Implementing CCM: Human Resources Controls

The Cloud Controls Matrix (CCM) is a framework of controls that are essential for cloud computing security. It is created and updated by CSA and aligned to CSA best practices.

You can use CCM to systematically assess and guide the security of any cloud implementation. CCM also provides guidance on which actors within the cloud supply chain should implement which security controls. Both cloud service customers (CSCs) and cloud service providers (CSPs) use CCM in many ways.

CSCs use CCM to:

• Assess the cloud security posture of current or potential cloud vendors. If a cloud vendor isn’t transparent about their security controls, the risk of doing business with them can be quite high.
• Compare vendors’ level of compliance with relevant standards like ISO 27001.
• Clarify the security roles and responsibilities between themselves and the CSP.

CSPs use CCM to:

• Assess, establish, and maintain a robust and internationally accepted cloud security program. CCM helps solidify CSPs' positions as trusted and transparent providers of cloud services.
• Compare their strengths and weaknesses against those of other organizations.
• Document controls for multiple standards in one place. CSA has mapped the controls in CCM against several industry-accepted security standards, regulations, and control frameworks.

CCM contains 197 control objectives structured into 17 domains that cover all key aspects of cloud technology:

CCM Domains

Today we’re looking at implementing the ninth domain of CCM: Human Resources (HRS). The HRS domain consists of 13 control specifications:

1. Background Screening Policy and Procedures
2. Acceptable Use of Technology Policy and Procedures
3. Clean Desk Policy and Procedures
4. Remote and Home Working Policy and Procedures
5. Asset returns
6. Employment Termination
7. Employment Agreement Process
8. Employment Agreement Content
9. Personnel Roles and Responsibilities
10. Non-Disclosure Agreements
11. Security Awareness Training
12. Personal and Sensitive Data Awareness and Training
13. Compliance User Responsibility

Up to 74% of all security breaches and information leaks involved a human element last year. Therefore, the HRS controls help cloud organizations manage risks associated with insider threats. They define policies to train personnel that handle sensitive data, making sure they maintain the security posture of the organization. The HRS domain addresses the full employee lifecycle - from pre-employment to post-termination. 

 

A Closer Look at Some of the Controls

Security and Privacy Training

The HRS domain includes mindset awareness training controls. This is to ensure individuals understand the importance of information security in their role. Information training is an ongoing process. Employees need refresher training and recurring awareness initiatives to ensure it becomes second nature to protect data and systems. 

Types of training include security awareness, best practices, controls, personal data and sensitive data awareness, compliance, and user responsibility. 

 

Personnel Conduct Controls

The HRS domain also includes controls about background screening, employee agreement processes and content, and non-disclosure agreements. This includes defining and communicating policies for:

• The acceptable use of technology
• Clean desk
• Remote and home working 

 

HRS Risks & Controls to Mitigate Them

Insider Risks 

Examples of insider risks include:

• You employ someone who didn't disclose their criminal history
• You employ someone that doesn’t have the required experience and knowledge to get the job done
• You employ someone that doesn’t meet legal work requirements

To avoid these risks, it's important to look at background screening policies and procedures. Establish and execute a screening process before granting system access to a potential employee. Tailor the verification process to the level of access that the individual needs. Also consider the nature of the data that they'll be working with. 

 

Inappropriate Use of Technology

For example, remote employees might leave sensitive information unattended, which could result in a leak. 

To mitigate this risk, you need to define, develop, and communicate an acceptable use policy and information security policy. These policies provide the general do’s and don’t's to protect information and to secure systems. 

You also need to ensure secure workplaces. This includes locking away documents, clearing whiteboards, and implementing an automatic screen lock on devices. Make sure to work towards these controls becoming second nature. They must become part of the culture in your organization.

Finally, you must invest in constant awareness training about the risks and best practices for working remotely.

 

Lack of Control Over Assets 

For personnel termination, you need to make sure that you have non-disclosure and non-compete agreements in place. Remind personnel of these agreements during the exit interview.

Maintain an offboarding checklist to ensure that the terminated personnel returns any physical assets. The security team should make sure to protect and revoke data assets and tokens. Consider implementing the ability to remote wipe or lock devices. 

You also need to communicate the post-employment obligations to individuals. Misunderstandings and legal disputes could surface when you don't have a well-defined and understood employment agreement.

 

Leakage of Sensitive Information

To prevent the leakage of sensitive information, make sure to disallow employee access to systems and data without having signed agreements in place. Personnel must sign acknowledgement of these policies so you know they have made an effort to understand what is expected from them. Signed acknowledgement of the policies puts you in a good position from the get-go. 

For misconduct handling, you’ll want to define your disciplinary procedures in advance. The first (and most important) step is to revoke access as soon as there's a breach of agreement by an individual.

 

Applying the Shared Security Responsibility Model

The Shared Security Responsibility Model (SSRM) is a framework that clarifies the division of security responsibilities between CSPs and CSCs. This model is crucial for ensuring that both parties understand their roles for securing the environment. It reduces the risk of security breaches due to miscommunication and misunderstandings. 

Under the SSRM, both CSPs and CSCs independently implement HRS security controls. This means that both parties need to implement these controls effectively. Both parties should conduct background checks, provide continuous security training, and ensure employees are aware of cloud security risks and best practices.

 

A Final Word

Communicating and creating awareness of best practices is essential. The mishandling of sensitive information can occur because individuals simply didn't know what the best practices are. So you must implement constant training and constant reminders of the best practices.

Along with this, make sure to train new joiners in your organization and to refresh your trainer annually. Make sure the training is based on the role that the individual will fulfill and the type of information they'll access.

Remember, you can download and review the Cloud Controls Matrix and CCM Implementation Guidelines for free. These resources will be a great help in establishing your HRS policies.

Finally, learn more about implementing other CCM domains by checking out the other blogs in this ongoing series. Be on the lookout for the next installation: Identity and Access Management.