Domain 1 · Objective reference 1.8 · Chapter 8 of 62
Personnel security through employment and contracting
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Access should follow employment status and role.
Explore the anchors
Perform appropriate screening and agreements.
Concept matching activity
Match this task or description to its concept:
Manage duties transfers and training.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
Personnel controls span role definition, appropriate screening, agreements, onboarding, transfers, review and departure. Apply screening and monitoring in accordance with applicable authority and privacy requirements. Define responsibilities, acceptable use and handling obligations for employees, contractors and suppliers. A confidentiality agreement does not replace practical access restrictions or competent supervision.
Design, evidence and tradeoffs
Transfers can create incompatible combinations of old and new rights. Departure should cover sessions, tokens, application-local accounts, remote access, physical access and entrusted assets, not only one directory switch. Transfer ownership of necessary service identities instead of abandoning them when a sponsor leaves. Separate technical revocation from retained evidence and legal holds. Privileged roles need proportionate oversight and clear emergency arrangements.
Worked example
A buyer moving into payments loses supplier-creation rights before receiving payment-approval authority.
Check your understanding
Why can adding a new role without reviewing the previous role be unsafe?
Show explanation
The combined effective access may exceed need or allow one person to complete incompatible business stages.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.