# Employee Security Handbook: [Organization name]

> A plain-language handbook that tells every person working for
> [Organization name] the things they must do to keep information safe.
> It turns the information security policy and the topic-specific
> policies into everyday habits, and supports awareness under ISO/IEC
> 27001:2022 + Amd 1:2024 clause 7.3 and Annex A control A.6.3
> (awareness, education and training), with links to the controls each
> rule comes from. Replace every `[bracketed]` value and every row marked
> *Example*.

<!--
Guidance: How to use this template
- When to use: give it to every new joiner on day one, and to all staff
  after each yearly update. It is the "what you must do" companion to the
  policies, not a replacement for them.
- Fill first: section 3 (the 14 rules) and section 4 (contacts). Adjust
  the rules to your real tools, then ask three people outside IT to read
  the draft and tell you what they did not understand.
- Main pitfall: writing for security people. Use short sentences,
  "you" and "we", and everyday words. Explain why a rule matters in one
  line. Keep standard and control references in the reference columns
  and in section 10, away from the rules themselves.
- Keep it short to read: a member of staff should finish sections 1 to 4
  in about 15 minutes.
- Related templates: `compliance/information-security-policy`,
  `compliance/acceptable-use-policy`, `isms/remote-working-policy`,
  `isms/security-event-reporting-procedure`,
  `isms/clear-desk-clear-screen-policy`, `ai-data/ai-usage-policy`,
  `security/security-awareness-program`, `isms/phishing-simulation-plan`,
  `isms/isms-competence-training-matrix`.
-->

## Document control

<!-- Guidance: The handbook is a controlled document because staff acknowledge a specific version. Keep the version number visible on the acknowledgement form. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-073 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@hr-lead], [@communications-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, clause 7.3 and Annex A A.6.3 (rules link to A.5.10, A.5.14, A.5.17, A.6.7, A.6.8, A.7.7, A.8.1 and others); ISO/IEC 27002:2022 |
| Parent policy | DOC-ISMS-001 Information security policy |
| Applies to | [All employees, contractors, interns and temporary staff] |
| Languages | [English; translations listed in section 8] |
| Next scheduled review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| HR lead | [@hr-lead] | [Reviewed] | YYYY-MM-DD |
| Plain-language reviewer | [@communications-lead] | [Reviewed] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First version |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Rule 11 updated for the newly approved AI assistant |

## Contents

<!-- Guidance: Sections 1 to 5 are for all staff. Sections 6 to 10 are for the people who maintain the handbook and for auditors. -->

1. Welcome: why this matters
2. Our promise to you
3. The 14 things everyone must do
4. Who to contact
5. Acknowledgement form
6. Extra rules for some roles
7. Size tiers
8. Keeping the handbook working
9. Records and evidence
10. Where the rules come from
11. References

## 1. Welcome: why this matters

<!-- Guidance: One short page. Say why security matters to this organization in particular (customers, patients, products), in words a new joiner understands. Avoid fear: explain, do not threaten. -->

Every day you work with information that matters: our customers' data,
our colleagues' personal details, our plans, our money and our systems.
Many attacks do not start with clever hacking. They start with a normal
person receiving a convincing email, reusing a password, losing a
laptop or sharing a file with the wrong link.

You do not need to be a technical expert to protect information. You
need a few good habits. This handbook lists them. Each rule says what to
do and, in one line, why it matters.

If you remember only one thing: **when something feels wrong, report it
straight away. You will never be blamed for reporting.**

The full rules are in our information security policy and the policies
linked in section 10. If this handbook and a policy ever seem to say
different things, the policy applies, and please tell [@isms-manager] so
we can fix the handbook.

## 2. Our promise to you

<!-- Guidance: Security works when staff trust the organization. State what the organization does in return. Make sure every promise is true: check with HR, IT and legal. -->

In return for following these rules, [Organization name] promises to:

1. **Give you the tools.** You get a managed device, a password manager,
   multi-factor sign-in and approved tools for sharing files, so the
   secure way is also the easy way.
2. **Train you.** You get short training when you join and every year,
   and extra training if your role needs it.
3. **Not blame you for honest mistakes you report.** If you click a bad
   link or send an email to the wrong person and report it quickly, you
   will not be disciplined for that mistake.
4. **Be open about monitoring.** We tell you what we monitor on work
   devices and accounts, and why. We do not watch you through your
   camera or microphone, and we do not use security tools to measure
   how hard you work.
5. **Listen.** If a rule gets in the way of your work, tell us. We would
   rather fix the rule than have people work around it.

