November 2026. The People theme of Annex A (controls 6.1 to 6.8) is often underestimated in SMEs, yet it produces many audit questions: who gets access, under which agreements, and what happens when someone leaves?
Screening beforehand
Control 6.1 asks for screening of candidates, proportionate to the role and the data they will access, and only as far as the law allows. Think of checking references and diplomas; for sensitive roles a certificate of conduct may be appropriate. Record who checks what and keep only what is needed, with an eye on the GDPR.
Terms of employment and confidentiality
Include information security responsibilities in the employment contract or staff handbook, including confidentiality. Have new employees demonstrably accept the policy. That is evidence for 6.2 and 6.6.
Onboarding: access and training
Tie access requests to a fixed process: the manager requests, an owner approves, IT provisions. Schedule awareness training within a fixed period; see security awareness. A checklist per role makes this repeatable.
Change of role
Do not forget the in-between step: someone who changes department often keeps old rights. Have access reassessed at every role change; that prevents accumulation of rights.
Offboarding: close down on the last day
Revoke accounts, tokens and access badges on the last working day, collect devices and remind the employee of continuing confidentiality (control 6.5). An auditor often asks for a list of recent leavers and then asks for evidence that access was revoked.