IEC 62443-3-1 Clause 10.2 – Personnel Security

Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for learning. The technical report is informational, not a requirements standard. Confirm wording in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.

Reference: IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007), Clause 10.2
Related: Clause 10 | 2-1 SPE 1 Organisational measures | 2-1 Awareness training | Clause 5

Technology categories: Overview | Cl. 5 | Cl. 6 | Cl. 7 | Cl. 8 | Cl. 9 | Cl. 10

Clause 10 pages: Cl. 10 | 10.1 Physical protection | 10.2 Personnel security

What it is

Personnel security treats people as a control: hire, screen, onboard, transfer and terminate so that access matches the job and is withdrawn when the job ends. Contractors and temporary workers are in scope.

Vulnerabilities addressed

Insiders (malicious or accidental), contractors who retain badges and accounts, and hiring into sensitive roles without screening.

Typical deployment

Job descriptions, interviews, background checks, access provisioning tied to role, and an exit process that collects badges and revokes accounts. High-risk posts may require extra checks subject to local law.

Known issues and weaknesses

Checks that are skipped for “trusted” vendors. Logical access left live after the badge is returned. Screening must comply with applicable employment and privacy law.

Use in IACS

A comprehensive personnel programme is part of physical and organisational security, not an HR-only formality. Link 2-1 organisational measures and awareness training.

Recommendations

Establish job descriptions and screen people before granting IACS access.
Subject employees, contractors and temporary workers to a background check that, at a minimum, includes criminal records, employment verification and educational records (as the TR lists, and as local law allows).
Some high-risk or sensitive posts may require further tests as appropriate.
Revoke physical and logical access on exit the same day.