## 3. The 14 things everyone must do

<!-- Guidance: Keep 10 to 15 rules. Each rule: a short heading, what to do (2 to 5 bullet points), and "Why" in one line. Use your real tool names. Pitfall: adding a 16th, 17th, 18th rule until nobody reads them. Put role-specific rules in section 6. -->

### Rule 1. Use a strong, unique password for every work account

- Let the password manager [password manager name] create and remember
  your passwords.
- Use a long passphrase, such as several random words (at least [15]
  characters), for the few passwords you must remember, such as your computer and your password
  manager.
- Never reuse a work password anywhere else, and never use a personal
  password for work.
- Never share your password with anyone, including IT. We will never
  ask for it.
- Change a password straight away if you think someone else knows it.

**Why:** reused and stolen passwords are one of the most common ways
attackers get in.

### Rule 2. Always use multi-factor sign-in, and never approve a prompt you did not start

- Multi-factor sign-in means a second step after your password, such as
  a code or a tap on your phone. Set up [authenticator app / security
  key / passkey] when you join.
- If you get a sign-in prompt or code request you did not expect, deny
  it and report it (Rule 14).
- Never read out or forward a sign-in code to anyone, even someone who
  says they are from IT.

**Why:** a second step stops most attacks even when a password is
stolen, unless someone tricks you into approving it.

### Rule 3. Stop and check before you click, open or pay

- Be suspicious of messages that are urgent, unexpected, or ask for
  passwords, codes, payments or gift cards.
- Check the sender address and hover over links before clicking.
- Confirm any request to change bank details or make an unusual payment
  by phoning the person on a number you already know, not one in the
  message.
- Use the [Report phishing] button for suspicious emails. Do not forward
  them to colleagues.

**Why:** phishing and fake payment requests cost organizations money
every day, and the person receiving the message is the last line of
defence.

### Rule 4. Lock your screen and protect your devices

- Lock your screen whenever you step away: [Windows key + L] or
  [Control + Command + Q].
- Keep your device with you or locked away. Never leave it visible in a
  car.
- Do not let family or friends use your work device.
- Install updates when asked; restart within [3] days.
- Do not switch off or work around security software.

**Why:** an unlocked or lost device gives someone everything you can
access.

### Rule 5. Use only approved devices, apps and services for work

- Do work on your company device. Use a personal phone for work only if
  IT has set it up for work use first (our "bring your own device"
  rules).
- Store and share work files only in [approved storage, for example the
  company file platform].
- Do not use personal email, personal cloud drives or messaging apps for
  work files.
- Ask IT before installing new software or signing up for a new online
  service for work.

**Why:** we cannot protect, back up or recover information stored in
places we do not know about.

### Rule 6. Know how sensitive information is, and handle it that way

- Our classification levels are [Public, Internal, Confidential,
  Restricted]. If you are not sure, treat it as Confidential.
- Label documents and emails with the right level using [labelling
  tool or header].
- Share Confidential information only with people who need it for their
  work.
- Never put Restricted information on paper, USB sticks or external
  drives unless your role allows it.

**Why:** the label tells everyone, including tools, how carefully to
handle the information.

### Rule 7. Share files and send emails carefully

- Check the recipient list before you press send, especially when the
  email client fills in names automatically.
- Share files with named people rather than "anyone with the link".
- Encrypt or use the secure sharing tool for Confidential files sent
  outside the organization.
- Do not forward work email to a personal account.

**Why:** "wrong recipient" and open sharing links are among the most
common causes of personal data breaches.

### Rule 8. Keep your desk and screen clear

- Put papers, USB sticks and external drives away when you leave your desk, and at
  the end of the day.
- Collect printouts at once. Where we have it, use secure printing:
  the printer waits until you tap your badge.
- Put paper you no longer need in the locked confidential waste bin or
  a cross-cut shredder.
- Remove whiteboard notes after meetings.

**Why:** visitors, cleaners and passers-by can see what you leave out.

### Rule 9. Work safely from home and on the move

- Work where others cannot see your screen or hear Confidential calls.
- Connect through [the secure connection app, for example the VPN] and
  avoid open public Wi-Fi; use your phone's hotspot instead.
- Carry devices in hand luggage when travelling. Ask [@isms-manager]
  before travelling with work devices to a country on our travel list.
- Ask HR before you work from another country (approval is needed for
  more than [10] working days a year).

