HRS

Human Resources Security

45 controls

Execute security-informed personnel management practices that address screening, onboarding, acceptable behavior, role-based risk, competence and offboarding requirements.

SCF #	Control Name	Weight	NIST CSF	Frameworks
HRS-01	Human Resources Security Policy	10 — Critical	Govern	6
HRS-02	Human Resources Security Management	10 — Critical	Govern	104
HRS-03	Position Categorization	8 — High	Identify	62
HRS-03.1	Users With Elevated Privileges	10 — Critical	Identify	16
HRS-03.2	Competency Requirements for Security, Compliance & Resilience-Related Positions	9 — Critical	Identify	66
HRS-04	Defined Roles & Responsibilities	10 — Critical	Identify	117
HRS-04.1	Assigned Roles & Responsibilities Awareness	9 — Critical	Identify	42
HRS-05	Personnel Screening	10 — Critical	Identify	77
HRS-05.1	Roles With Special Protection Measures	9 — Critical	Identify	42
HRS-05.2	Citizenship Requirements	5 — Medium	Identify	8
HRS-06	Terms of Employment	10 — Critical	Identify	80
HRS-06.1	Rules of Behavior	10 — Critical	Identify	85
HRS-06.2	Social Media & Social Networking Restrictions	9 — Critical	Identify	44
HRS-06.3	Technology Use Restrictions	10 — Critical	Identify	62
HRS-06.4	Use of Critical Technologies	9 — Critical	Identify	15
HRS-06.5	Use of Mobile Devices	9 — Critical	Identify	20
HRS-06.6	Security-Minded Dress Code	1 — Low	Protect	0
HRS-07	Access Agreements	10 — Critical	Identify	51
HRS-07.1	Confidentiality Agreements	10 — Critical	Identify	67
HRS-08	Onboarding, Transferring & Offboarding Personnel	9 — Critical	Govern	27
HRS-08.1	Formal Indoctrination	7 — High	Identify	30
HRS-08.2	Policy Familiarization & Acknowledgement	8 — High	Identify	25
HRS-08.3	Post-Employment Requirements Awareness	5 — Medium	Protect	7
HRS-08.4	Post-Employment Requirements Notification	8 — High	Protect	8
HRS-09	Probationary Periods	1 — Low	Detect	3
HRS-10	Personnel Sanctions	9 — Critical	Respond	53
HRS-10.1	Workplace Investigations	8 — High	Respond	14
HRS-10.2	Updating Disciplinary Processes	3 — Low	Identify	1
HRS-10.3	Preventative Access Restriction	5 — Medium	Protect	1
HRS-11	Personnel Transfer	9 — Critical	Identify	45
HRS-12	Personnel Termination	9 — Critical	Protect	55
HRS-12.1	Automated Employment Status Notifications	5 — Medium	Protect	13
HRS-12.2	Asset Collection	9 — Critical	Protect	8
HRS-12.3	High-Risk Terminations	9 — Critical	Protect	24
HRS-13	Third-Party Personnel	10 — Critical	Identify	40
HRS-14	Separation of Duties (SoD)	7 — High	Protect	65
HRS-15	Incompatible Roles	8 — High	Protect	11
HRS-16	Identify Critical Skills & Gaps	5 — Medium	Protect	9
HRS-16.1	Remediate Identified Skills Deficiencies	5 — Medium	Protect	3
HRS-16.2	Identify Vital Security, Compliance & Resilience Staff	5 — Medium	Protect	2
HRS-16.3	Establish Redundancy for Vital Security, Compliance & Resilience Staff	5 — Medium	Protect	3
HRS-16.4	Perform Succession Planning	5 — Medium	Protect	3
HRS-17	Identifying Authorized Work Locations	8 — High	Protect	4
HRS-17.1	Communicating Authorized Work Locations	8 — High	Protect	4
HRS-18	Reporting Suspicious Activities	7 — High	Protect	8

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Human Resources Security

Manage SCF Controls in SCF Connect