# 12 People security and training policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | People Owner |
| Review | Yearly |
| Applies to | Directors, employees, contractors and interns |

## Before access

1. A written role description exists for every role with access to in-scope systems (GOV-07).
2. A confidentiality agreement or contract clause is signed before any access (GOV-05).
3. Background verification is completed for anyone who will have production or customer-data access, within what the law of their country allows: identity, education, and previous employment. Records are kept by the People Owner, not in the evidence store (GOV-06).
4. Access is requested and approved under [13 Access control](/soc2/13-access-control).

## Onboarding checklist

- [ ] Contract and NDA signed
- [ ] Background verification complete
- [ ] Policies acknowledged (GOV-04)
- [ ] Security awareness training complete within 30 days (GOV-08)
- [ ] Device enrolled and meets the endpoint baseline
- [ ] Accounts created with approvals on record

## Training

- Security awareness training at hire and yearly: phishing, passwords and MFA, data classification, handling customer data, reporting incidents, using AI tools with company data.
- Engineers additionally: secure coding (OWASP Top 10, the playbook's security defaults), the [SOC 2 gate](/soc2/05-soc2-gate), and [17 AI coding agents](/soc2/17-ai-agents).
- Completion is recorded per person with a date.

## Offboarding

1. All access is removed within 1 business day of the last working day, and immediately for a termination for cause (ACC-05).
2. Checklist, with the time each item was done: workforce identity, GitHub, Cloudflare, cloud console, production access and SSH keys, Gate admin, email, password manager shares, shared secrets they knew (rotate), devices returned or wiped.
3. Confidentiality obligations continue after departure; this is stated in the exit communication.