Community Library

ISO 27001 Onboarding Checklist

What to do before they start, on the first day, and in the first weeks.

Join to save this for later.

A new person is new access to company information. Give this list to the people who bring them in. Each step also names the proof your ISO/IEC 27001 program should already be able to show.

How to use this checklist

1. Use this when someone joins. Work the parts in order: before they start, the first day, the first weeks, and the confirmation that they are in the program.
2. The Proof line is the record your program keeps. If you cannot produce it, the task is not done.
3. References point to ISO/IEC 27001:2022 Annex A controls, for example A.6.1.

• 5Before they start
• 5First day
• 4First weeks
• 4In the program

18 tasks for a new person. Each one names the proof to keep and the ISO/IEC 27001:2022 control it supports.

Before · Before they start

Before they start

Know who is joining, what they may see, and which device they will use, before the first day.

0 of 5

• Screen the person to the level the role requires.

  Proof: Screening record completed before the start date.

  A.6.1
• Put information security responsibilities into the employment terms.

  Proof: Signed terms that include those responsibilities.

  A.6.2
• Sign the confidentiality agreement before they see company information.

  Proof: Signed confidentiality or non-disclosure agreement.

  A.6.6
• Name the manager, the role, and the access that role is allowed to have.

  Proof: Role record and the access approved for it.

  A.5.15, A.5.18
• Decide which device they will use.

  Proof: The device is on the endpoint list, or the plan to issue one is recorded.

  A.8.1

Day one · First day

First day

Give the identity, the access, and the device the role needs, and no more.

0 of 5

• Create the company identity and give only the access the role needs.

  Proof: Identity record and the access granted, with the date.

  A.5.16, A.5.18
• Give privileged access only when the role requires it, and record who approved it.

  Proof: Privileged access approval, separate from ordinary access.

  A.8.2
• Issue the device, or confirm the one they will use matches the company build.

  Proof: Endpoint record tied to the person and the date.

  A.8.1
• Have them acknowledge acceptable use before they use company information.

  Proof: Signed acceptable use acknowledgment.

  A.5.10
• Show them how to report a security event, and who receives it.

  Proof: Note that they were shown the reporting path.

  A.6.8

Weeks · First weeks

First weeks

Train them on the rules, the information they will handle, and what happens if a rule is broken.

0 of 4

• Complete security awareness training for the role.

  Proof: Completion record with the person and the date.

  A.6.3
• Show which information they will handle, and how it is classified.

  Proof: The classification rules they were shown.

  A.5.12
• Add the assets they are responsible for, with an owner on each row.

  Proof: Asset register rows tied to the person.

  A.5.9
• Tell them what happens if a security rule is broken.

  Proof: The disciplinary process is part of the terms they signed.

  A.6.4

Confirmed · In the program

In the program

A manager confirms the access, and the records are stored where the program can find them later.

0 of 4

• A manager confirms the access still matches the role.

  Proof: Access check dated after the start, with the manager named.

  A.5.18
• Include them in the next awareness cycle.

  Proof: The person is on the awareness audience list.

  A.6.3
• Put them on the people record with a start date, so a later leaver check can find them.

  Proof: People record with the start date.

  A.5.16
• Store the signed terms, confidentiality agreement, and acceptable use where the program keeps them.

  Proof: The three records stored with dates.

  A.6.2, A.5.33

Want a new person to show up in the program, not in a side spreadsheet?

Trygg keeps the person, the access, and the proof in one place.

Book a demoISO 27001 Preparation Checklist

Portal demos follow a mutual NDA.

This checklist is guidance, not a substitute for the ISO/IEC 27001:2022 standard. Purchase the standard from ISO or your national standards body. Certification decisions are made only by accredited certification bodies.