A.6.1
Screening
People controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control verifies the identity, career history, qualifications, and background of candidates before they are given access to information, lowering the risk of inadvertently hiring someone who could threaten the organization's information and assets. People are the first line of defense in information security and can also be its weakest point, so the scope and depth of screening should be proportionate to the classification of the information to be accessed and the risk level of the role. The control requires verification both before joining and on an ongoing basis during employment, carried out in line with applicable laws, regulations, and ethics (personal data protection, consent, non-discrimination), proportionate to the role's risk, and extended beyond full-time employees to external personnel who hold equivalent access.
Key checkpoints
- Is there a documented screening procedure applied to all candidates before or at hiring, operated in proportion to business need, information classification, and risk level?
- Are screening items (identity verification, verification of education/career/qualifications, reference checks, and criminal-record/credit checks where legally permitted) defined according to role sensitivity?
- Are the scope and depth of screening strengthened for people who handle sensitive information or perform key duties?
- Does screening comply with applicable law and ethics, including a lawful basis, data minimization, notice and required consent/authorization, and non-discrimination?
- Are equivalent screening requirements applied through contracts to external personnel such as contractors, temporary staff, and outsourced/dispatched workers?
- Are screening and its lawful basis recorded, and is ongoing verification defined (for example, re-verification at defined intervals for critical roles and when duties or access become more sensitive) using only legally permitted, proportionate checks?
Implementation guidance
- Document a screening policy/procedure that applies to all candidates, and differentiate the screening scope in proportion to the classification of information to be accessed and the risk of the role.
- Define per-role screening items: identity verification, education/qualifications, career history, reference checks, and criminal-record/credit checks for high-risk roles where legally permitted.
- Confirm a lawful basis before collecting or verifying personal information and apply required notice and consent/authorization procedures. Consent alone does not authorize a prohibited check; securely process only information necessary for the role.
- Apply enhanced verification to sensitive/key roles (privileged access, finance, personal data handlers), and define how suitability is re-verified during employment (at defined intervals for critical roles and on moves into more sensitive roles), using only checks that applicable law permits.
- Extend screening requirements to external personnel (contractors, dispatched workers, outsourced staff) through contract clauses, and confirm that the supplier performed equivalent screening.
- Retain screening criteria, results, lawful basis, and required consent/authorization records in restricted storage, with retention and disposal rules aligned with purpose and law.
Evidence
- Screening policy/procedure document
- Per-candidate screening checklists and records (identity verification, results of education/qualification/career verification)
- Lawful-basis and notice records for screening/personal-data collection, with consent/authorization where required
- Reference-check records and, where legally permitted, criminal-record/credit-check records
- Contract clauses requiring screening of external personnel and supplier confirmations that screening was performed
- Re-screening records for key-duty personnel, and records of secure storage and access control for screening results
Nonconformity examples
- Hiring proceeds with no documented screening procedure, so identity/career verification is left to individual discretion or not performed at all.
- People in sensitive roles (privileged/administrator accounts, personal data handlers) are placed without background verification proportionate to the risk.
- Screening is applied only to full-time employees and not to contractors/dispatched workers who hold equivalent access.
- Background information is collected without a lawful basis or required consent/authorization, or beyond what the role requires.
- No screening records are kept, so it cannot be evidenced at audit time that screening was actually performed.
- No re-screening or review is carried out even when someone moves into a role with a higher risk level.