**Why:** at home and on the road you do not have the office's locked
doors and protected network.

### Rule 10. Protect personal data

- Personal data is any information about a person, such as a name,
  email address, phone number or health details.
- Use personal data only for the purpose it was collected for, and only
  the minimum you need.
- Do not copy customer or colleague data into spreadsheets, test systems
  or personal notes without approval.
- Pass any request from a person about their own data (to see, correct
  or delete it) to [privacy contact] the same day.

**Why:** people trust us with their data, and data protection laws such
as the GDPR set strict rules and short deadlines.

### Rule 11. Use AI tools only as approved

- Use only the AI tools listed as approved in our AI usage policy
  ([link]).
- Do not paste Confidential or personal information into public or
  consumer AI services.
- Check AI output before you use it: it can be wrong, biased or contain
  someone else's data.
- Say when content was produced with AI where our policy requires it.

**Why:** information typed into some AI services can be stored or used
by the provider, outside our control.

### Rule 12. Be careful with visitors, calls and social media

- Do not hold secure doors open for people you do not know; ask them to
  sign in at reception.
- Make sure your visitors are signed in and accompanied.
- Do not give information about colleagues, systems or customers to
  callers you cannot verify.
- Do not post photos that show screens, badges, whiteboards or office
  layouts on social media.

**Why:** attackers often ask, call or walk in rather than hack.

### Rule 13. Return and wipe what you no longer need

- Return devices, badges and tokens when you leave or change role.
- Do not throw away or sell devices or storage media: give them to IT
  for secure wiping or destruction.
- Delete information you no longer need, following the retention rules
  for your team.

**Why:** old devices and forgotten files are a common source of leaks.

### Rule 14. Report anything suspicious straight away

- **Suspicious email:** press [Report phishing].
- **Something happening now, a lost device or you clicked:** call
  [+00 000 000 000], day or night.
- **Anything else:** [service desk portal], category "Security event".
- Say what you saw, when, and what you did. Do not investigate or delete
  anything yourself.

**Why:** the sooner we know, the less harm is done, and some legal
deadlines start the moment anyone in the organization knows.

## 4. Who to contact

<!-- Guidance: Real names or team addresses and numbers only. Check them every review. Pitfall: personal mobile numbers of staff who have left. -->

| Need | Contact | How |
|---|---|---|
| Report a security event (any time) | Security hotline | [+00 000 000 000] |
| Report a suspicious email | Report button | [Report phishing] in [email client] |
| IT help, new software, lost password | Service desk | [portal URL], [phone] |
| Question about this handbook or a security rule | ISMS manager | [@isms-manager], [security@example.com] |
| Personal data question or request from a person | Privacy lead | [privacy@example.com] |
| Travel to a country on the travel list | ISMS manager | [@isms-manager] |
| Concern you cannot raise with your manager | Whistleblowing channel | [link] |

## 5. Acknowledgement form

<!-- Guidance: Collect the acknowledgement electronically in the HR system or learning platform where possible. Keep the version number. HR should confirm with legal whether, in your jurisdictions, an acknowledgement is part of the contract or only a record of receipt. This is a documentation format, not legal advice. -->

**Employee Security Handbook acknowledgement**

| Field | Entry |
|---|---|
| Name | [Full name] |
| Employee or contractor ID | [ID] |
| Team and manager | [Team], [@line-manager] |
| Handbook version | DOC-ISMS-073 version [1.0] |
| Date received | YYYY-MM-DD |

I confirm that:

1. I have received and read the Employee Security Handbook, version
   [1.0].
2. I understand the 14 rules in section 3 and where to find the full
   policies they come from.
3. I know how to report a security event (Rule 14 and section 4).
4. I understand that I can ask [@isms-manager] if anything is unclear.
5. I have been told what the organization monitors on work devices and
   accounts and where to read more (section 9 of the remote working
   policy, and the staff privacy notice).

| Signature or electronic confirmation | Date |
|---|---|
| [Signature] | YYYY-MM-DD |

*Example* record in the HR system: `ACK-073-2027-0118 | Data analyst |
version 1.0 | confirmed 2027-02-01 via learning platform`.

