Personnel Security Controls. TCS Personnel Security policy covers pre and post-employment security measures apart from the measure while being in employment including but not limited to Acceptable Usage Policies. All associates are required to sign and abide by, • Confidentiality and IPR Agreement • Associate Declaration • Tata Code of Conduct Mandatory third-party background verification checks are done for all associates who join TCS. This check is performed subject to the laws of the land. All associates undergo security awareness orientation as part of their induction to TCS. All new joiners in TCS are required to mandatorily complete information security awareness course within 30 days of joining and thereafter every year. Security Awareness program is used to sensitize the associate on the following. The Security awareness training program includes but not limited to the following contents • Security practices - Do’s and Don’ts • Acceptable usage of IT resources which includes email, network, systems, application, and internet • Password Management • Intellectual Property Rights • Social Engineering • Security incident reporting process and associate’s responsibility towards it • Consequence of Security, Privacy breaches, etc. The security awareness training program is followed up periodically with methods like email broadcasts, town- halls, posters, refresher training, etc. Also, annually game, and fun based events are carried out with theme as Information security to maintain and improve the security awareness of the users in the organization. When joining an engagement, additional induction training is conducted to brief the joiners about the contractual requirements and customer specific information security requirements. TCS has an internal repository of training material and has also signed up with external training provider platforms. Role-based training, with different competency levels, is handled by the project teams for associates handling roles that require security implementation as part of their job function or project, e.g., software security assurance, network security, firewall security administration, data-base security administration, external security certifications, etc. All employees and contract staff are required to sign Confidentiality and Non-Disclosure Agreement and the security declaration form at the time of joining the organization where they confirm that they have understood the requirements of TCS Security Policy and that they accept to abide by i...
