Why Are Cleaners So Risky In ISO 27001….

The international standard for information security management, ISO 27001:2022, takes a risk based approach and covers both digital and physical assets.  

The 93 controls contained in Annex A of the standard includes those for physical security, human resource security and supplier relationships.

While there are many risks to consider within an organisation, one area is often forgotten or underestimated: the office cleaners.  

Here’s why you should look again at the cleaners:

  1. Access All Areas

Cleaners often have access to physical areas of the site that other workers don’t.  For example, they may have keys to locked offices, such as those of HR, Finance or Directors; and the information contained within.

  1. Left Alone on Site

In many cases, cleaning takes place outside of office hours, to minimise disruption to staff.  This will often mean they are alone on site and unsupervised, which makes their activity hard to trace.

  1. Often Informal Agreements

It’s not unusual to find that the cleaner is a friend or family member of someone at the organisation, which means there may not be a formal contract in place and the usual information security considerations, such as training or NDAs could be missed.

  1. Access to Waste Streams

Cleaners may empty the bins or have cause to take other property away from the site, and this could provide an opportunity for data leakage.  

  1. May Permit Unauthorised Access

While on-site, cleaners may inadvertently permit unauthorised people in to the organisation’s boundary, for example by holding a door open.  Cleaners may not challenge a person posing as an employee, and may not have any means to verify them.

Remember to Risk Assess Cleaners

The above issues can all be managed by including them in your ISO 27001 risk assessment and taking control measures such as formalising your agreement and providing training to the cleaners who will be on site.

In some cases, you may also find it necessary to find ways of monitoring the activity of cleaners for example via CCTV or door access records.  

For more information on ISO 27001 or Supplier Risk Management, please contact us.

PLEASE NOTE: This blog was updated 14th Feb 2024 to reflect changes in ISO 27001:2022.

Robert Clements
Robert Clements
Articles: 290