Show me new joiners accepted the rules before they started.
Hiring someone starts onboarding. Its policy step waits until the new person signs, and its upload step holds the signed NDA until an admin or manager has checked it.
ISO/IEC 27001:2022
The people side of ISO 27001, with the evidence on file
Joiners, movers and leavers run as processes with owners and dates. Policies are signed per version, refreshers come round every year, and every admin change lands in the audit log. SquadBear runs the HR controls of your ISMS, and your AI assistant can pull the status together in one question.
SquadBear doesn't certify you and isn't a full ISMS tool. It runs the controls that live in HR.
You
Prepare the people-controls status for Thursday's management review.
Assistant · ISO 27001
People controls, Q3
- Policies5.1 · 7.35 of 6 fully signed · InfoSec v4: 41/46, 2 overdue
- Joiners6.1 · 6.2 · 6.63 onboardings · NDA and policies signed
- Movers5.182 access reviews · both closed
- Leavers6.5 · 5.11Access revoked 6/6 · 1 laptop not back
- Refreshers6.311 done this quarter · 1 due Oct 17
- Audit log8.1537 changes since July · 2 role changes, 1 revoked signature
What the auditor asks for
Six questions every audit samples
Surveillance and recertification audits keep coming back to the same people questions. Each one should be a lookup, not a week of forwarding emails.
Show me access was reviewed when this person changed roles.
A process starts when a job title, role or manager changes. The access review has a named owner, and the decision is recorded with who made it and when.
Show me this leaver lost access on their last day.
Offboarding starts by itself, access before equipment, and each step records who closed it and when. The leaver's SquadBear sessions, assistant connections and API keys end in the same moment.
Show me last year's security awareness, person by person.
Annual security training runs on each hire anniversary and waits for that person's signature on the current security policy. One run per person per year, each with its completion time.
Show me staff acknowledged the current information security policy.
Each version is pinned with a SHA-256 fingerprint, and each signature records the typed name, that fingerprint, the time and the channel. The campaign roster exports to CSV.
Show me who changed roles and permissions in your HR system.
Role changes, MFA settings, policy and signature changes and process steps go to an audit log that is never pruned, filterable by person, record or date.
Control map
Where SquadBear fits in Annex A
Numbers follow ISO/IEC 27001:2022. "Runs it" means the control operates in SquadBear and the evidence is produced there. "Supports it" means SquadBear holds the task or the record, and part of the control lives elsewhere.
| Control | In SquadBear | Evidence you hand over |
|---|---|---|
| Joiners, movers and leavers | ||
| 6.5 · 5.11Leavers' responsibilities and return of assetsRuns it | Offboarding starts when someone is offboarded - hand over work, revoke access, then collect equipment - each step with an owner and a due date. Their open approvals and steps move to their manager. | One run per leaver with every step's owner and completion time, and each step change on the audit log. |
| 6.2 · 6.6Terms of employment and confidentiality agreementsSupports it | Onboarding starts from the hire. A policy step waits for the signature, and an upload step collects the signed contract or NDA, with an optional check by an admin or manager. | The run's timeline - owner, completion time and reviewer for each step - and the uploaded file on the person. |
| 5.18Access rights for joiners, movers and leaversSupports it | A process can start on a hire, an offboarding, or a change of job title, role or manager, and gives the access work a named owner. Removing access in your other systems stays a task - SquadBear does not deprovision them. | Completed access steps and decisions with owner and time. |
| 6.1ScreeningSupports it | A task, upload or decision step in onboarding records that screening was done and by whom. SquadBear doesn't run background checks. | The completed step with its owner and time. |
| Awareness and training | ||
| 6.3 · 7.2Awareness, education and trainingSupports it | The Annual security training template runs on each hire anniversary and waits for the current security policy to be signed. Add an upload step if you also collect a course certificate. | One run per person per year, with completion times. |
| Policies | ||
| 5.1 · 7.3Information security policies and awareness of themRuns it | Company documents with immutable versions, and campaigns that ask an audience to sign one version by a date. Reminders reach only the people who haven't signed. | Per campaign: who was asked, status, signed at (CSV). Per signature: typed name, version fingerprint, time, channel. |
| 7.5Documented informationSupports it | Policy versions are never edited or deleted, and "In force since" records when each text took effect. | Version history with a fingerprint per version. |
| 5.10 · 6.4 · 6.7 · 7.7Acceptable use, disciplinary process, remote working, clear deskSupports it | The same campaigns, for the rules these controls expect people to know. Enforcing them happens outside SquadBear. | Signatures per version, as above. |
| Access and audit trail | ||
| 5.15 · 5.17 · 8.5Access to SquadBear itselfRuns it | Four roles, workspace-wide MFA with a grace period, passkeys, and Google or Microsoft sign-in you can require for your domain. Offboarding ends the leaver's sessions, assistant grants and API keys. | The MFA compliance report, and audit entries for role and sign-in policy changes. |
| 8.15Logging, for your HR systemSupports it | Admin changes to people, roles, policies, signatures, processes and settings go to an audit log that is never pruned. Viewing it needs the Team or Enterprise plan. | The audit log, filtered by person, record or date range. |
| Privacy | ||
| 5.34Privacy and protection of PIISupports it | EU or US data region, a person's data export, and erasure that keeps compliance evidence under a placeholder name. | The export file and the erasure receipt. |
How it works
Evidence as a by-product of the work
Processes run the joiner, mover and leaver steps, campaigns collect policy signatures, and the audit log records every admin change. The evidence is what the work leaves behind.
