Bulgaria Ordinance on Minimum Requirements for Network and Information Security (2019) 9: Secure human resources through internal rules on hiring, security duties on exit or role change, disciplinary procedures, documented responsibilities with deadlines, professional training and scheduled, traceable awareness briefings

What does 9 require?

To reduce incidents caused by staff, whether deliberate or accidental, the entity uses internal rules and instructions to make sure people working on in-scope processes hold the qualifications, knowledge and skills their duties demand. The rules cover hiring in line with law, professional ethics and the sensitivity of the information the person will access; the security obligations that apply when employment or a contract ends or changes; and disciplinary procedures for breaches of the security policy and internal rules. Each person's security responsibilities are documented with clear deadlines and obligations. Security is sustained through professional training that keeps skills current with the technology in use and through periodic awareness briefings run to a set schedule and documented so attendance can be traced.