How to Build a Human Resource Security Policy

Building a human resource security policy means writing a single document that governs how your organization manages people-related risk from the first background check through the final exit interview, anchored to ISO/IEC 27001:2022’s Annex A.6 controls and layered with the federal rules that apply to hiring, pay, and recordkeeping in the United States. The framework tells you what controls to include. Statutes like the Fair Credit Reporting Act, the Fair Labor Standards Act, and the E-SIGN Act tell you how to implement them without generating liability. Get the combination right and the policy holds up in an audit; get it wrong and you have the paperwork equivalent of an unlocked door.

What the Policy Has to Cover

A working HR security policy tracks the employee lifecycle. ISO 27001:2022 organizes its people controls under Annex A.6, and NIST SP 800-53 does something similar through its Personnel Security (PS) control family.¹ Between them, the domains you need to address are pre-employment screening, the terms of employment itself, ongoing responsibilities and training, remote work, internal transfers, offboarding, and third-party access. Leave any of these out and there is a phase of the lifecycle where nobody knows what the rules are.

Before drafting, interview department heads. A software engineering team working with source code needs controls around repository access and code review. A customer service team handling payment card data needs PCI DSS-aligned restrictions. Mapping role-specific risks first keeps the policy from becoming generic boilerplate.

Structural Elements Every Policy Needs

Regardless of the organization’s size, the document itself should carry the same skeleton:

Effective date and review cycle. Annual review is the most common cadence, triggered sooner by a major regulatory change or a security incident.
Scope. Name full-time employees, part-time staff, contractors, temporary workers, and interns explicitly. Ambiguity gets exploited.
Policy owner. Assign a specific role, typically a Chief Information Security Officer or HR Director, responsible for maintaining the document and authorizing exceptions.
Data classification levels. Define categories like public, internal, confidential, and restricted, and attach handling rules to each. Restricted data might require encryption; anything above internal might be barred from personal devices.
Acceptable use rules. Cover company technology, personal device usage, password requirements, and multi-factor authentication with enough specificity that an employee can look up whether a particular action is allowed.

Pre-Employment Screening

ISO 27001:2022 calls for background verification proportional to the sensitivity of the role under Annex A.6.1 (previously A.7.1 in the 2013 edition). Someone handling encrypted financial records warrants deeper scrutiny than someone stocking a warehouse. Verification typically covers criminal history, educational credentials, and prior employment, with costs generally running $30 to $100 or more per applicant depending on how many jurisdictions and databases are searched.

Federal law dictates the procedure. Under the Fair Credit Reporting Act, an employer must provide a clear written disclosure, in a standalone document, that a consumer report may be obtained for employment purposes, and the candidate must authorize the report in writing before the employer requests it.² The standalone-document requirement is the one most employers get wrong. Burying the disclosure inside a broader application form violates the statute even if the candidate signs the application.³

The offer letter or employment agreement then becomes a security control in its own right. Spell out obligations around data handling, acceptable use of company systems, and any non-disclosure requirements tied to the role. Formalizing these in a binding document before day one gives the organization legal footing if it later needs to discipline or terminate someone for a security violation.

Adverse Action When a Background Report Kills a Hire

If something in a background report causes you to rescind an offer, deny a promotion, or terminate an employee, the FCRA requires a two-step notice sequence. Before taking the adverse action, send a pre-adverse action notice that includes a copy of the consumer report and a written summary of the candidate’s rights under the FCRA.² The statute does not specify a waiting period, but the FTC has informally recommended at least five business days so the candidate can review the report and dispute errors. Then send the final adverse action notice, which must identify the reporting agency, state that the agency did not make the decision, and inform the candidate of their right to obtain a free copy of the report and dispute its contents.

The procedure applies to new applicants and current employees alike, and it applies whether the report was the sole reason for the decision or one factor among several. Skipping the pre-adverse notice is what generates class-action FCRA claims, and the statute allows statutory damages per violation without proof of actual harm.⁴

Ongoing Employee Responsibilities

ISO 27001:2022 dedicates several Annex A.6 controls to what happens after hiring: security awareness training (A.6.3), a formal disciplinary process (A.6.4), and incident reporting (A.6.8). NIST SP 800-53 requires organizations to assign risk designations to positions and rescreen individuals periodically based on those designations.¹

Employees need a defined channel for reporting security incidents. “Tell your manager” is not enough. Specify a mechanism, whether a dedicated email address, a ticketing system, or a hotline, and state that reporting a suspected breach is a duty.

Access control is where the policy meets daily practice. The principle of least privilege means each employee gets only the system access their job requires and nothing more.⁵ Permissions accumulate in the absence of active review. Someone who transferred from accounting to marketing two years ago may still hold access to financial systems because no one revoked it. Quarterly access reviews for sensitive systems catch this before it becomes a vulnerability.

The disciplinary section of the policy should be documented in the employee handbook with enough specificity that enforcement is predictable, ranging from a formal warning for a first-time minor lapse to immediate termination for deliberately exfiltrating data. Inconsistent enforcement is nearly worse than none: it tells employees the policy is aspirational.