## 6. Extra rules for some roles

<!-- Guidance: Keep the 14 rules universal. List extra duties for higher-risk roles here and point to the documents that define them. -->

| Role group | Extra rules | Where defined |
|---|---|---|
| Managers | Approve access and remote working only for real need; tell IT and HR on the day someone leaves or changes role; support reporting | `isms/access-control-policy`, `isms/offboarding-security-checklist` |
| IT and system administrators | Use separate admin accounts and the privileged access path; never use admin accounts for email or browsing | `security/privileged-access-standard` |
| Developers | Follow secure coding rules; never put secrets in code or tickets | `isms/secure-development-policy`, `security/secrets-management-standard` |
| Finance and payroll | Two-person approval and call-back for any change of bank details | [Finance procedure] |
| HR | Protect personnel files; follow screening and leaver procedures | `isms/personnel-screening-procedure` |
| Reception and facilities | Visitor sign-in, badges, escorting, deliveries | `isms/physical-security-policy` |
| Everyone handling health or financial data | Additional training before access | `isms/isms-competence-training-matrix` |

## 7. Size tiers

<!-- Guidance: The rules stay the same at every size. What changes is the delivery: format, languages, how acknowledgements are collected and who answers questions. These are the library's working tiers. -->

| Topic | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Context | 46 staff (38 employees, 8 contractors), one office plus remote staff | 320 staff, two offices and one colocation suite | 2,400 staff, 6 sites in 4 countries, OT and IT |
| Format | One shared document plus a 20-minute onboarding talk by the ISMS manager | Intranet page, printable PDF, 15-minute e-learning with quiz | Intranet in local languages, printed pocket card at plants, supervisor briefings for shift staff |
| Rules | The 14 rules as written | 14 rules; Rule 10 adds patient data examples | 14 rules plus a plant addendum for OT (no personal USB devices on OT machines, visitors in control rooms escorted) |
| Acknowledgement | Electronic form in the HR system | Learning platform completion with version | Learning platform; paper form for staff without a company account, scanned by site HR |
| Questions | ISMS manager (0.5 FTE) directly | Security team mailbox | Local security champions per site, group security office |
| Refresh | Annually, with all-hands reminder | Annually, plus campaign of the month | Annually, translated and released on the same day in all countries |

## 8. Keeping the handbook working

<!-- Guidance: A handbook that nobody reads does not raise awareness. Test readability, translate properly, and update after incidents. Auditors may ask staff about two or three rules, and check the acknowledgement records. -->

### 8.1 Plain-language checks

Before each release:

1. Ask at least three people from non-technical roles to read sections 1
   to 4 and note anything unclear.
2. Keep sentences short (aim for under 20 words), use "you" and "we",
   and explain any technical word the first time it appears.
3. Check that every tool name, button and phone number is current.
4. Check that each rule matches the current policy it comes from
   (section 10).

### 8.2 Translations

| Language | Translated by | Reviewed by native speaker | Version |
|---|---|---|---|
| [Language] *(Example)* | [Translation provider] | [@site-hr-lead] | 1.0 |

Translations carry the same version number as the English master.

### 8.3 Update triggers

Update the handbook at least once a year, and also when:

- a policy behind one of the rules changes;
- a new tool replaces an old one (for example a new password manager);
- incidents or phishing simulation results show a rule is not
  understood;
- staff feedback shows a rule does not work in practice.

### 8.4 Measures

| Metric ID | Measure | Target *(Example)* | Source |
|---|---|---|---|
| ESH-M01 | Staff with acknowledgement of the current version | 100 % within [30] days of release or joining | HR system or learning platform |
| ESH-M02 | Quiz score on the 14 rules | Average ≥ 85 % | Learning platform |
| ESH-M03 | Staff who can name the reporting route in spot checks | ≥ 90 % | Awareness spot checks |

Worked example *(Example)*: at Quillmere Health Systems, 304 of 320
staff acknowledged version 1.1 within 30 days, which is 95.0 %. The 16
remaining staff (12 on leave, 4 new joiners in their first week)
received reminders and completed within the next two weeks, giving
100 %.

## 9. Records and evidence

<!-- Guidance: Record who received which version and when. Map these records in the control evidence matrix (DOC-ISMS-033) against clause 7.3 and A.6.3. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Approved handbook versions | The content staff received | ISMS manager | [Document management system], listed in `isms/isms-documented-information-register` | Version superseded plus [3] years |
| Acknowledgement records with version and date | Each person received and read the handbook | HR lead | [HR system or learning platform] | Employment plus [2] years |
| Quiz results | Understanding was checked | Awareness lead | [Learning platform] | [3] years |
| Plain-language review notes and translation reviews | The handbook is understandable for its audience | ISMS manager | [GRC tool] | [3] years |
| Feedback and change log | The handbook is improved from feedback and incidents | ISMS manager | Revision history and [feedback log] | Life of the document |

Acknowledgement and quiz records are personal data: limit access to HR,
the awareness lead and the ISMS manager, and report to management in
aggregate. Retention follows `data/data-retention-deletion-standard`.

