What does ISO 27001 require in terms of background checks?
ISO/IEC 27001:2022, under Control 6.1 ‘Screening’, addresses background checks on individuals before they take up employment and, where necessary, during the course of their employment.
The aim is to identify potential personnel-related security risks at an early stage and to take them into account appropriately. The scope of the checks depends on the individual’s role, access to sensitive information, the identified risks and the applicable legal framework.
Background checks are therefore an integral part of a comprehensive personnel security strategy and should be integrated into existing information security processes.
Which background checks are relevant?
As part of employment screening, various checks can help to verify information provided by applicants and identify potential security risks.
Possible measures include, for example:
- Identity verification: Confirmation of a person’s identity using appropriate supporting documents.
- Verification of educational qualifications: Checking the qualifications and degrees stated.
- Employment history check: Verification of previous career stages and roles.
- Reference checks: Obtaining and assessing work-related references, where permitted.
Which of these checks are appropriate depends on the relevant security requirements and legal conditions.
Why is a risk-based approach crucial?
Not all employees are exposed to the same security risks. Whilst certain roles require extensive access rights to confidential information or critical systems, other positions have only limited access to sensitive areas.
The results of the organisation’s internal risk analysis carried out under ISO 27001 can form an important basis for this. They help to identify relevant security risks and determine appropriate measures for different roles.
This allows background checks to be used in a targeted manner, without carrying out unnecessary checks or disproportionately infringing on the rights of the individuals concerned.
Implementing employment screening consistently
In addition to selecting suitable checks, consistent implementation is key.
This requires clear lines of responsibility between Security, Compliance and HR, as well as defined procedures for carrying out and evaluating checks.
A structured process also takes data protection into account, documents relevant decisions and enables measures to be adapted in the event of changing risks. At the same time, documentation makes it easier to present the processes during audits.
Risk-based employment screening with DISA
The practical implementation of employment screening can present organisations with organisational and technical challenges. This is particularly the case when different screening requirements, responsibilities and data protection regulations must be taken into account.
Specialised service providers such as DISA can support internal teams through technical expertise, standardised screening processes and scalable capacity. Responsibility for the company’s internal security requirements and decisions remains with the company.
ISO 27001: Is your screening policy fit for purpose?
How well established are your screening processes? Use six practical questions to assess whether your screening policy follows a risk-based approach and clearly defines responsibilities and procedures.