💼 GV.RR-04: Cybersecurity is included in human resources practices

• Contextual name: 💼 GV.RR-04: Cybersecurity is included in human resources practices
• ID: /frameworks/nist-csf-v2.0/gv-rr/04
• Located in: 💼 Roles, Responsibilities, and Authorities (GV.RR)

Description

1. Integrate cybersecurity risk management considerations into human resources processes (e.g., personnel screening, onboarding, change notification, offboarding)
2. Consider cybersecurity knowledge to be a positive factor in hiring, training, and retention decisions
3. Conduct background checks prior to onboarding new personnel for sensitive roles, and periodically repeat background checks for personnel with such roles
4. Define and enforce obligations for personnel to be aware of, adhere to, and uphold security policies as they relate to their roles

Similar

• Sections
  • /frameworks/nist-csf-v1.1/pr-ip/11
  • /frameworks/nist-sp-800-53-r5/pm/13
  • /frameworks/nist-sp-800-53-r5/ps/01
  • /frameworks/nist-sp-800-53-r5/ps/07
  • /frameworks/nist-sp-800-53-r5/ps/09

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 NIST CSF v1.1 → 💼 PR.IP-11: Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening)
💼 NIST SP 800-53 Revision 5 → 💼 PM-13 Security and Privacy Workforce
💼 NIST SP 800-53 Revision 5 → 💼 PS-1 Policy and Procedures
💼 NIST SP 800-53 Revision 5 → 💼 PS-7 External Personnel Security
💼 NIST SP 800-53 Revision 5 → 💼 PS-9 Position Descriptions

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags