HR / People Operations
Overview
HR / People Operations is another domain of the organisation. The Manual does not say how HR works; it says what must exist on its side for security to work: recorded training, onboarding before access, timely offboarding.
Key Responsibilities
- Run the LMS, manage onboarding and integrate security training into individual plans
- Ensure that mandatory training is completed and recorded before technical access
- Coordinate the preparation and offboarding of contractors, within the deadlines the Manual sets
- Keep the training record that supports audits
Specialisations: HR (Learning & Development) — the Training Manager, who coordinates the training tracks; HR (Recruiting) — the Recruiter, who screens contractors.
Organisational Context
Recorded training is evidence under NIS2 (cybersecurity training) and DORA (staff competence). Timely offboarding closes access that would otherwise outlive the contract.
Regulatory Framework
Supports:
- NIS2: Cybersecurity training for staff
- DORA: Staff competence and awareness of ICT risk
- GDPR: Training for those who process personal data
Activities by Chapter
Ch. 13 - Training and Onboarding
Ensure mandatory onboarding training before technical access, continuous training cycles with communicated deadlines, and remediation when the result falls below the threshold.
User Stories:
- US-01: Mandatory secure onboarding - Everyone starts out aligned with the practices
- US-11: Formal onboarding validation via checklist - Onboarding completed before access (with GRC / Compliance)
- US-12: Knowledge validation via quizzes - Auditable record of competence (with AppSec Engineer)
- US-15: Delivery formats and DoD per format - Verifiable completion in each format (with AppSec Engineer)
- US-16: Remediation path below the threshold - Remediation before any access (with AppSec Engineer)
- US-19: Training in safe use of AI and tooling - Training before autonomous use of AI (with AppSec Engineer)
Ch. 14 - Governance and Contracting
Coordinate the preparation of contractors before access, the mandatory training track and secure offboarding when the contract ends.
User Stories:
- US-15: Technical preparation and validation of contractors before access - Contractors prepared before access (with Security Champion)
- US-16: Mandatory pre-access training track - Training Manager coordinates the track (with CISO)
- US-17: Secure offboarding of contractors - Access revoked on the same day, ≤ 2 h for unplanned departures (with Security Champion and DevOps / SRE)
Chapter References
For full context and framing: