People Controls (Domain 6)

Requirement: Verify the backgrounds of all candidates for employment, prior to joining. Verification depth must be proportionate to the role's access to sensitive information, business criticality, and risk level.

Implementation: Define a screening policy specifying which checks are required for each role category. For high-risk roles (privileged access, financial data access): identity verification, criminal record check (SKCK in Indonesia), employment history verification, reference checks, and qualification verification. For standard roles: identity verification, reference checks minimum.

Common gap: Screening applied inconsistently — conducted for permanent staff but not contractors or temporary workers who may have equivalent or greater access.

Evidence: Screening policy. Per-candidate screening records (consent, checks conducted, outcomes). Role-based screening matrix showing tiering.

Reg: Indonesian Manpower Law screening obligations; UU PDP Article 17 lawful basis for processing applicant personal data; financial sector fit-and-proper requirements (OJK)

Requirement: Employment contracts and agreements must clearly state the employee's responsibilities for information security — what they are required to do, what they are prohibited from doing, and what happens if they do not comply.

Implementation: Review employment contracts and ensure they include: confidentiality obligations, IS policy compliance requirements, consequences for IS policy violation, obligations that survive employment (confidentiality post-departure), and reference to the full IS policy suite. For contractors: equivalent terms in service agreements or contractor agreements.

Common gap: Contractor agreements lack IS clauses. Existing staff contracts pre-date current IS policy — not updated when policies were revised.

Evidence: Employment contract template with IS clauses. Contractor agreement template with IS clauses. Signed contracts for all current in-scope staff and contractors.

Reg: Indonesian Manpower Law employment contract requirements; UU PDP — employee confidentiality obligations for personal data; POJK fit-and-proper requirements

Requirement: All employees and relevant contractors must receive appropriate information security awareness education and training, updated regularly. Training must be relevant to their role.

Implementation: Deliver a tiered awareness program: all staff receive annual security awareness (IS policy, data classification, incident reporting, phishing recognition). Role-specific groups receive targeted training (developers: secure coding; finance: BEC recognition; HR: secure onboarding/offboarding). Maintain completion records. Measure effectiveness through behavioral metrics.

Common gap: Training delivered but not measured for effectiveness. Contractors excluded. New hires complete training after 60+ days rather than within 30.

Evidence: LMS completion records per staff member. Training content for each module. Phishing simulation results. Role-specific training records for targeted groups.

Reg: UU PDP awareness obligation for data processors; POJK staff training requirements for IT risk management

Requirement: A formal disciplinary process must exist for employees who have committed an information security breach. The process must be documented, communicated, and proportionate to the severity and nature of the violation.

Implementation: Define an information security disciplinary procedure. Categories of violation: minor (inadvertent breach, first offense), moderate (negligent breach, policy non-compliance), major (intentional breach, data theft, sabotage). Connect to HR disciplinary process. Ensure HR is briefed on IS policy obligations and can apply the procedure appropriately.

Common gap: Discipline procedure exists in HR policy but no specific IS provisions. Staff do not know that IS violations have formal consequences — procedure was never communicated.

Evidence: Disciplinary procedure document with IS-specific provisions. Evidence that staff have been informed of the disciplinary process (policy acknowledgment).

Reg: Indonesian Manpower Law disciplinary and termination requirements; UU ITE criminal provisions for unauthorized access (crossover for major violations)

Requirement: Information security responsibilities and duties that remain valid after termination of employment must be defined, communicated, and enforced. This includes ongoing confidentiality obligations.

Implementation: Offboarding security checklist covering: (1) access revocation within 4 hours of departure confirmation across ALL systems, (2) asset return (devices, access cards, documents), (3) handover documentation, (4) acknowledgment of continuing confidentiality obligations, (5) final briefing on post-departure data restrictions. For role changes: access rights review and update immediately.

Common gap: 4-hour access revocation SLA exists in policy but not tracked operationally. Physical access cards not recovered. Accounts in cloud systems (SaaS) missed because only AD accounts were revoked.

Evidence: Offboarding checklist and completion records. Access revocation evidence (IAM export showing account disabled on departure date). Asset return records. Signed acknowledgment of continuing obligations.

Reg: Indonesian Manpower Law post-employment obligations; UU PDP continuing confidentiality of personal data; trade secret protections under Indonesian law

Requirement: Requirements for confidentiality or non-disclosure agreements (NDAs) reflecting the organization's information protection needs must be identified, documented, reviewed, and signed by employees and third parties.

Implementation: Identify who requires NDAs: all permanent staff (embedded in employment contract), contractors and consultants (in service agreements), external parties with access to confidential information. Define the information categories covered. Ensure NDAs reference the organization's data classification scheme. Review NDAs when roles or access levels change significantly.

Common gap: NDAs exist for permanent staff in employment contracts but freelancers, contractors, and temporary staff do not have equivalent confidentiality commitments.

Evidence: NDA template(s). Signed NDA records for all in-scope staff and contractors. Evidence that NDAs are renewed/updated when roles change significantly.

Reg: Indonesian trade secret law (UU No. 30/2000); UU PDP confidentiality obligations; contractor confidentiality in POJK outsourcing requirements

Requirement: Implement security measures for staff working remotely — outside the traditional office perimeter. Cover device security, network security, access controls, and the physical environment of the remote workspace.

Implementation: Develop a Remote Working Policy covering: approved devices (corporate-managed only or BYOD with MDM), network requirements (VPN mandatory for production access, no public WiFi without VPN), physical security at home (no family use, clean screen, secure storage of documents), screen lock requirements, and incident reporting when working remotely.

Common gap: Remote working is widespread but no formal policy exists. VPN is available but not mandatory. Staff use personal devices for production access without MDM. No physical security guidance for home offices.

Evidence: Remote Working Policy. Evidence of VPN deployment and usage. MDM enrollment records for remote devices. Staff acknowledgment of remote working policy.

Reg: UU PDP data protection applies regardless of work location; POJK IT risk management in distributed work environments; COVID-era regulatory guidance remains relevant

Requirement: All employees and contractors must be required to report information security events as quickly as possible through appropriate channels. Low-barrier, no-blame reporting is essential to ensure events reach the incident management process before they escalate.

Implementation: Define what counts as a reportable event (broader than most staff think: suspicious emails, lost devices, accidental data disclosure, unusual system behavior, suspected unauthorized access). Establish a simple reporting channel — helpdesk ticket, dedicated email, or mobile app. Train staff to report immediately, without fear of blame. Measure report rate as an ISMS KPI.

Common gap: Staff do not know what to report or who to tell. Fear of blame suppresses reporting — staff who click phishing links hide it rather than reporting. Report rate is near zero, which is the most dangerous signal.

Evidence: Incident reporting procedure. Reporting channel evidence (helpdesk system, email alias). Staff training records covering incident reporting. Incident log showing reports received (high report volume is a positive indicator, not a negative one).

Reg: UU PDP Article 46 — 14-day notification clock starts from discovery; early internal reporting maximizes time for regulatory notification preparation