+10. Human resources security
---+10.1 Human resources security
------+10.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
------+10.1.2 The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure …
------+10.1.3 The relevant entities shall review the assignment of personnel to specific roles as referred to in …
---+10.2 Verification of background
------+10.2.1 The relevant entities shall ensure to the extent feasible verification of the background of their …
------+10.2.2 For the purpose of point 10.2.1., the relevant entities shall: (a) put in place criteria, which set …
------+10.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …
---+10.3 Termination or change of employment procedures
------+10.3.1 The relevant entities shall ensure that network and information system security responsibilities …
------+10.3.2 For the purpose of point 10.3.1., the relevant entities shall include in the individual’s terms and …
---+10.4 Disciplinary process
------+10.4.1 The relevant entities shall establish, communicate and maintain a disciplinary process for handling …
------+10.4.2 The relevant entities shall review and, where appropriate, update the disciplinary process at …

10. Human resources security

Human resources security

1. Overview

10.1 Human resources security

Mapping to standards and frameworks

ISO standard 27001:20227.1, 7.2, A.6.2, A.6.3
NIST Cybersecurity Framework v2.0PR.AT-02, GV.RR-04, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1Clause 7.2
CEN/TS 18026:2024HR-01, HR-02, HR-03
BE-CyFun®2023BASIC: ID.GV-1.1, PR.AC-1.1, PR.AC-4.3, PR.IP-11.1
IMPORTANT: ID.AM-6.1, ID.GV-1.2, ID.SC-3.1, PR.AC-2.2, PR.AC-4.6, PR.IP-11.2, DE.CM-6.2
ESSENTIAL: ID.BE-1.2, ID.SC-3.2, ID.SC-3.3
FI-KybermittariWORKFORCE-1, WORKFORCE-2, WORKFORCE-3, THIRD-PARTIES-1, THIRD-PARTIES-2, Management activities
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 4b.c, 7c
ENS-Royal Decree 311/2022Article 15
Annex II: [mp.per.1] Job characterization, [mp.per.2] Duties and obligations, [mp.per.3] Awareness, [mp.per.4] Training, [org.4] Authorization process
FR1.1-IE/EE
2.A.1-IE/EE
2.A.2-EE
2.A.3-IE/EE
3.A.1-IE/EE
3.A.2-IE/EE
3.B.1-IE/EE
3.B.2-IE/EE
10.2 Verification of background

Mapping to standards and frameworks

ISO standard 27001:2022A.6.1
NIST Cybersecurity Framework v2.0GV.RR-04, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.2-09X, REQ-7.2-17
CEN/TS 18026:2024HR-02
BE-CyFun®2023BASIC: PR.IP-11.1
IMPORTANT: PR.IP-11.2
FI-KybermittariWORKFORCE-1
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 10.1a, 10.2
ENS-Royal Decree 311/2022Article 15,Article 16
Annex II: [mp.per.1] Job characterization,
FR4.4-IE/EE
10.3 Termination or change of employment procedures

Mapping to standards and frameworks

ISO standard 27001:2022A.6.5
NIST Cybersecurity Framework v2.0GV.RR-04
ETSI Standard EN 319 401 V3.1.1REQ-7.3.2-07X, REQ-7.4-08X
CEN/TS 18026:2024HR-05, HR-06
BE-CyFun®2023BASIC: ID.GV-3.1, PR.AC-4.3, PR.IP-11.1
IMPORTANT: PR.IP-11.2
FI-KybermittariWORKFORCE-1, ACCESS-1, ACCESS-2, ACCESS-3
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 10.1b
ENS-Royal Decree 311/2022Annex II: [org.2] Security regulations
FR2.B.2-IE/EE
4.3-EE
4.4-IE/EE
10.4 Disciplinary process

Mapping to standards and frameworks

ISO standard 27001:20225.28, A.6.4
NIST Cybersecurity Framework v2.0ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.2-06X
CEN/TS 18026:2024HR-01
BE-CyFun®2023BASIC: ID.GV-3.1
IMPORTANT: ID.GV-3.2
FI-KybermittariWORKFORCE-1
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 10.1c
ENS-Royal Decree 311/2022Annex II: 3.2 Annex II: [org.2] Security regulations
FR2.C.2-IE/EE
3.B.1-IE/EE
3.B.2-IE/EE
4.1-IE/EE

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is related to 10. Human resources security (Article 21(2), point (i), of Directive (EU) 2022/2555)