Screening

What the requirement asks

Every candidate who is to become personnel is to undergo background verification before joining and on a continuing basis, within applicable law, regulation and ethics, and in proportion to business needs, the classification of the information they will reach and the perceived risk. Purpose: confirm that people qualify for and fit the jobs they are being considered for and stay so throughout their employment. Guidance: screen all personnel, full-time, part-time and temporary, and where people come through service suppliers, write screening requirements into the supplier contract. Candidate information is collected and handled under the law of the relevant jurisdiction, which may require candidates to be told in advance. Verification respects privacy, PII and employment law and, where allowed, includes satisfactory business and personal references, a check that the CV is complete and accurate, checking the degrees and professional credentials the person claims, independent identity verification using an official document, and deeper checks such as credit or criminal record review for critical roles. For information security roles, confirm the candidate is competent and trustworthy, especially where the role is critical. Where a job, on appointment or promotion, gives access to processing facilities and especially to confidential information such as financial, personal or health data, consider more detailed checks. Procedures define criteria and limits: who may screen, and how, when and why checks are done. If checks cannot be finished in time, apply mitigations until they are, such as delaying onboarding or the issue of corporate assets, onboarding with reduced access, or ending employment. Repeat checks periodically according to the criticality of the role. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Screening is a pre-employment control with legal limits. The guidance asks for the role risk, the checks allowed by law, the record and the decision.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A screening procedure defining criteria, depth by role and classification, who performs checks, and when and why they are done and one live sample together.

Evidence an assessor asks for

• Pre-employment screeningA screening procedure defining criteria, depth by role and classification, who performs checks, and when and why they are done
• Pre-employment screeningScreening records for a sample of new joiners showing references, CV verification, qualification confirmation and identity checks
• Pre-employment screeningEvidence of enhanced checks such as criminal record or credit review for critical and security roles
• Pre-employment screeningSupplier contracts requiring screening of contracted personnel, and evidence it occurred
• Pre-employment screeningRecords of mitigations such as reduced access or delayed onboarding where screening was incomplete
• Pre-employment screeningPeriodic re-screening records for critical roles, and evidence candidates were informed where law requires

The question an assessor will ask

An assessor will ask for A screening procedure defining criteria, depth by role and classification, who performs checks, and when and why they are done, then trace it to the system it protects. For A.6.1 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Contractors and temporary staff start work without any screening
• Access is granted in full before checks are completed and no mitigation is recorded
• Screening is never repeated for people who move into critical roles
• Checks are not proportionate, either excessive for low-risk roles or thin for high-risk ones

Before the next audit

Before the next audit, check one live sample for this gap: contractors and temporary staff start work without any screening.