7.1 - Prior to employment
Objective : To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.
7.1.1 - Screening :
365Talents performs the following screening actions :
- Confirmation of claimed academic qualifications by requesting a copy of original diploma(s).
- Check that the candidate has the necessary competence to perform its role, in particular if it is a security role.
- Confirmation of first opinion on candidate by requesting and contacting a reference of a previous job experience.
- Confirmation of identity of the candidate by requesting a copy of recognized identity document (passport or National ID Card).
Screening is performed only by authorized people : HR department.
7.1.2 - Terms and conditions of employment
The contractual obligations for employees or contractors reflect the 365Talents' policies for information security.
- All employees sign, as part of their work contract, :
- a confidentiality agreement that applies during and after employment;
- a contractual clause stating employee's legal responsibilities and rights regarding data protection legislation, in particular the European GDPR.
- All contractors sign a contract that reflect the same requirements regarding confidentiality and legal responsibilities and rights regarding data protection legislation
- All employees and contractors are made aware that they are responsible to handling properly the information, including information received from other companies or external parties.
- All employees are made aware and sign the rules of procedure of 365Talents that defines sanction process.
7.2 - During employment
Objective : To ensure that employees and contractors understand their responsibilities and are suitable for the roles for which they are considered.
7.2.1 - Management responsibilities
Management requires all employees and contractors to apply information security in accordance with the established policies and procedure of 365Talents.
7.2.2 - Information security awareness, education and training
An information security program is defined annually and implemented. It covers all 365Talents employees and contractors.
Topics covered are, but not limited to, :
- commonly known security best practices, notably the ones defined by the French National Agency for Information Systems Security ("Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI)"), such as password management, secure administration, (sensitive) data handling, phishing, ...;
- Specific topics related to 365Talents business, notably secure development practices;
- Specific topics related to protection and proper handling of personal data.
Targeted awareness actions are performed towards sensitive population such owner of privileged accesses and developers.
When possible and relevant, awareness level of employees and contractors is tested, for example by performing phishing simulation campaigns or performing "pop quizz".
New employees and contractors are made familiar of internal information security rules by :
- being requested to take note of internal dedicated page on information security rules and best practices;
- signing internal rules of procedures;
- signing confidentiality agreement as part of their contract.
New employees are made aware during the onboarding process of the security incident process and their responsibilities and expected actions when they witness or are made aware of a security event or incident.
New employees are made aware of the main points of contacts on information security matters and ways to contact them.
New employees have to follow a general awareness on security matters during the onboarding process.
7.2.3 - Disciplinary process
A disciplinary process is defined and formalized within the internal rules of procedure.
7.3 - Termination and change of employment
Objective : To protect 365Talents' interests as part of the process of changing or terminating employment
7.3.1 - Termination or change of employment responsibilities
In case of termination of employment, the confidentiality agreement part of the contract signed with employees or contractors effects remain without limitation of time after termination.
In case of change of employment, the employee is, when applicable and relevant, made aware of its new responsibilities regarding information securities.