The international standard for information security management, ISO 27001:2022, takes a risk based approach and covers both digital and physical assets.
The 93 controls contained in Annex A of the standard includes those for physical security, human resource security and supplier relationships.
While there are many risks to consider within an organisation, one area is often forgotten or underestimated: the office cleaners.
Here’s why you should look again at the cleaners:
- Access All Areas
Cleaners often have access to physical areas of the site that other workers don’t. For example, they may have keys to locked offices, such as those of HR, Finance or Directors; and the information contained within.
- Left Alone on Site
In many cases, cleaning takes place outside of office hours, to minimise disruption to staff. This will often mean they are alone on site and unsupervised, which makes their activity hard to trace.
- Often Informal Agreements
It’s not unusual to find that the cleaner is a friend or family member of someone at the organisation, which means there may not be a formal contract in place and the usual information security considerations, such as training or NDAs could be missed.
- Access to Waste Streams
Cleaners may empty the bins or have cause to take other property away from the site, and this could provide an opportunity for data leakage.
- May Permit Unauthorised Access
While on-site, cleaners may inadvertently permit unauthorised people in to the organisation’s boundary, for example by holding a door open. Cleaners may not challenge a person posing as an employee, and may not have any means to verify them.
Remember to Risk Assess Cleaners
The above issues can all be managed by including them in your ISO 27001 risk assessment and taking control measures such as formalising your agreement and providing training to the cleaners who will be on site.
In some cases, you may also find it necessary to find ways of monitoring the activity of cleaners for example via CCTV or door access records.
For more information on ISO 27001 or Supplier Risk Management, please contact us.
PLEASE NOTE: This blog was updated 14th Feb 2024 to reflect changes in ISO 27001:2022.
