Skip to main content
IT Staffing in ISO 27799

IT Staffing in ISO 27799

$346.00
When you get access:
Course access is prepared after purchase and delivered via email
Toolkit Included:
Includes a practical, ready-to-use toolkit containing implementation templates, worksheets, checklists, and decision-support materials used to accelerate real-world application and reduce setup time.
Who trusts this:
Trusted by professionals in 160+ countries
Your guarantee:
30-day money-back guarantee — no questions asked
How you learn:
Self-paced • Lifetime updates
Adding to cart… The item has been added

What does the IT Staffing in ISO 27799 course cover?

IT Staffing in ISO 27799 is covered here in 10 modules: Aligning Staffing Models with ISO 27799 Control Objectives, Role-Based Access Control and Segregation of Duties, Personnel Screening and Onboarding Compliance and 7 more. The outline lists 80 specific topics, opening with determine which roles must be formally defined to satisfy ISO 27799 A.7.1.1 (defined roles and responsibilities for information security).

How do you approach IT Staffing in ISO 27799 step by step?

The work is sequenced in 10 stages. It starts with Aligning Staffing Models with ISO 27799 Control Objectives, moves through Role-Based Access Control and Segregation of Duties and Personnel Screening and Onboarding Compliance, and ends at Legal, Regulatory, and Audit Interface. Each stage carries its own topic list, so the sequence is followed rather than summarised.

What is in Module 1 of the IT Staffing in ISO 27799 course?

Module 1 is Aligning Staffing Models with ISO 27799 Control Objectives. It works through determine which roles must be formally defined to satisfy ISO 27799 A.7.1.1 (defined roles and responsibilities for information security)., map existing IT job descriptions to ISO 27799 control requirements to identify gaps in accountability., decide whether to consolidate security responsibilities within a centralized team or distribute them across.

How is the IT Staffing in ISO 27799 course delivered?

The IT Staffing in ISO 27799 course is fully self-paced with immediate online access after enrolment. Access does not expire and future updates are included at no cost. It can be taken on any device, and a certificate of completion is issued by The Art of Service when you finish.

How much does the IT Staffing in ISO 27799 course cost?

The IT Staffing in ISO 27799 course is $346 as a one time payment. There is no subscription, no per seat licence and no hidden fee. Enrolment carries a 30 day satisfied or refunded guarantee, so it can be assessed in full before you commit.

Closely related courses: IT Staffing in ISO 27001, Staffing And Training in ISO 16175, IT Staffing and ISO 22313 Kit, Staffing Plan and ISO 22313 Kit.

More answers: what you get with every course, refund policy, all help answers.

This curriculum spans the equivalent of a multi-workshop compliance initiative, addressing staffing structures, access governance, and lifecycle controls in detail comparable to an internal ISO 27799 implementation program for healthcare IT environments.

Module 1: Aligning Staffing Models with ISO 27799 Control Objectives

  • Determine which roles must be formally defined to satisfy ISO 27799 A.7.1.1 (defined roles and responsibilities for information security).
  • Map existing IT job descriptions to ISO 27799 control requirements to identify gaps in accountability.
  • Decide whether to consolidate security responsibilities within a centralized team or distribute them across departments.
  • Establish reporting lines that ensure independence of security oversight, particularly for audit and compliance functions.
  • Define escalation paths for security incidents that comply with A.16.1.5 (incident escalation procedures).
  • Integrate staffing plans into the organization’s risk assessment process as required by A.6.1.2 (addressing information security within project management).
  • Assess whether third-party contractors meet the personnel screening requirements in A.7.2.1.
  • Document staffing-related control ownership in the Statement of Applicability (SoA) for audit readiness.

Module 2: Role-Based Access Control and Segregation of Duties

  • Design role definitions that enforce segregation of duties between system administration, application support, and audit functions.
  • Implement access provisioning workflows that require dual approval for privileged accounts.
  • Conduct periodic access reviews to validate that user privileges align with current job functions.
  • Resolve role conflicts in ERP or EHR systems where a single user may have incompatible duties.
  • Define break-glass access procedures that maintain accountability without violating A.9.2.5 (emergency access).
  • Use automated tools to detect and remediate excessive or redundant permissions.
  • Enforce least privilege in cloud environments where default roles often grant broad access.
  • Document role definitions and access rules in alignment with A.9.2.1 (user access management).

Module 3: Personnel Screening and Onboarding Compliance

  • Determine the scope of background checks based on job sensitivity and data access levels.
  • Verify that third-party vendors perform equivalent screening for their staff accessing organizational systems.
  • Integrate security clearance verification into the HR onboarding workflow to prevent premature access grants.
  • Define retention periods for screening documentation in compliance with legal and regulatory requirements.
  • Establish procedures for re-screening employees after role changes involving higher-risk access.
  • Ensure that contractors and temporary staff sign confidentiality agreements before system access is granted.
  • Coordinate with legal counsel to ensure screening practices comply with regional privacy laws (e.g., GDPR, HIPAA).
  • Track completion of onboarding tasks related to A.7.2.2 (terms and conditions of employment).

