People and vendors
Training, acknowledgement, and third-party risk management that customers trust.
People and vendors
This section covers personnel records, training, vendor risk, and questionnaire responses.
Personnel Directory
Keep employee, contractor, and identity records connected to access and training evidence.
Training and acknowledgement
Track security awareness, policy acknowledgement, assignments, and completion.
Vendor Register
Manage third-party risk, critical vendors, owners, and review evidence.
Questionnaires
Answer customer security questionnaires from current program evidence.
What Noru tracks
Prop
Type
The minimum useful loop
Keep personnel records current from HR or identity systems.
Connect your HR system or identity provider so the personnel directory reflects current employees and contractors. Manual updates fall behind. Stale personnel records are a common audit gap — auditors check whether offboarded employees are still in systems.
Assign training and acknowledgement based on role and scope.
Not every person needs the same training. Assign security awareness to all personnel and add role-specific modules (developer secure coding, administrator privileged access) where relevant. Policy acknowledgement should cover at minimum the Acceptable Use Policy and Information Security Policy.
Track onboarding and offboarding evidence for access controls.
Access provisioning and deprovisioning are among the most tested controls in SOC 2 and ISO 27001 audits. Keep records of when access was granted, to what, and by whom — and when it was revoked.
Keep a vendor register focused on critical services and data processors.
A vendor register with 200 entries and no classification is not useful. Focus on critical vendors — those that process personal data, provide production infrastructure, or represent significant operational dependency. Each should have a named owner, a review date, and a risk classification.
Reuse the same evidence for questionnaires and trust requests.
Customer questionnaires ask about the same controls your auditor tests. Answer them from the same source of truth — controls, evidence, and policies — not from a separate "marketing version" that drifts from operational reality.
Evidence Noru can and cannot prove
- Personnel records, active status, and identity provider sync
- Training assignments and completion timestamps
- Policy acknowledgement records with date and version
- Onboarding and offboarding events where connected systems produce records
- Vendor register entries, review dates, and owner assignments
- Questionnaire responses linked to current controls
The most common people-related audit gap is not missing training records — it is personnel records that show people with access to systems long after they left the company. Automate offboarding checks by connecting your identity provider so access evidence stays current.