Remote and Hybrid Work

ISO 27001:2022 added a dedicated remote working control at Annex A.6.7. NIST’s telework guidance recommends that remote workers secure their home Wi-Fi with WPA2 or WPA3 encryption and use a strong network password.⁶ Write those minimums into the policy rather than assuming employees know them.

A VPN should be standard for any remote employee accessing internal systems. NIST recommends using the organization’s own VPN when available, and considering a personal VPN provider when one is not.⁶ The policy should also state whether employees may use personal devices under a bring-your-own-device arrangement or must use company-issued hardware. BYOD requires mobile device management software that can enforce encryption, remotely wipe a lost device, and segregate personal data from corporate data. Add behavioral rules too: screen privacy in public spaces, locking devices when stepping away, and avoiding public Wi-Fi for sensitive tasks.

Internal Transfers and Role Changes

Termination is not the only event that demands access adjustment. NIST SP 800-53 control PS-5 requires organizations to review access authorizations when someone moves to a different role, modify those authorizations to match the new position, and complete the changes within a defined time period.¹ This is the step most organizations skip. A promotion or lateral move triggers new access grants, but the old access rarely gets revoked unless someone actively reviews it. Treat a transfer as a mini-offboarding followed by a mini-onboarding: revoke permissions tied to the old role, document the new manager’s approval, and grant only what the new position needs.

Offboarding

Offboarding is where security failures are most common and least forgivable. ISO 27001:2022 Annex A.6.5 covers responsibilities after termination or role change, and NIST SP 800-53 control PS-4 gives specific instructions: disable system access within a defined time period, revoke all credentials, conduct an exit interview covering security topics, and retrieve all organizational property.¹ The defined time period should be measured in minutes.

Access revocation goes well beyond the primary login. Think about shared cloud folders, project management tools, social media accounts the person managed, vendor portals they used, and personal devices enrolled in mobile device management. A termination checklist covering only Active Directory and badge access will miss half the exposure, so build role-specific checklists. A departing systems administrator requires different deprovisioning than a departing sales representative.

Confidentiality obligations typically survive the end of employment. Non-disclosure agreements signed during onboarding usually contain survival clauses that remain enforceable for a defined period or indefinitely for trade secrets. Reminding the departing employee of these obligations in writing during the exit interview creates a documented touchpoint that helps if the person later shares proprietary information with a competitor. A signed receipt for all returned equipment serves the same evidentiary function.

Contractors and Third Parties

A policy that covers only direct employees leaves a significant attack surface open. Contractors, vendors, and temporary workers often access the same systems and data as full-time staff without the same vetting. ISO 27001:2022 addresses this through its supplier relationship controls, and NIST SP 800-53 includes supply chain risk management as a distinct control family.

At minimum, require any third party with access to sensitive systems to sign a non-disclosure agreement before receiving credentials. The contract should specify what data the third party may access, how they must protect it, and what happens to that data when the engagement ends, including documented destruction or return. Third-party accounts should carry automatic expiration dates tied to the contract term. Assess vendor security before onboarding, reassess periodically rather than once, and apply the same offboarding rigor to a departing vendor as to a departing employee.

Distribution, Acknowledgment, Training, and Records

A drafted policy accomplishes nothing until employees have read and acknowledged it. Distribution typically runs through an internal HR portal or secure email, with each employee providing a digital acknowledgment. These electronic signatures are legally enforceable under the E-SIGN Act, which provides that a signature or contract cannot be denied legal effect solely because it is in electronic form.⁷ Log every acknowledgment with a timestamp.

Training turns acknowledgment into practice. Focus sessions on recognizing a phishing email, labeling a confidential document, and reporting a lost laptop. Track completion alongside the signed acknowledgment so no one gets system access until both are done, and refresh annually as the policy and the threat picture change.

One FLSA detail catches employers repeatedly: mandatory security training for non-exempt employees is almost certainly compensable time. Training counts as hours worked unless all four of the following conditions are met: attendance is outside regular working hours, attendance is truly voluntary, the content is not directly related to the employee’s job, and the employee does no productive work during the session.⁸ Security training that is mandatory and job-related fails at least two of those criteria, so pay for the time.

Retention rules vary by record type. EEOC regulations require personnel records to be kept for at least one year, with involuntary termination records retained for one year from the termination date.⁹ The Department of Labor requires payroll records to be preserved for at least three years.¹⁰ Many organizations hold policy acknowledgments and training records longer than these federal floors, particularly in regulated industries like healthcare and financial services where audit requirements extend further.

1
National Institute of Standards and Technology. NIST Special Publication 800-53 Revision 5 – Security and Privacy Controls
2
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
3
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
4
U.S. Equal Employment Opportunity Commission. Background Checks: What Employers Need to Know
5
National Institute of Standards and Technology. NIST CSRC Glossary – Least Privilege
6
National Institute of Standards and Technology. Telework Security Basics
7
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
8
eCFR. 29 CFR 785.27 – General
9
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
10
U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act