing is being reported because staff do not know how, or events are being reported and then lost in the process.
This control connects directly to the ISMS incident management process. If you are auditing A.6.8, it is worth cross-referencing with the technological controls around incident management to check whether the end-to-end process is coherent.
Auditing the People Controls as a Group
One of the most effective audit approaches for A.6 is to trace a single employee through the full lifecycle. Pick a relatively recent hire who has since changed roles or left the organisation, and test each control against their experience. Did they go through screening before joining? Did they sign an NDA? Did they complete security awareness training? Was their access updated when their role changed? Was it revoked promptly when they left?
This lifecycle approach often reveals gaps that a control-by-control review misses. It is easy for an organisation to have a screening policy and an offboarding process that both look reasonable in isolation, but when you trace a real person through both, you discover that the two processes are not connected. The screener never tells IT what access the new hire should have, and IT never tells HR when someone's access has actually been removed.
For guidance on how to sample Annex A controls effectively and decide which ones to focus on during a given audit, the article on Sampling Annex A Controls: A Practical Approach for ISMS Auditors provides a useful framework.
Common Nonconformities in A.6
After conducting ISMS audits across multiple industries and geographies, certain patterns appear repeatedly in the people controls. Here are the most common nonconformities worth looking for:
- Screening not applied to contractors: The screening policy covers employees but contractors, who often have equivalent or greater access, are not screened at all.
- Training records incomplete or outdated: Awareness training is assigned but completion is not tracked, or training has not been updated to reflect changes in policy or threat landscape.
- Access not revoked promptly on departure: IT access remains active for days or weeks after an employee has left, creating a window of risk.
- Remote working policy not enforced: The policy exists but there is no evidence of monitoring or enforcement, and staff behaviour does not reflect the policy requirements.
- No evidence of event reporting: The reporting mechanism exists but there are no records of any events being reported, suggesting either that staff do not know how to use it or that reports are not being captured.
- NDAs not signed by all relevant parties: Permanent staff have signed NDAs but contractors, visitors with access to sensitive areas, or third party service providers have not.
Exemplar Global Certified Training ProviderRTP No. 310970Linking People Controls to the Statement of Applicability
When you audit the people controls, always check the Statement of Applicability first. Each of the eight A.6 controls should appear in the SoA with a clear indication of whether it is applicable, and if it is excluded, the justification for that exclusion must be documented.
A common issue is that organisations mark all people controls as applicable in the SoA but then have no evidence of implementation for several of them. That gap between the SoA and actual implementation is one of the most reliable indicators of an immature ISMS. The article on Checking the Statement of Applicability Against the Risk Treatment Plan: A Practical Audit Guide for ISO 27001 explains how to approach this cross-check systematically.
Training for ISMS Auditors
Auditing people controls effectively requires more than reading the standard. You need to know how to interview HR managers and IT staff, how to cross-reference records across different systems, and how to recognise when an organisation has implemented the form of a control without the substance. That kind of judgement develops through practice and through quality training that goes beyond clause summaries.
Audit Workshop offers ISO 27001 auditor training at Foundation, Internal Auditor, and Lead Auditor levels. The courses are built around practical audit scenarios, not just theory, and they are delivered by an experienced lead auditor who has conducted hundreds of certification audits across multiple industries. If you are building your ISMS auditing skills or preparing to sit a lead auditor examination, the guide to choosing the best ISO 27001 Lead Auditor course is a good place to start.
