NIS2 Art.21.2i: Human Resources Security and Access Control Policies

Build an HR security programme that covers the full employment lifecycle. Before employment: define screening requirements proportionate to each role's sensitivity and include cybersecurity responsibilities in contracts. During employment: deliver security awareness training, enforce acceptable use policies, and review access whenever someone changes role. After employment: revoke access immediately, recover all assets, and handle knowledge transfer. Implement an access control framework grounded in least privilege. Your IAM policy should cover user registration and deregistration, role-based access control (RBAC) with clearly defined roles and permissions, MFA for all remote access and privileged accounts, privileged access management (PAM) with enhanced controls for admin accounts, and password policies aligned with current best practice. Run regular access reviews - quarterly for privileged accounts, semi-annually for standard accounts at a minimum. Each review should verify that access rights match the user's current role and strip out anything unnecessary. Maintain a comprehensive asset inventory covering hardware, software, data assets, cloud resources, and intellectual property. Every asset needs a designated owner, a classification level, and handling requirements that match its classification. Track assets from acquisition through to disposal. Enforce access policies with technical controls: directory services, identity providers with SSO, privileged access management tools, and data loss prevention where appropriate. Define procedures for emergency and temporary access with additional approval requirements, time-limited grants, and enhanced monitoring. Log all access changes so they are fully auditable.