CISSP Training Guide

Employment Policies and Practices

Determine how employment policies and practices are used to enhance information security in your organization.

Although the first concern of management might be employees and employment policies, these seem to be the last concerns of information security management. Although various research groups say that most of the threats to information assets are from internal users, employment policies can be used to protect information security assets by setting guidelines for the following:

• Background checks and security clearances

• Employment agreements and hiring and termination practices

• Setting and monitoring of job descriptions

• Enforcement of job rotation

Background Checks and Security Clearances

Those who work for ...