ISO 27001 A.6.1 - Screening

Requirement

“Background verification checks on all candidates to become personnel shall be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.”

Plain-language meaning

The organization should check that people are who they claim to be, have the relevant background for the role, and do not present unmanaged personnel risk before they join or receive access.

The depth of screening should match the role. A person handling regulated customer data, privileged administration, finance approval, or sensitive investigations needs stronger checks than a short-term low-risk role. The organization must also stay inside applicable law, regulation, and ethical boundaries.

Why this matters

People can become the strongest control or the easiest path to compromise. Poor screening increases the chance of insider misuse, fraud, social engineering, unauthorized disclosure, and trust being given to someone whose background was never verified.

Screening also protects the organization from weak hiring assumptions. A CV, reference letter, or qualification supplied by the candidate is not strong evidence unless it is verified where legally permitted.

Implementation guidance

1. Define who is in scope

Screening should cover people working within the ISMS scope, including:

• employees;
• contractors;
• temporary staff;
• consultants;
• third-party users who receive organization access or handle organization information.

Do not treat contractors as outside the control just because they are not on payroll.

2. Create a risk-based screening matrix

Use a matrix that maps role risk to screening depth.

Screening should be proportional. Over-screening can create legal, ethical, and privacy risk.

3. Verify independently where permitted

Possible checks include:

• identity verification;
• CV and employment history review;
• qualification and certification verification;
• reference checks;
• review of unexplained employment gaps or inconsistencies;
• confirmation of previous roles and responsibilities where the role is sensitive.

Some previous employers may only confirm dates and job title. That limitation is not a failure by itself, but the organization should document what was attempted, what was confirmed, and what follow-up was performed.

4. Control screening records as sensitive personal data

Screening records usually contain personal data and sometimes sensitive personal data. They should be protected using retention, access control, lawful purpose, and disposal rules aligned to A.5.34 Privacy and Protection of PII and A.5.33 Protection of Records.

Keep records long enough to support employment decisions, appeals, and audit needs, but do not keep them indefinitely without a lawful reason.

5. Decide when ongoing screening is justified

Ongoing screening does not mean constant intrusive monitoring. It means rescreening or updated verification where it is justified, lawful, ethical, and risk-based.

Examples:

• a person moves into a privileged administrator role;
• a contractor is extended into a higher-risk engagement;
• a regulated role requires periodic checks;
• a major access change increases exposure to classified or sensitive information.

Audit guidance

Auditors should verify that screening procedures exist, are applied consistently, and include appropriate verification checks for the role risk.

Audit testing should include:

• the screening procedure and screening matrix;
• samples of new hires and contractors;
• evidence that checks were completed before start date or before sensitive access;
• independent verification records, not only candidate-provided documents;
• documented follow-up on gaps, inconsistencies, or reference issues;
• interviews with HR, hiring managers, recruitment staff, and contractor owners;
• access control samples to confirm people were not provisioned early;
• privacy and data protection handling of screening records.

The auditor should challenge any process that screens employees but ignores contractors or third-party users who access the same information.

Evidence examples

Strong evidence

• Screening procedure covers employees, contractors, temporary staff, and third-party users in ISMS scope.
• Screening depth is mapped to role risk and information classification.
• Checks are completed before joining or before sensitive access is granted.
• Candidate-provided CVs, certificates, and references are independently verified where permitted.
• Employment gaps or irregularities are questioned and documented.
• Screening records are retained, restricted, and disposed of according to legal and privacy requirements.
• Ongoing screening is triggered by risk-based role or access changes.

Weak evidence

• Candidate-supplied CVs and certificates are accepted without verification.
• Checks happen after the person already starts work or receives access.
• Contractors and temporary staff are excluded without justification.
• Every role receives the same screening with no risk basis.
• Screening records are stored in open HR folders or retained indefinitely.
• Referee conversations or follow-up actions are not documented.
• The organization cannot explain legal limits on screening.

Common failures

Exam traps

Related controls and concepts

• A.6 People Controls MOC
• A.6.2 Terms and Conditions of Employment
• A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
• A.5.34 Privacy and Protection of PII
• A.5.33 Protection of Records
• Roles and Responsibilities
• Risk Assessment
• Statement of Applicability
• Internal Audit
• Personnel Screening Register
• Background Verification Checklist
• A.6.1 Audit Evidence Pack
• A.6.1 Audit Checklist

KB-ready summary

• Screening is a risk-based personnel trust control.
• Checks should happen before joining or before sensitive access is granted.
• Screening applies to employees, contractors, temporary staff, and third-party users in ISMS scope.
• Screening depth should reflect business requirements, information classification, role sensitivity, and perceived risk.
• Independent verification is stronger than candidate-provided documents.
• Screening records are sensitive personal data and must be protected.
• Ongoing screening should be lawful, ethical, proportionate, and triggered by justified risk changes.

Templates and checklists

• Personnel Screening Register
• Background Verification Checklist
• A.6.1 Audit Checklist