## 10. Where the rules come from

<!-- Guidance: This table is for policy owners and auditors. It shows that each rule is backed by a policy and an Annex A control, so the handbook stays consistent with the ISMS. Labels are short descriptions, not official control titles. -->

| Rule | Main policy or document | Annex A control (short label) |
|---|---|---|
| 1. Strong, unique passwords | `isms/access-control-policy` (DOC-ISMS-041) | A.5.17 authentication information |
| 2. Multi-factor sign-in | `isms/access-control-policy` | A.8.5 secure authentication |
| 3. Stop and check (phishing, payment fraud) | `security/security-awareness-program`, `isms/phishing-simulation-plan` (DOC-ISMS-074) | A.6.3 awareness and training |
| 4. Lock and protect devices | `isms/endpoint-device-byod-policy` (DOC-ISMS-058) | A.8.1 user endpoint devices, A.7.9 off-premises assets |
| 5. Approved devices and services | `compliance/acceptable-use-policy` (DOC-ISMS-040), `isms/cloud-services-security-policy` | A.5.10 acceptable use, A.5.23 cloud services |
| 6. Classification and handling | `isms/information-labelling-handling-procedure` (DOC-ISMS-042), `data/data-classification-policy` | A.5.12 classification, A.5.13 labelling |
| 7. Sharing and email | `isms/information-transfer-policy` (DOC-ISMS-043) | A.5.14 information transfer |
| 8. Clear desk and screen | `isms/clear-desk-clear-screen-policy` (DOC-ISMS-056) | A.7.7 clear desk and clear screen |
| 9. Home and travel | `isms/remote-working-policy` (DOC-ISMS-054) | A.6.7 remote working |
| 10. Personal data | [Privacy policy], `compliance/gdpr-ropa` | A.5.34 privacy and PII protection |
| 11. AI tools | `ai-data/ai-usage-policy` | A.5.10 acceptable use |
| 12. Visitors, calls, social media | `isms/physical-security-policy` (DOC-ISMS-055), `security/security-awareness-program` | A.7.2 physical entry, A.6.3 awareness and training |
| 13. Return and wipe | `isms/offboarding-security-checklist` (DOC-ISMS-053), `isms/equipment-disposal-reuse-record` | A.5.11 return of assets, A.7.14 secure disposal or reuse, A.8.10 information deletion |
| 14. Report | `isms/security-event-reporting-procedure` (DOC-ISMS-023) | A.6.8 reporting security events |

## 11. References

<!-- Guidance: Cite editions; keep links to official pages only. -->

- ISO/IEC 27001:2022, https://www.iso.org/standard/82875.html, with
  Amendment 1:2024, https://www.iso.org/standard/88435.html (clause 7.3
  and Annex A controls cited by number only)
- ISO/IEC 27002:2022, https://www.iso.org/standard/75652.html
- NIST SP 800-50 Rev. 1, *Building a Cybersecurity and Privacy Learning
  Program*, September 2024, https://csrc.nist.gov/pubs/sp/800/50/r1/final
- NIST SP 800-63B-4, *Digital Identity Guidelines: Authentication and
  Authenticator Management*, July 2025,
  https://csrc.nist.gov/pubs/sp/800/63/b/4/final (basis for the
  15-character minimum for passwords used on their own and for not
  forcing periodic password changes)
- Regulation (EU) 2016/679 (GDPR), as an example of data protection law
- Related templates: `compliance/information-security-policy`,
  `compliance/acceptable-use-policy`, `security/security-awareness-program`,
  `isms/phishing-simulation-plan`, `isms/remote-working-policy`,
  `isms/security-event-reporting-procedure`, `ai-data/ai-usage-policy`,
  `isms/control-evidence-matrix`

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clause 7.3 and
Annex A control A.6.3, with each rule traced to the related Annex A
controls, and with practical content informed by NIST SP 800-50 Rev. 1
and NIST SP 800-63B-4 (US Government works in the public domain). The
text of this template is original. No ISO/IEC text is reproduced;
control numbers and short descriptive labels only are used, and you
need the official standards to read the requirements and guidance.
Check the current editions before use. The acknowledgement form is a
documentation format, not legal advice. Template licence: MIT.