Recently our management team started changing the salaries of employees without having them sign a new contact or statement saying they acknowledge the change in wage. I thought that there was a process defined under ISO that stated any new salary change would have be acknowledged with either a newly signed contract or statement (btw, this is for full time salaried employees not part time or contract work). Unfortunately I can't find an artifact that defines this process, am I mistaken in thinking that 27001 covers this aspect of HR?


  • 3
    Umm, not to be flippant, but how is a question about salary change policy appropriate for a computer / information security site? Maybe re-ask on workplace.stackexchange.com. Commented Apr 10, 2017 at 17:54
  • Because ISO 27001 deals with HR procedures, 27001 also deals with information security. Commented Apr 10, 2017 at 17:57
  • 3
    Umm, ok, but how is this question related to information security? Commented Apr 10, 2017 at 17:58
  • Because ISO 20071 audits fall under the information security umbrella and artifacts of that audit fall also under the information security umbrella as well, this is not an HR question, this is specifically an artifact question, HR workers would not know the answer to "what artifacts exist in our ISO audit". If you don't understand what an ISO audit is please don't worry yourself with commenting. Commented Apr 10, 2017 at 18:01
  • 1
    the HR components to 27002 are security-focused, not compensation focused
    – schroeder
    Commented Apr 10, 2017 at 18:15

1 Answer 1


I do not believe this is a specific control requirement; in fact, the general guidance of most any regulatory standard is often less concerned with specific data points and details such as this. They typically focus on documenting and adhering to the procedures, policies, and requirements dictated internally or externally. I don't think specific things like changing compensation without notice is mandated by a standard focused on Information Security Management.

There certainly may be labor law issues involved; I am not a lawyer and could not say for certain. But I believe pursuing this with ISO 27001 is barking up the wrong tree.

  • 1
    Thanks for the feedback, I'm not worried about the legal aspect of it TBH. I was only worried as I was under the impression this might be covered in the ISO audit and thus if we weren't following that procedure we wouldn't be compliant come next audit. Commented Apr 10, 2017 at 18:02

Not the answer you're looking for? Browse other questions tagged .