Module 4: Security Awareness and Role-Specific Training

  • Develop differentiated training content for clinical staff, IT administrators, and executives based on data exposure risks.
  • Schedule mandatory refresher training at intervals that satisfy A.7.2.2 and regulatory audit requirements.
  • Measure training effectiveness through phishing simulation results and policy acknowledgment rates.
  • Integrate security training into role-specific certification paths, such as system administrator or data steward.
  • Automate enrollment in training modules based on HR job codes and system access entitlements.
  • Document training completion in a central repository for audit and incident investigation purposes.
  • Update training content following changes in regulatory requirements or organizational threats.
  • Enforce training completion as a prerequisite for granting access to electronic health record (EHR) systems.

Module 5: Managing Remote and Hybrid Workforce Security

  • Define acceptable device configurations for remote access to systems containing protected health information (PHI).
  • Implement conditional access policies that restrict access based on device compliance and location.
  • Require multi-factor authentication for all remote connections to clinical and administrative systems.
  • Establish procedures for securing home network environments used for work purposes.
  • Define data handling rules for remote workers to prevent local storage of sensitive data.
  • Conduct risk assessments for long-term remote roles to determine if additional monitoring is required.
  • Update acceptable use policies to reflect hybrid work arrangements and cloud-based tool usage.
  • Monitor endpoint compliance for remote devices through mobile device management (MDM) or unified endpoint management (UEM) platforms.

Module 6: Third-Party and Contractor Governance

  • Require third-party providers to document their adherence to ISO 27799 controls relevant to staffing and access.
  • Negotiate service-level agreements (SLAs) that include security staffing requirements, such as dedicated security contacts.
  • Conduct on-site or virtual audits of vendor staffing practices for high-risk service providers.
  • Limit contractor access to only the systems and data necessary for their specific tasks.
  • Enforce contract clauses that mandate timely offboarding of vendor personnel upon contract completion.
  • Assign internal staff as accountability owners for each third-party relationship.
  • Verify that contractors receive role-appropriate security awareness training before access is granted.
  • Include staffing continuity requirements in contracts for critical support roles.

Module 7: Incident Response Staffing and Readiness

  • Define and staff an incident response team with clearly assigned roles (e.g., coordinator, technical analyst, communications lead).
  • Ensure 24/7 coverage through shift scheduling or escalation to on-call personnel.
  • Conduct tabletop exercises to validate staffing adequacy and decision-making under pressure.
  • Document staffing assignments in the incident response plan to satisfy A.16.1.2 (responsibilities and procedures).
  • Integrate external forensic experts into the response structure with pre-approved engagement protocols.
  • Establish communication workflows between technical staff, legal, PR, and executive leadership during incidents.
  • Track incident response times to identify staffing or training gaps.
  • Review incident logs to assess whether response delays were due to insufficient staffing or unclear roles.

Module 8: Staff Offboarding and Access Revocation

  • Automate deprovisioning workflows to revoke system access upon HR termination notification.
  • Verify access revocation across all systems, including cloud applications and privileged accounts.
  • Reassign or archive data owned by departing employees in accordance with data retention policies.
  • Conduct exit interviews that reinforce ongoing confidentiality obligations.
  • Recover hardware and cryptographic tokens from terminated staff before final access is removed.
  • Monitor for anomalous login attempts from recently offboarded accounts.
  • Update role coverage plans to address knowledge gaps left by departing personnel.
  • Document offboarding completion to satisfy A.7.3.1 (termination responsibilities).

Module 9: Performance Metrics and Continuous Governance

  • Define KPIs for staffing-related controls, such as average access request fulfillment time.
  • Track the percentage of staff who complete mandatory security training on schedule.
  • Measure the time between employee termination and full access revocation.
  • Use audit findings to identify recurring staffing or role definition deficiencies.
  • Report staffing compliance metrics to the information security steering committee quarterly.
  • Conduct annual reviews of role-based access control models to reflect organizational changes.
  • Compare staffing levels against industry benchmarks for security operations and compliance functions.
  • Update governance documentation to reflect changes in staffing structure or control ownership.
  • Align staffing practices with jurisdiction-specific requirements for handling personal health data.
  • Prepare staffing-related evidence for external audits, including training records and access logs.
  • Coordinate with legal to ensure employment contracts include clauses required by ISO 27799 A.7.2.2.
  • Respond to regulator inquiries about staffing levels in security-critical roles.
  • Document how staffing decisions support compliance with HIPAA, GDPR, or other applicable frameworks.
  • Facilitate auditor access to role definitions, SoA entries, and access review reports.
  • Adjust staffing models in response to enforcement actions or audit findings.
  • Maintain version-controlled records of policy and role changes for legal defensibility.
!