CHRO guide to ISO 27001: screening, NDAs, training, discipline and offboarding

How far can pre-employment background checks go? Can we ask for a police record or credit history?

Before screening people for privileged or confidential roles, check the limits in Taiwanese law:

• Employment Service Act, Article 5(2)(2): when recruiting or employing, an employer may not require private information not needed for the job
• Enforcement Rules of the Employment Service Act, Article 1-1: private information includes physiological information (such as genetic testing and drug testing), psychological information (such as psychological tests and lie detection) and personal life information (credit records, criminal records, pregnancy plans or background investigations); an employer asking for it must not exceed what is necessary for a specific purpose and must have a legitimate and reasonable link to that purpose
• Penalty: under Article 67 of the Act, a fine of NT$60,000 to NT$300,000

In practice, tier checks by the level of information each role can access, ask for deeper data only where it is truly needed, and record why the role needs it. Whether a specific request is allowed is for legal counsel to judge.

How should confidentiality agreements and non-compete clauses be written to hold up?

Confidentiality agreements: specify the scope of what is confidential, rather than "all business information". A signed confidentiality contract alone is not enough to amount to reasonable secrecy measures under the Trade Secrets Act; classification, confidentiality marking, access records and limits on who knows are also needed. ISO 27001 information classification, access control, logging and people security can serve directly as supporting evidence.

Post-employment non-competes: under Article 9-1 of the Labor Standards Act, all four conditions must be met:

1. The employer has a legitimate business interest to protect
2. The worker's position allows access to or use of the employer's trade secrets
3. The period, region, scope of occupational activity and employers covered do not exceed a reasonable scope
4. The employer provides reasonable compensation for the worker's loss from not competing (excluding pay received during employment)

If any condition is not met, the agreement is void; the period may not exceed 2 years, and anything longer is shortened to 2 years. Templates are best split into four sets: hiring, during employment, departure and external parties. See Trade secret protection.

How should security awareness training be run, and what will auditors look at?

BSI's summary of the revision notes that clause 6 of Annex A in ISO/IEC 27001:2022 has 8 people controls, covering topics such as training and terms and conditions of employment; Taiwan's National Institute of Cyber Security also notes that all 8 people controls are existing controls. The evidence the CHRO should prepare:

• Annual training plan: tiered by role, for example all staff, IT staff, managers and new hires
• Completion records: sign-in or online completion records for onboarding and annual training
• Effectiveness: post-training quizzes or exercise results
• Follow-up: reminders and make-up training for those who did not complete

If personal data is also processed: the security measures listed in Article 12 of the Enforcement Rules of the Personal Data Protection Act also include "data security management and personnel management" and "awareness and education training". Security and privacy training can be run together and share records.

How should the disciplinary process for security violations be set up so it can actually be enforced?

Under Article 70 of the Labor Standards Act, an employer with 30 or more workers must set work rules covering matters including "discipline to be observed" and "attendance, leave, rewards and penalties, and promotion", file them for approval and publicly display them. To make security discipline enforceable:

1. Specify violation types and penalty levels in the work rules or in a security policy they authorize
2. Announce it and include it in onboarding and annual training, keeping records that employees were informed
3. Investigate the facts and preserve evidence before imposing a penalty, and record the decision

A framework for judgment:

• Work rules that violate mandatory or prohibitive provisions of law are void (Article 71)
• Terminating without notice for "a serious violation of the labor contract or work rules" (Article 12(1)(4)) must be done within 30 days of learning of the facts (Article 12(2))

Whether a violation is "serious" and whether a penalty is lawful are for legal counsel to judge case by case.

When an employee leaves or changes roles, what counts as complete access removal and asset return?

HR's notice of departure or transfer is the trigger for the IT, asset and confidentiality steps:

The procedures for returns, access removal and evidence preservation should be rehearsed at least once: for example, simulate a departing employee taking data, run it from the logs through evidence preservation, find the gaps and fix them.

How many dedicated security staff do we need? Should we appoint a CISO?

Article 9-1 of the Regulations Governing Establishment of Internal Control Systems by Public Companies requires appropriate human resources and equipment for planning, monitoring and carrying out information security management. Under the FSC order of 28 December 2021 (Jin-Guan-Zheng-Shen-Zi No. 11003656544):

For ordinary public and listed companies, no official text sets the CISO's rank. Companies that are not public companies are not subject to these rules but may refer to them voluntarily.

How does Winners Consulting help the CHRO with ISO 27001?

Winners Consulting's VP- and director-level consultants lead the work end to end, never outsourced, and the team holds ISO lead auditor qualifications.

• Scope: confirm customer, tender and regulatory security requirements first and define the certification scope
• Risk assessment and SoA: decide controls from the risk assessment and document them in the Statement of Applicability, with reasons for exclusions
• Integration: reuse risk management, internal audit and management review
• Outsourced internal audit: for certified organizations, Winners can carry out the internal audit
• Timeline (as listed on the service page): typically 4 to 8 months, depending on scope and the maturity of existing systems

ISO 27001 clients who have authorized disclosure include InfoLight (訊光資訊科技), MPI Corporation (旺矽科技), 卓元科健 and Hypercore Fitness Center. Further reading: ISO 27001 ISMS, How to choose an ISO 27001 consultant, Outsourcing the ISO 27001 internal audit.

Apply for a free mechanism diagnosis