Joiners · 6.1 · 6.2 · 6.6
Joiners start with the rules signed
Hiring someone starts New joiner onboarding, with owners and dates counted from the start date. A policy step makes the run wait until the new person signs, an upload step that someone has to check holds the signed NDA, and a decision step records that screening came back clear.
CreatedOnboarding
Onboarding checklist
- Prepare laptop and accounts
MartaSep 14start −2d - Welcome email + first-day plan
JuliaSep 15start −1d - Sign the employee handbookEmilySep 17start +1d
- Profile & emergency contactsEmilySep 18start +2d
Movers · 5.18
Movers get an access review
A process can start whenever someone's job title, role or manager changes. Give the access review a named owner and a decision step, and every move leaves a record of who checked what. The Manager change handover template ships ready to adapt.
Processes · Active
Access review on role change
StartsWhen someone’s record changes
Job title or Role changed- 1Review access for the new roleTask · start +2 days
Adam - 2Does access match the role?Decision · Matches / Needs changesAdam
Julia Mazur · Product Designer → Design Lead · run started Oct 2Leavers · 6.5 · 5.11 · 5.18
Leavers, in the right order
The offboarding template revokes access before the kit comes back and tells HR when both are done. Every step records who closed it and when, and SquadBear ends the leaver's own sessions and assistant connections the moment they're offboarded.
InactiveSquadBear sessions, AI assistants and API keys ended · Sep 30, 17:40
Process
Employee offboarding
- Hand over ongoing workMarta
- Revoke system accessMarta
- Collect the equipmentJulia
- Exit checkpoints cleared (to HR)Message
Training · 6.3 · 7.2
A refresher on every hire anniversary
Annual security training sends a message on each person's hire anniversary, then waits until they've signed the current security policy. Publish each year's reviewed text as a new version and the refresher asks for that year's signature.
Processes · Compliance
Annual security training
Tomasz Wójcikanniversary Sep 12Signed v4
Natalia Barananniversary Sep 26Signed v4
Magda Królanniversary Oct 3Due Oct 17
Policies · 5.1 · 7.3 · 7.5
Policies signed per version
Publishing pins the file's SHA-256 into an immutable version. Start a campaign for everyone, a team or one person with a due date, and reminders go only to people who haven't signed - days 1 and 3 overdue, then weekly to day 30. Ask new joiners to sign the current version covers everyone hired later.
Documents · ISO 27001 Campaign
Information Security Policy
ISO 27001:2022 · Version 4.0 · Effective 15 Jul 2026
Signed
31
of 46 people
Pending
15
reminders sent
Compliance
Audit-ready
Audit log
67% complete
Access and audit · 5.15 · 8.5 · 8.15
Who changed what, kept for good
Require MFA for the whole workspace, or Google or Microsoft sign-in for your domain. Role changes, MFA settings, policy and signature changes and process steps go to an audit log that is never pruned - filter it by person, record or date when the auditor asks. Viewing it needs Team or Enterprise.
Settings · Audit log
Changes since Jul 1
- Oct 4, 08:30
employee.updatedTomasz W. · role: managerMarta Z. - Oct 3, 11:02
policy.acknowledgment_revokedInfoSec v4 · reason recordedMarta Z. - Oct 2, 09:15
policy.rollout_createdInfoSec v4 · all active · 46Marta Z. - Sep 30, 17:52
process_action.completedRevoke system access · Filip K.Marta Z. - Sep 29, 10:20
mfa.policy_updatedMFA required · 14-day graceMarta Z.
With your AI assistant
Run the ISMS chores from Claude or ChatGPT
Connect SquadBear over MCP and your assistant works under your own login and role. It can pull a management-review status across every control, check on leavers and refreshers, start a policy campaign and chase who's left - and every change lands on the same audit trail as the app.
ISMS lead · ClaudeExample workflow
Prompt
Prepare the people-controls status for Thursday's management review - policies, joiners, movers, leavers, yearly refreshers and audit log changes since July.
