Performance Evaluation Process

Owner	[Security Owner / management]
Effective date	[set on approval]
Review cadence	Annual review of the process; evaluations run on the cadence below
Version	0.1 — DRAFT
TSC mapping	CC1.4 / CC1.5 (Performance Evaluation Process)

1. Purpose

Ensure every employee receives regular, documented feedback on performance — including adherence to security responsibilities — so that competence and accountability are maintained.

2. Cadence

Touchpoint	Frequency	Owner
Lightweight check-in	Quarterly	Direct manager
Formal performance evaluation	Annual	Direct manager + Security Owner sign-off

(A small team may combine these; the annual formal evaluation is the minimum and is the documented evidence.)

3. What is evaluated

1. Role performance — against the responsibilities in the person’s job description.
2. Security responsibilities — did the person follow the security policies (Acceptable Use, Access Control, Change Management), use MFA, handle data correctly, and complete required security-awareness training?
3. Goals — progress on prior goals; goals for the next period.

4. Process

1. Manager and employee each complete a short written assessment.
2. They meet to discuss; the manager records outcomes, ratings, and goals.
3. The Security Owner confirms the security-responsibilities section was assessed.
4. The completed evaluation is filed (HR system / compliance platform) as evidence and retained.

5. Outcomes

Evaluations inform development, role changes, and — where security or performance issues are found — a documented remediation plan with follow-up.

6. Review

The process itself is reviewed annually by management.