HR Security Policy

Purpose

This policy establishes information security requirements throughout the employee lifecycle at Carriyo — from pre-employment screening through onboarding, ongoing employment, and termination or change of role. It ensures that personnel-related security risks are appropriately managed.

Scope

This policy applies to all Carriyo employees, contractors, temporary staff, and interns. It also applies to third-party personnel who are granted access to Carriyo systems or facilities.

Policy Statements

Pre-Employment (A.6.1)

• All candidates for employment or contract engagement must undergo background verification checks proportionate to the role and the classification of information they will access.
• Screening checks include, at a minimum: identity verification, employment history verification, and reference checks.
• For roles with access to confidential or restricted data, additional checks may include: criminal background checks (where legally permitted), educational qualification verification, and credit checks.
• Screening must be completed and results reviewed before the individual is granted access to Carriyo systems or data.
• All screening activities comply with applicable local laws and regulations, including data protection legislation.

Terms and Conditions of Employment (A.6.2)

• Employment contracts and contractor agreements must include clauses covering:
  • Confidentiality and non-disclosure obligations that survive termination.
  • The employee's or contractor's responsibilities for information security.
  • Acknowledgement of and agreement to comply with Carriyo's information security policies.
  • Consequences of policy violations.
• Employees and contractors must sign an acknowledgement of Carriyo's information security policies before being granted system access.

Security Awareness and Training (A.6.3)

• All new employees and contractors must complete information security awareness training within their first two weeks of joining.
• Annual security awareness refresher training is mandatory for all personnel.
• Training content covers: phishing awareness, data classification and handling, password and authentication security, incident reporting, acceptable use, and role-specific security topics.
• Completion of training is tracked and reported. Personnel who do not complete mandatory training within the required timeframe may have system access restricted.
• The security team conducts periodic phishing simulations to reinforce training and measure effectiveness.

Disciplinary Process (A.6.4)

• A formal disciplinary process is in place for personnel who violate information security policies.
• Violations are investigated by the security team in coordination with the CISO, who holds people matters, and management.
• Disciplinary actions are proportionate to the severity of the violation and may include: formal warnings, mandatory additional training, access restrictions, suspension, or termination.
• Repeated or wilful violations are treated as serious misconduct.

Responsibilities After Termination or Change of Employment (A.6.5)

• Information security responsibilities that remain valid after termination or change of employment are communicated to the individual and enforced.
• Confidentiality and non-disclosure obligations continue in effect after the end of employment or contract, as specified in the employment agreement.
• Intellectual property and data ownership terms survive termination.

Termination and Offboarding (A.6.5, A.6.6)

• A formal offboarding process is followed for all departing personnel.
• The offboarding process includes:
  • Revocation of all system access within 24 hours of the last working day (immediately for involuntary terminations).
  • Return of all Carriyo-owned equipment, including laptops, mobile devices, access badges, and security tokens.
  • Remote wipe of company data from personal devices used under BYOD arrangements.
  • Transfer of ownership for files, documents, and accounts to designated successors.
  • Exit interview covering ongoing confidentiality obligations.
• The CISO (people matters) and the security team jointly maintain and execute the offboarding checklist.

Role Changes

• When an employee changes roles within Carriyo, an access review is conducted to ensure that:
  • Access rights are adjusted to match the new role's requirements.
  • Access that is no longer required is promptly revoked.
  • Any additional screening requirements for the new role are satisfied.

Roles and Responsibilities

Compliance and Enforcement

Compliance is monitored through training completion records, screening verification logs, and offboarding checklists. Regular audits verify that onboarding and offboarding procedures are followed consistently. Non-compliance with this policy is addressed through the disciplinary process defined above.