ISO 27001 Annex A: people controls (A.6)

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · ISO 27001

A.6 is the people theme: hiring, training, offboarding, and the rules of working. Most of it lives with HR as much as security.

The human layer

The people theme (A.6) recognises that security depends on the workforce. It covers screening before hire, security responsibilities in employment terms, awareness and training, a disciplinary process for violations, responsibilities after employment ends, confidentiality agreements, and remote/secure working.

Shared with HR

Most of A.6 sits at the security/HR boundary: background checks during hiring, security clauses in the employment contract, onboarding that includes policy acknowledgement and training, and offboarding that revokes access. The controls formalise good people processes rather than inventing new ones.

Awareness and conduct

Security awareness training and a clear acceptable-use/disciplinary framework are the recurring operational controls here — every employee trained and bound by the rules, with consequences defined for breaches. These are also the ones with the clearest evidence trail.

The evidence

A.6 is evidenced through records: screening completed, employment terms signed, training done (tied to your roster), policies acknowledged, and offboarding records showing prompt access removal. SentinelPanda tracks training, policy acknowledgement, and joiner/mover/leaver as evidence against these controls.