# Run the ISO 27001 people controls

> Set up the processes, policies and audit trail that operate the HR side of an ISO 27001 ISMS, and know which record answers each audit question

SquadBear operates the ISO/IEC 27001:2022 controls that pass through HR - joiners, movers,
leavers, policy acknowledgment and yearly refreshers - and keeps the records an auditor
samples. Risk assessment and the Statement of Applicability stay in your ISMS tooling.

## Set it up

1. **Joiners.** In **Processes**, *New joiner onboarding* ships active and starts from every
   hire. Add a **Policy acknowledgment** step for the rules a joiner must accept first, an
   **Upload** step with **Someone has to check the upload** for the signed contract or NDA, and
   a **Decision** step if you record screening.
2. **Movers.** **New process** started by **An employee record changes**, with a rule on
   **Job title** or **Role** changed. Give the access review **A named person** and a
   **Decision** step.
3. **Leavers.** *Employee offboarding* ships active: hand over work, revoke access, then collect
   equipment. Point **Revoke system access** at whoever removes accounts in your other
   systems - SquadBear does not deprovision them, but offboarding ends the leaver's own
   SquadBear sessions, assistant grants and API keys at once.
4. **Yearly refresher.** **New process → Annual security training**, choose the security
   policy, activate. It runs on each hire anniversary and waits for a signature on the policy's
   current version.
5. **Policies.** Upload each policy at **Company documents** as a **Policy**, start a
   campaign for **All active employees** with a due date, and switch on **Ask new joiners to
   sign the current version** under **Edit details**.
6. **Access.** Require two-factor authentication, or Google or Microsoft sign-in for your
   domain, at **Settings → Security**.

## Each year

Review every policy and publish the reviewed text as a new version, then start a campaign on
it. A signature belongs to one version, so a person who already signed the current one is not
asked again - the refresher's policy step closes at once for them.

## Which record answers which control

| Control | Record |
|---|---|
| 6.5, 5.11, 5.18 | **Processes → Runs**: each leaver's and mover's steps with owner and completion time |
| 6.1, 6.2, 6.6 | The onboarding run, with the reviewer of each checked upload |
| 6.3, 7.2 | One *Annual security training* run per person per year |
| 5.1, 7.3, 7.5 | A campaign's **Signers** and **Export signatures** (CSV); versions with their fingerprints |
| 8.15, 5.15 | **Settings → Audit log**, filtered by person, record or date (Team and Enterprise) |

> [!NOTE]
> Export signatures covers one campaign. A joiner asked through **Ask new joiners** or a process
> step appears under **Policy signatures** on their profile, not in a campaign export. Once a
> process step references an uploaded evidence file, only an admin can delete it, and the audit
> entry names the step.

## Worked example

Aleksandra joins Northlake on 3 March: onboarding asks her to sign the information security
policy and upload her signed NDA, which Marta checks. When Tomasz becomes a manager, the
role-change process gives Marta an access review. Before the audit Marta opens **Processes →
Runs** for the year's leavers, exports the policy campaign and filters **Settings → Audit
log** to role changes.

## With an assistant

`list_process_runs` and `get_process_run` cover joiners, movers, leavers and refreshers,
`list_policies` and `get_policy_rollout` cover signatures, and `list_audit_logs` covers admin
changes. An assistant signs a policy only for the person who connected it, recorded as the
`mcp` channel. More in [Prompts](/docs/agents/recipes/).

> [!AGENT]
> Prepare the people-controls status for our management review - policies, joiners, movers, leavers, yearly refreshers and audit log changes since July.

## Related

- [Processes](/docs/processes/overview/)
- [Policies & acknowledgments](/docs/documents/policies/)
- [Data protection and GDPR](/docs/admin/privacy/)