Run the ISO 27001 people controls
Ask AI
Set up the processes, policies and audit trail that operate the HR side of an ISO 27001 ISMS, and know which record answers each audit question
SquadBear operates the ISO/IEC 27001:2022 controls that pass through HR - joiners, movers, leavers, policy acknowledgment and yearly refreshers - and keeps the records an auditor samples. Risk assessment and the Statement of Applicability stay in your ISMS tooling.
Set it up
- Joiners. In Processes, New joiner onboarding ships active and starts from every hire. Add a Policy acknowledgment step for the rules a joiner must accept first, an Upload step with Someone has to check the upload for the signed contract or NDA, and a Decision step if you record screening.
- Movers. New process started by An employee record changes, with a rule on Job title or Role changed. Give the access review A named person and a Decision step.
- Leavers. Employee offboarding ships active: hand over work, revoke access, then collect equipment. Point Revoke system access at whoever removes accounts in your other systems - SquadBear does not deprovision them, but offboarding ends the leaver's own SquadBear sessions, assistant grants and API keys at once.
- Yearly refresher. New process → Annual security training, choose the security policy, activate. It runs on each hire anniversary and waits for a signature on the policy's current version.
- Policies. Upload each policy at Company documents as a Policy, start a campaign for All active employees with a due date, and switch on Ask new joiners to sign the current version under Edit details.
- Access. Require two-factor authentication, or Google or Microsoft sign-in for your domain, at Settings → Security.
Each year
Review every policy and publish the reviewed text as a new version, then start a campaign on it. A signature belongs to one version, so a person who already signed the current one is not asked again - the refresher's policy step closes at once for them.
Which record answers which control
| Control | Record |
|---|---|
| 6.5, 5.11, 5.18 | Processes → Runs: each leaver's and mover's steps with owner and completion time |
| 6.1, 6.2, 6.6 | The onboarding run, with the reviewer of each checked upload |
| 6.3, 7.2 | One Annual security training run per person per year |
| 5.1, 7.3, 7.5 | A campaign's Signers and Export signatures (CSV); versions with their fingerprints |
| 8.15, 5.15 | Settings → Audit log, filtered by person, record or date (Team and Enterprise) |
Worked example
Aleksandra joins Northlake on 3 March: onboarding asks her to sign the information security policy and upload her signed NDA, which Marta checks. When Tomasz becomes a manager, the role-change process gives Marta an access review. Before the audit Marta opens Processes → Runs for the year's leavers, exports the policy campaign and filters Settings → Audit log to role changes.
With an assistant
list_process_runs and get_process_run cover joiners, movers, leavers and refreshers,
list_policies and get_policy_rollout cover signatures, and list_audit_logs covers admin
changes. An assistant signs a policy only for the person who connected it, recorded as the
mcp channel. More in Prompts.