C5 domain HR: making joining, leaving and training audit-ready

This page covers the HR (personnel) domain of C5:2026, section 5.3 of the catalogue. How criteria and subcriteria are structured in general is explained on the page C5 criteria catalogue.

What is the HR domain about?

HR governs the personnel process from an information security perspective. The catalogue states as its objective that personnel understands its responsibilities, is aware of its responsibilities regarding information security, and that the organisation’s assets are protected in the event of changes in responsibilities or termination (section 5.3). The criteria range from verification before employment through employment terms, training, disciplinary measures and non-disclosure agreements to remote working.

The domain comprises eight criteria, HR-01 to HR-08, with 28 basic subcriteria, one sharpening and six complementing additional subcriteria. According to the change history, HR-07 and HR-08 on remote working are new compared with C5:2020; on-site office workplaces, by contrast, are covered by PS-08, see the PS domain. HR applies to internal and external personnel. According to the supplementary information, external personnel within the meaning of HR-01 is personnel that works according to the provider’s processes and procedures and has potential access to customer data. Personnel of service organisations working according to their own processes and procedures is not covered by HR-01; you manage these service providers through the SSO domain.

The counterpart to HR lies in IAM: granting and removing access rights on joining, change and leaving, with their deadlines, are covered on the page IAM domain. This page covers what has to happen before and alongside.

Starting point: a growing provider with external developers

Fictitious example, not a client. A provider runs a platform that housing companies use to manage their properties, tenancy agreements and communication with tenants. Around 50 employees, most of them working mainly from home. Four developers from a service provider work in the provider’s own team, in the same Git system and following the same processes. The service runs as SaaS on the infrastructure of a large cloud provider.

Before the project, the situation looks like this:

• When hiring, the specialist department looks through the CV. Whether someone will later receive administrator rights in production plays no role in the verification.
• Employment contracts contain a general confidentiality clause. The external developers have signed nothing except their employer’s framework contract.
• New employees receive a laptop and accounts on their first day; the security policies are in the wiki.
• Everyone takes the same e-learning course once a year. Whether anyone has understood anything is not recorded.
• Whoever leaves hands in the laptop. Nobody explains which obligations continue to apply after leaving.
• For working from home there is a wiki page without concrete requirements; some people read work e-mails on private phones.

Who is responsible for what: provider, platform, customer?

HR lies with the provider. In the HR domain, no criterion contains complementary customer criteria. The boundary to service providers matters. Our classification for the example:

The distinction by the processes in which someone works corresponds to the delimitation in DEV-02: whoever is integrated into your processes belongs to your personnel; whoever delivers according to their employer’s processes is a service provider.

How do you assign roles to risk classes?

HR-01.01B requires identifying, for the production environment, the roles that can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components. HR-01.04B requires classifying security-sensitive positions according to their level of risk, expressly including IT administration. The intensity of the assessment is in proportion to the business context, the sensitivity of the information and the risks (HR-01.06B). Our scheme for the example:

The five measures listed in HR-01.02B (identity, professional experience, degrees, certificate of good conduct or national equivalent, susceptibility to blackmail) apply only to the extent permitted by local legislation and as considered appropriate by the provider. The supplementary information points out that some checks are restricted or prohibited in some jurisdictions, that consent may be required and that, depending on local regulations, a creditworthiness check may only be permissible for positions with significant financial responsibility. Which check is permitted in your case has to be clarified legally in the individual case. Encryption and monitoring of access can reduce the extent of the verification, but cannot replace it completely.

What does the personnel process look like from joining to leaving?

The criteria mainly define what has to be done before first access. Our process for the example, the same for own and external personnel:

Two processes from other domains run alongside: the return of laptops and security keys, with removal of access rights no later than the date of leaving if the return is late (AM-08, see Asset management), and the adjustment of rights within the deadlines of IAM-04. You review the requirements for the non-disclosure agreements under HR-06.04B at least annually and in case of significant changes to the service. If the review shows that the requirements need to be adapted, you update the agreements. HR-06.03B requires the non-disclosure agreement before access authorisation only for internal personnel; that the process above also requires it from external staff is our recommendation. For external personnel, HR-02.03B requires the non-disclosure provision in the terms. The two language versions differ here: the English version 1.0.1 names “anonymised and decontextualised information”, the German version 1.1.0 anonymised and pseudonymised information.

How do you build a role-based training programme?

HR-03 requires a target group-oriented programme that all internal and external personnel undergo regularly and when changing job function, aligned with risk classification and technical responsibilities (HR-03.02B). The content is regularly updated based on changed policies and the threat situation, and learning outcomes are measured and evaluated (HR-03.03B, HR-03.04B). The sharpening HR-03.02AS turns this into “at least annually”. Our programme for the example:

The measurement does not have to assess each person individually: for the complementing HR-03.03AC, the supplementary information expressly allows evaluation at an aggregated level per target group, also to protect employee data. We recommend feeding the results into the revision of the programme every year.

Example control description for HR-02

The most delicate moment is the first working day: laptop and accounts are handed out quickly, commitment and instruction are not. Our example control for the provider above (own wording, not catalogue text):

Whether the control covers the subcriteria is for the auditor to assess; for a type 2 report the auditor checks, using a sample of the joiners in the period, whether it was effective.

What evidence the auditor wants to see

HR evidence contains personal data. Define which records the auditor sees and in what form; for disciplinary measures, the supplementary information on HR-04.04B expressly accepts anonymised evidence. Examples from our scenario:

An evidence register maps each subcriterion to its evidence; how to maintain it is shown on the page Evidence and documentation.

Possible gaps: cause, effect, remedy

The following gaps follow from the wording of the criteria and the scenario above. If a single subcriterion is not met, the criterion counts as not met, and the auditor reports the deviation (sections 3.4.12 and 3.4.13).

All criteria of the HR domain

Titles as in the English version 1.0.1, number of subcriteria counted per section 5 (B = basic, AS = sharpening, AC = complementing). The column “What it covers” is our own short description, not catalogue text; the wording of the criteria in the catalogue is binding.

The additional criteria go deeper into two topics: HR-01.01AC requires the provider to define in the human resource policy positions that require regular assessment, and to review the assessment for this personnel annually; HR-03.01AC to HR-03.05AC cover monitoring of training completion, target group-oriented measurement with quantitative and qualitative aspects, and feedback into the programme.

Relationship to ISO/IEC 27001:2022 Annex A

The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3). The short labels are ours, not titles from the standard. What you can reuse overall from a certified ISMS is shown on the page C5 and ISO 27001.