Skip to main content
Review and revision metadata
Review Date: 2026-06-16
Reviewer: Business Manager

previous version on gdrive

Onboarding & Offboarding Process

This document defines the mandatory lifecycle controls for integrating new personnel and managing staff departures at anDREa B.V. (anDREa). Aligned with ISO/IEC 27001:2023 (A.05.10, A.05.11, A.06.01, A.06.02, A.06.05, A.06.06)* and NIS 2 personnel security requirements, this framework standardizes security gatekeepers, asset management, and regulatory compliance.

This policy undergoes mandatory evaluation and re-validation annually or immediately following updates to the corporate Risk Inventory and Evaluation (RI&E).

1. Recruitment, Shortlisting, & Candidate Vetting​

To safeguard anDREa's information infrastructure, vacancies follow a systematic, multi-tiered evaluation pipeline before an employment offer is extended:

  • Sourcing Footprint: Vacancies are announced internally first to encourage professional progression, followed by public listings on LinkedIn, werk.nl, or routed through verified Employer of Record (EOR) providers for international candidates.
  • First-Stage Triage: Human Resources evaluates all applications against core role competencies to compile the formal candidate shortlist. First interviews include HR and the Operations Manager to establish baseline cultural and professional alignment.
  • Second-Stage Technical Audit: Peer-led technical panels consisting of two direct team members, in the presence of HR or the Operations Manager, execute an in-depth capability assessment mapping to the specific demands of the position.

2. Onboarding Gatekeepers & Statutory Identification​

No corporate account generation or access provisioning can occur until HR captures, validates, and archives all required vetting documentation:

Mandatory Ingestion Dossier​

  1. Fully Executed Employment Contract: Digitally signed by both parties.
  2. Statutory Identity Verification: A high-resolution scan of a valid Passport or National Identity Card (Driving licenses are strictly rejected under Dutch labor verification laws).
  3. Financial Telemetry: Personal identification numbers, direct bank routing details, and a clear copy of the employee's physical bank card.
  4. Emergency Continuity Contact: Active contact details for designated emergency routing.
  5. VOG Screening Certificate: A validated criminal background check (Verklaring Omtrent Gedrag) processed in complete alignment with the Employee Data Sharing Policy.
info

Identity Document Lifecycle: Dutch law mandates providing a valid identification document at the exact onset of employment. If an individual's identification expires during their active tenure with anDREa, submitting an updated copy is not a statutory obligation.

Corporate Benefits & EOR Ingestion​

Upon dossier verification, payroll-enrolled staff are registered into the mandatory Zwitserleven pension scheme, ASR insurance frameworks, and the centralized HR portal (Werknemerloket). International personnel onboarded via Remofirst or Backstage IT are verified to have equivalent local pension and insurance coverages administered directly by those designated EOR partners.

3. Workplace Provisioning & Mandatory Baseline Training​

Hardware Custody & MDM Policy​

anDREa furnishes employees with managed IT assets and ergonomic home-office equipment to establish a secure remote footprint.

Mandatory First-Month Training Track​

Every team member, regardless of role or operational hierarchy, must complete and pass five core training paths during their first month of employment:


┌────────────────────────────────────────────────────────────────────────┐
│                        MANDATORY ONBOARDING EXAMS                      │
├────────────────────────────────────────────────────────────────────────┤
│  • Information Security & Data Protection (GDPR) Ingestion             │
│  • Policy Agreements Affirmation (First Week Mandate)                  │
│  • Azure-900 (Fundamentals) Internal Examination                       │
│  • Corporate Code of Conduct Compliance Quiz                           │
│  • Remote Workplace Safety & Company Emergency Training (BHV)          │
└────────────────────────────────────────────────────────────────────────┘

Probationary Term Milestone Evaluation​

Shortly before completing their one-month probationary window, the employee completes a comprehensive self-evaluation. Their direct manager reviews this self-assessment in the presence of an HR representative to meet our corporate 4-eye criteria, making a metric-backed determination to continue or terminate the employment relationship.

4. Offboarding Protocols & Core Asset Recovery​

Resignation & Administrative Wind-Down​

Employees departing anDREa must submit a formal, written resignation notice to hr@andrea-cloud.com fulfilling a minimum 1-month notice period. This window gates the administrative offboarding track, allowing for vacation balance liquidation, final salary settlement, and physical asset recovery scheduling.

Post-Employment Compliance Continuance​

While anDREa supports professional mobility, the Non-Disclosure Agreement (NDA) and all associated information security obligations remain legally binding after leaving the company. Departing staff are required to formally execute the Offboarding Formalities Declaration via email or physical signature, re-affirming their lifetime commitment to protecting corporate intellectual property.

Endpoint Sanitization & Data Containment Workflow​

To prevent data spillage, the following technical isolation sequence must be executed during the exit protocol:

  1. Audit Personal Directories: Prior to Account Freeze. The departing employee must thoroughly audit their local workspace profiles and Personal Google Drive directories.

  2. Transfer Corporate Documentation: Prior to Account Freeze. Move any corporate-related files or documentation to the managed Shared Google Drive repository. Concurrently, remove any unapproved personal files from the asset.

  3. De-provision Identity Vectors: Day of Departure. Security operations freeze the employee's Google Workspace profile, suspend underlying platform access rights, and set up mandatory email-forwarding rules to designated company custodians.

  4. Execute Full Remote Wipe: Day of Departure. Initiate an automated, full cryptographic remote wipe command via the Google MDM plane to reset the device to an unpopulated factory state before physical shipping.