Sample record
list_policies6 policies · Information Security v4: 41 of 46 signed, 2 overdue · 5 others fully signed
Inspect query parameters
{}Sample record
list_process_runs3 runs since Jul 1 · 3 completed · policy and upload steps done
Inspect query parameters
{ "processId": "prc_onboarding" }Sample record
list_process_runs2 runs · 2 completed · decision: matches the role
Inspect query parameters
{ "processId": "prc_role_change_review" }Sample record
list_process_runs6 runs · 5 completed · 1 active: Collect the equipment (Filip K., owner Julia)
Inspect query parameters
{ "processId": "prc_offboarding" }Sample record
list_process_runs12 runs this quarter · 11 completed · 1 active, due Oct 17
Inspect query parameters
{ "processId": "prc_security_training" }Sample record
list_audit_logs37 entries · 2 role changes · 1 policy.acknowledgment_revoked · mfa.policy_updated
Inspect query parameters
{ "from": "2026-07-01" }Status for the review: 5 of 6 policies are fully signed; InfoSec v4 is missing 5 people, and Nora and Oskar are overdue. Three onboardings closed with the NDA signed, and both role-change access reviews are closed. All six leavers lost access on their last day; Filip’s laptop isn’t back yet (Julia’s step). 11 yearly refreshers are done and one is due 17 October. Audit log: 37 changes since July, including 2 role changes and 1 revoked signature with its reason. I didn’t change anything.
Every tool shown ships in the product
Prompts that work today
“Prepare the people-controls status for our management review - policies, joiners, movers, leavers, refreshers and audit log changes since July.”
list_policies · list_process_runs · list_audit_logs
“Did everyone who joined since July finish onboarding, including the NDA upload?”
list_process_runs · get_process_run
“Which leavers this month still have offboarding steps open, and who owns them?”
list_process_runs · get_process_run
“Whose annual security refresher is open right now, and when is it due?”
list_process_runs · get_process_run
“Make the v4 file I uploaded the active Information Security Policy and ask everyone to sign it by the end of the month.”
list_files · publish_policy_version · create_policy_rollout
“Show me every role change and revoked signature since the last audit.”
list_audit_logs · Team and Enterprise
Why your auditor can live with it
- Your login, your role
- The assistant connects with your own OAuth sign-in, not a shared service account, and can do only what you could do in the app.
- Bigger changes need a click in SquadBear
- Starting a process, changing workspace settings or a leave policy, and erasing a person wait for approval of the exact plan in the app. The assistant's token can't approve them.
- Signing stays personal
- Acknowledging a document needs its own permission. An assistant can sign only for the person who connected it, and the signature records that it came through an assistant.
- Leavers lose their assistants too
- Offboarding revokes the leaver's assistant grants and API keys in the same step that deactivates them.
SquadBear in your supplier register
Answers for your supplier review
SquadBear holds personal data, so it belongs in your supplier register (Annex A 5.19 to 5.23). These are the answers that review usually needs.
Data region
EU or US, chosen at sign-up and fixed. Each region has its own database and file store.
Tenant isolation
Every query is scoped to the signed-in workspace, and the database refuses a row that points at another one.
Subprocessors
Cloudflare hosts the app, data, files and email. Stripe and Google or Microsoft sign-in take part only if you turn them on.
AI boundaries
Optional summaries use Cloudflare Workers AI without author labels. A connected assistant receives only the tool results its user is allowed to see.
Questions, answered
Does SquadBear make us ISO 27001 compliant?
No tool does. Certification covers your whole ISMS - scope, risk assessment, Statement of Applicability, internal audit and management review. SquadBear runs the people controls inside it and keeps their evidence, the part that usually lives in spreadsheets and inboxes.
Which events can start a process?
A hire, an offboarding, a change to someone's job title, role, manager or status, and an approved leave request. Date-based processes count days from the start date, recurring ones repeat on the hire anniversary, and an admin or manager can start one by hand.
Does SquadBear remove access in our other systems?
No. It gives that work an owner, a due date and a record. Removing accounts in your identity provider or other tools is a step someone closes, and SquadBear has no SAML or SCIM provisioning. It does end the leaver's own SquadBear access automatically.
What can we hand the auditor?
Process runs show every joiner's, mover's and leaver's steps with owners and times. Export signatures on any campaign gives a CSV of who was asked, their status and when they signed. The audit log (Team and Enterprise) shows admin changes. There is no single audit-pack export yet.
Is a typed name enough evidence for an auditor?
For policy acknowledgment it's the record auditors normally sample - who confirmed which version, when, and through which channel. It is acknowledgment capture, not a qualified electronic signature, so sign contracts and NDAs that need one in a dedicated signature tool and upload the result in onboarding.
How do we show yearly awareness?
Review your policies every year and publish each reviewed text as a new version. The Annual security training template then asks each person on their hire anniversary. A signature belongs to one version, so nobody can be asked to sign the same version twice.
Can our assistant sign policies for people?
Only for the person who connected it, only with the separate acknowledgment permission, and the record shows it came through an assistant. Nobody can sign for someone else, in the app or through an assistant.
Is SquadBear itself ISO 27001 certified?
Not today. The security page covers data residency, tenant isolation, subprocessors and how AI touches your data, for your supplier review.
Which plan do we need?
Processes, company documents and campaigns work on every plan. Free covers five people and three active processes. Viewing the audit log needs Team or Enterprise.
Walk into your next audit with the evidence already filed
Onboarding and offboarding are switched on in a new workspace, and the audit trail starts with the first change. Add your policies and the yearly refresher, and the rest is the work you already do.
Your agent is connectedLeave · Time · People