People security policy

How we make sure the people who work for us are suitable, know their security responsibilities and keep to them, during and after their work for us. It applies to employees, interns and freelancers.

Annex A controls: 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7.

Screening (6.1)

• Before someone starts, Office & HR verifies their identity with a valid passport or identity card, as Dutch law requires. The onboarding page describes what the new employee sends.
• Before an offer, the hiring team checks the diplomas that matter for the role and at least one reference. For an intern, the internship agreement with their school confirms the enrolment.
• Office & HR keeps the result with the HR records.

Terms and conditions of employment (6.2)

• Every employee has a signed employment contract and every freelancer an assignment agreement. Interns work under the internship agreement of their school.
• The contract or agreement states that the person follows the handbook and the information security policies, and it contains a confidentiality clause.
• New employees read the security pages and these policies during onboarding and confirm it in their onboarding issue, as awareness describes.

Awareness, education and training (6.3)

Awareness, education and training are described in support.

Disciplinary process (6.4)

• A violation of the information security policies can lead to disciplinary measures. Depending on its severity and intent, the measure is a conversation, a written warning, or in serious cases the end of the contract under Dutch employment law.
• The Information Security Officer establishes the facts. Management decides on the measure, and Office & HR records it in the HR records.
• Reporting your own mistake or an incident in good faith does not by itself lead to disciplinary measures.

Responsibilities after termination or change of employment (6.5)

• Confidentiality obligations continue after the contract ends, as the contract states.
• When someone leaves, Office & HR informs Infrastructure in time, and offboarding revokes all access. Office keys and company equipment are returned, as the asset management policy describes.
• When someone changes role, their access is adjusted to the new role, as the access control policy describes.
• Leaving and changing roles are big changes under the change management policy.

Confidentiality or non-disclosure agreements (6.6)

• Employees and freelancers agree to confidentiality in their contract. Anyone else who gets access to internal or confidential information, such as an intern whose school agreement has no confidentiality clause, signs a non-disclosure agreement before getting access.
• The confidentiality terms cover customer data, personal data, credentials and all information classified internal or confidential in the information handling policy, and they continue after the contract ends.
• Suppliers and partners that receive confidential information agree to confidentiality in their contract or in a non-disclosure agreement, see the supplier management policy.
• Office & HR keeps the signed agreements. The Information Security Officer checks the confidentiality terms in the yearly policy review.

Remote working (6.7)

Working from home and other places is normal for us, see the orientation. Wherever you work:

• Lock your screen when you step away, and never leave your laptop unattended in a public place.
• Make sure nobody can read your screen or overhear a call with confidential content.
• Keep your device in line with the security rules: full-disk encryption, firewall, automatic updates and screen lock.
• Reach internal company services only from the office network or through the company VPN.
• Use 2FA on every account.
• Keep company information in company services, not only on your laptop.
• Report a lost or stolen device at once as an incident.

Responsibilities

• The Information Security Officer owns this policy and checks that every new employee confirmed reading the policies.
• Office & HR handles screening, contracts and confidentiality agreements, keeps the HR records, and starts onboarding and offboarding.
• Management decides on disciplinary measures.
• Employees follow this policy and report incidents.

Review: yearly by the Information Security Officer.