Checks must be carried out on all candidates for employment in accordance with laws, regulations and ethics and be proportionate to the job requirements, the classification of accessible information and the risks identified. ...

Contractual agreements between employees and subcontractors must specify their responsibilities and those of the organization with respect to information security. ...

Management must instruct all employees and subcontractors to apply the security rules in accordance with the policies and procedures in effect in the organization. ...

All employees of the organisation and, where relevant, Subcontractors must receive appropriate awareness and training and receive regular updates to the organization’s policies and procedures that apply to their duties. ...

There must be a formal disciplinary process known to all to take action against employees who have violated information security rules. ...

The responsibilities and tasks related to the security of information which remain valid after the termination, term or modification of the employment contract, must be defined, communicated to the employee or to the sub-processing, and applied. ...