7.15 Personnel Safety & Security

Key Takeaways

CISSP 7.15 is officially: Address personnel safety and security concerns.

The current CISSP outline explicitly identifies four areas: travel, security training and awareness, emergency management and duress.

Security exists to protect people as well as information and technology.

During an immediate threat to human safety: people come first.

An employee should not remain inside a dangerous facility merely to protect a server, application or dataset.

Human life > equipment > data availability.

Personnel safety and personnel security overlap but are not identical.

Safety addresses hazards and injury. Security also addresses intentional threats such as coercion, violence, targeted social engineering and insider activity.

Personnel protection should be risk-based.

A travelling executive, lone engineer and ordinary office worker may need different controls.

Travel moves personnel away from many normal organisational safeguards.

Travel planning should therefore consider the destination, activity, employee profile, technology, information and available support.

Travel security begins before departure.

Personnel travelling to higher-risk environments may require additional preparation and more restrictive technology arrangements.

A core travel principle is minimisation.

Personnel should carry only the information, devices and access required for the trip where practical.

What does not travel cannot be lost from the travel device.

Organisations may use appropriately prepared travel devices containing limited data and access.

Devices should be appropriately patched, encrypted, authenticated and managed.

Travellers should maintain appropriate physical control of their devices.

Encryption reduces data exposure but does not eliminate the operational consequences of a lost laptop.

Networks outside organisational control should be treated as untrusted.

Employees should follow organisational policy for approved secure remote connectivity.

Unknown USB devices, charging connections and wireless peripherals can introduce additional technical risk.

Personnel should avoid exposing sensitive information through public conversations, unattended documents or visible screens.

A confidential conversation in an airport lounge can disclose information just as effectively as an email sent to the wrong person.

Personnel should also avoid unnecessarily advertising security badges, organisational access or sensitive business affiliation while travelling.

Lost or stolen equipment should be reported quickly.

Employees should not put themselves in danger attempting to personally retrieve equipment.

Person first. Device incident second.

Suspected physical tampering with travelling devices should be treated as a potential security concern.

Travel plans may also need to account for different legal and cultural environments.

Organisational policy does not override the laws of the jurisdiction in which the traveller is operating.

Travel programmes should provide usable emergency contact and escalation mechanisms.

The current ISC2 objective specifically mentions insider threat as part of security awareness.

Insider risk can arise when trusted organisational access is intentionally misused, negligently handled or compromised by another party.

Insider-threat awareness should not create an environment where everyone automatically suspects everyone else.

Security decisions should be based on relevant behaviour, events, evidence and context.

Indicator ≠ proof.

Personnel should know how to report suspicious activity safely and appropriately.

Awareness without a usable reporting mechanism is incomplete.

Social-media impact is another explicit CISSP 7.15 awareness topic.

Public information about employees, projects, suppliers, travel, roles and reporting lines can help attackers construct convincing social engineering.

Small individual pieces of information can become valuable when combined.

Social-media exposure can create physical-security risk as well as cybersecurity risk.

Publicly advertising travel, home location or a detailed corporate badge may reveal information useful to a malicious actor.

The current CISSP outline also explicitly includes two-factor authentication fatigue.

MFA fatigue occurs when an attacker repeatedly triggers authentication requests hoping the legitimate user will eventually approve one.

Repeated unexpected MFA prompts should be treated as a potential security signal.

If you did not initiate the login, do not approve the authentication request merely to make the prompts disappear.

Personnel should deny and report unexpected authentication attempts using established organisational procedures.

Training is only one layer of protection against MFA-fatigue attacks.

Organisations can also implement stronger authentication mechanisms.

CISA recommends movement toward phishing-resistant MFA and identifies number matching as a stronger alternative to simple push approval where phishing-resistant authentication cannot yet be deployed.

User awareness + stronger authentication = better defence.

Emergency management is the third official 7.15 area.

Personnel should know how emergencies are reported, how alarms are communicated, what protective action is required and how people will be accounted for.

Emergency plans may address fire, medical emergencies, hazardous conditions, natural hazards, infrastructure failures and security events.

Evacuation is an important emergency response but is not necessarily the correct response to every hazard.

Some situations may require personnel to remain or shelter in an appropriate safe location.

Personnel should follow the established emergency procedure relevant to the threat.

Emergency plans should include routes, alarms, responsibilities, communications and personnel accountability.

Visitors and contractors matter too.

Knowing that employees evacuated is insufficient if the organisation cannot determine whether visitors remain inside.

Accessibility should be included in emergency planning.

Personnel who cannot use the normal evacuation route may require appropriate alternative arrangements.

Emergency plans should be trained and practised.

Plan written ≠ people prepared.

Drills and exercises can reveal confusing instructions, blocked routes, communication problems and other weaknesses before a genuine emergency.

Repeated false alarms can create complacency and weaken emergency response.

Alarm systems should therefore be maintained and personnel should understand what the alarms mean.

Lone and remote workers may require additional arrangements because immediate assistance may not be nearby.

Check-in procedures, emergency communication and personal-safety devices may form part of this protection.

A missed check-in can itself trigger an escalation procedure.

Duress is the final explicit CISSP 7.15 area.

Duress concerns situations where personnel are threatened, coerced or otherwise unable to communicate freely.

Appropriate controls may include panic alarms, personal alarms, monitored check-in systems and other predefined methods of requesting assistance.

In some environments the signal may need to be discreet because an obvious request for help could increase the danger to the person.

Duress = request assistance when normal communication may not be safe.

A duress alarm alone is not sufficient.

Someone needs to receive the signal and understand how to respond.

Alarm + monitoring + response = usable duress capability.

Personnel also need training on when and how the duress mechanism should be used.

Duress systems should be tested appropriately so that organisations know the signal reaches the intended responder.

Personnel should not be expected to physically confront threatening individuals when doing so would create unnecessary personal danger.

Employees should follow established security and emergency procedures and obtain assistance where appropriate.

Cybersecurity incidents can also affect personnel safety.

A cyberattack against building access, communications, industrial systems or safety technology may create physical consequences.

Security operations should therefore consider: what does this technical incident mean for people?

Security training should be role-specific where appropriate.

A receptionist facing public interaction, a privileged administrator, a lone engineer and an international traveller may need different preparation.

Personnel-safety incidents and near misses should be reviewed.

The fact that nobody was injured does not prove that a safety control functioned correctly.

No injury ≠ no problem.

Lessons should feed into improved procedures, technology and training.

Domain 1.8 and 7.15 should not be confused.

Domain 1.8 addresses personnel-security policies such as screening, onboarding, transfers, termination and contractor arrangements.

Domain 7.15 addresses operational concerns affecting the safety and security of personnel.

The four official topics can be remembered simply as:

TRAVEL → AWARENESS → EMERGENCY → DURESS

The central CISSP principle is:

understand the risks personnel face, prepare them before exposure, minimise unnecessary information and access, teach them to recognise and report suspicious activity, protect human life before technology, maintain effective emergency procedures and ensure people have a reliable way to obtain help when they are threatened or under duress.