Personnel Security Policy

What it has to decide

Pre-employment verification, proportionate to the role
Say what is checked, for which roles, and what happens when a check comes back adverse. The last part is the one usually missing, and it is the one that matters.
Contractors and temporary staff, explicitly in scope
The most common gap. Contractors frequently have deeper access than employees and are engaged through a process that never sees the policy.
Terms and conditions that survive termination
Confidentiality obligations that end with employment protect nothing. State the survival period.
Training, with a definition of completion
Attendance is not completion. State the assessment, the pass mark, and the consequence of not completing, or the training is a slide deck people click through.
The disciplinary link
Say plainly that a deliberate breach is a disciplinary matter. Without this the policy has no teeth, and people can tell.
Offboarding, with the return of assets and the timing of revocation
Same-day revocation for involuntary departures. The gap between notice and revocation is where the data leaves.

How it is usually got wrong

Background checks are performed on employees and not on contractors doing the same work with the same access.
Security training completion is measured by attendance, and the assessment either does not exist or cannot be failed.
Confidentiality obligations lapse on termination.
Offboarding depends on the line manager raising a ticket, and for involuntary exits that ticket is raised late.
The policy references disciplinary consequences that human resources has never agreed to.

Worked extract

What a decision looks like once it has been madeIdentity, right to work and employment history are verified before an offer is confirmed for all personnel, including contractors, temporary staff and personnel engaged through a third party. Roles with access to Restricted data or with privileged access additionally require a criminal history check, repeated every three years. Where a check returns an adverse finding, the role owner and the head of human resources jointly decide, and the decision is recorded with its reasoning. Confidentiality obligations survive the end of engagement for five years without limitation as to time in respect of trade secrets. All personnel complete security awareness training within fourteen days of commencement and annually thereafter, with an assessment that can be failed; two failures escalate to the line manager. For involuntary departures, all access is revoked before the individual is notified.