+10.1 Human resources security
---+10.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
---+10.1.2 The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure …
---+10.1.3 The relevant entities shall review the assignment of personnel to specific roles as referred to in …

10.1 Human resources security

Mapping to standards and frameworks

ISO standard 27001:20227.1, 7.2, A.6.2, A.6.3
NIST Cybersecurity Framework v2.0PR.AT-02, GV.RR-04, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1Clause 7.2
CEN/TS 18026:2024HR-01, HR-02, HR-03
BE-CyFun®2023BASIC: ID.GV-1.1, PR.AC-1.1, PR.AC-4.3, PR.IP-11.1
IMPORTANT: ID.AM-6.1, ID.GV-1.2, ID.SC-3.1, PR.AC-2.2, PR.AC-4.6, PR.IP-11.2, DE.CM-6.2
ESSENTIAL: ID.BE-1.2, ID.SC-3.2, ID.SC-3.3
FI-KybermittariWORKFORCE-1, WORKFORCE-2, WORKFORCE-3, THIRD-PARTIES-1, THIRD-PARTIES-2, Management activities
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 4b.c, 7c
ENS-Royal Decree 311/2022Article 15
Annex II: [mp.per.1] Job characterization, [mp.per.2] Duties and obligations, [mp.per.3] Awareness, [mp.per.4] Training, [org.4] Authorization process
FR1.1-IE/EE
2.A.1-IE/EE
2.A.2-EE
2.A.3-IE/EE
3.A.1-IE/EE
3.A.2-IE/EE
3.B.1-IE/EE
3.B.2-IE/EE

1. Ħarsa ġenerali

10.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …

Requirement

For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall ensure that their employees and direct suppliers and service providers, wherever applicable, understand and commit to their security responsibilities, as appropriate for the offered services and the job and in line with the relevant entities’ policy on the security of network and information systems.

Guidance

  • Define clear security roles and responsibilities for employees, aligned with the entity’s security policies and each employee’s functional role . Define relevant security responsibilities for direct suppliers and service providers, within the scope of contractual obligations, ensuring they are appropriate to the nature of the services provided and aligned with the entity’s overall security requirements.
  • Establish onboarding and continuous education programmes that include both security awareness and role-specific cybersecurity training tailored to different risk exposures.
  • Implement periodic assessments to evaluate understanding of security responsibilities, supported by mandatory refresher training as needed.
  • Ensure that security responsibilities are formally documented and integrated into job descriptions, contractual agreements and performance review processes. Incorporate relevant security responsibilities into contractual agreements or service-level agreements (SLA), for direct suppliers and service providers with clear language regarding expectations and compliance requirements.
  • Promote a culture of accountability by requiring formal acknowledgement of security obligations and by linking compliance to incentives and disciplinary measures, where appropriate.
  • Develop and maintain a centralized repository of training records, acknowledgements, certifications and contractual clauses to demonstrate compliance and facilitate audits.
  • Require suppliers and service providers to designate responsible contacts for cybersecurity and encourage or mandate participation in relevant security briefings or training programmes provided by the entity.

Examples of evidence

  • List of employees whose roles require specific security skills and their assignment to roles.
  • Documented evidence of regular training sessions on security of network and information systems for employees, direct suppliers and service providers, wherever applicable. This includes attendance records, training materials and feedback forms.
  • Signed acknowledgements from employees, direct suppliers and service providers, wherever applicable, confirming they have read, understood and agreed to comply with the policy.
  • Reports from internal or external audits assessing the understanding and implementation of security responsibilities among employees, direct suppliers and service providers, wherever applicable.
  • Inclusion of security responsibilities, where relevant, in employee performance reviews and evaluations.
  • Contracts with direct suppliers and service providers that include clauses on security responsibilities and compliance with the entity’s policies or written justifications by the direct supplier or service provider in cases where these clauses do not exist in the contract.
  • Certifications or attestations of cybersecurity skills from nationally recognized or accredited bodies confirming that a person fulfils specific requirements regarding cybersecurity knowledge and skills.
10.1.2 The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure …

Requirement

The requirement referred to in point 10.1.1. shall include the following: (a) mechanisms to ensure that all employees, direct suppliers and service providers, wherever applicable, understand and follow the standard cyber hygiene practices that the entities apply pursuant to point 8.1.; (b) mechanisms to ensure that all users with administrative or privileged access are aware of and act in accordance with their roles, responsibilities and authorities; (c) mechanisms to ensure that members of management bodies understand and act in accordance with their role, responsibilities and authorities regarding network and information system security; (d) mechanisms for hiring personnel qualified for the respective roles, such as reference checks, vetting procedures, validation of certifications or written tests.

Guidance

  • Implement regular awareness raising on cyber hygiene practices for users, tailored to different roles and responsibilities (Annex to the regulation, point 8.1). Wherever applicable, require employees of direct suppliers and service providers, to follow similar awareness raising on cyber hygiene via contractual clauses.
  • Communicate clear and concise cyber hygiene practices for users to all employees, suppliers and service providers. Require acknowledgement of receipt and understanding (Annex to the regulation, point 8.1).
  • Consider specialised training for users with administrative or privileged access, focusing on their specific responsibilities (Annex to the regulation, point 8.2).
  • Establish performance metrics related to security responsibilities and include them in management evaluations.
  • Hold regular briefings for members of management bodies on the importance of network and information system security, their specific responsibilities and the potential impact of incidents (section 8.2).
  • Conduct thorough reference checks, where appropriate, to verify the candidate’s previous experience and performance in similar roles.
  • Consider vetting procedures, including background checks (section 10.2), to ensure the candidate’s suitability for the role.
  • Validate any relevant certifications claimed by the candidate, to ensure they are current and legitimate.
  • Use written tests or practical assessments to evaluate the candidate’s knowledge and skills related to network and information system security.
  • Use interview panels, where appropriate, that also include security experts, to assess the candidate’s technical and behavioural competencies.

Examples of evidence

  • Training and awareness raising material such as videos, slides, emails, newsletters, posters and intranet announcements.
  • Documented records showing that all users with administrative or privileged access were properly informed and are aware of and are following their network and information security roles, responsibilities and authorities.
  • Contractual agreements, the policy on the security of network and information systems, terms and conditions, code of conduct and other documentation confirming that all users have understood and are following the standard cyber hygiene practices for users (signed employment contracts and any proof of employees having been informed of their responsibilities relating to network and information security).
  • Records of security training sessions provided to employees, including attendance logs and training schedules.
  • Evidence, for example attendance certificates where relevant, that suppliers and service providers receive security training relevant to their roles.
  • Mechanisms for hiring qualified personnel (e.g. reference check, validation of certifications and written tests) in place.
  • Use of relevant cybersecurity frameworks and standards along with widely recognised quality management and capability maturity models and standards.
10.1.3 The relevant entities shall review the assignment of personnel to specific roles as referred to in …

Requirement

The relevant entities shall review the assignment of personnel to specific roles as referred to in point 1.2., as well as their commitment of human resources in that regard, at planned intervals and at least annually. They shall update the assignment where necessary.

Guidance

  • Set up a formal schedule for reviewing personnel assignments and resource commitments. This should occur at least annually.

Examples of evidence

  • Up-to-date list of employees and their assignment to roles.
  • Records of the review process, including the criteria used, the findings and any changes made.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is related to 10.1. Human resources security