ISO 27001 A.6.1: Screening

Create a screening policy that defines check types and depth based on role sensitivity. Set up role categories: standard screening for general positions, enhanced screening for roles with access to sensitive information, and comprehensive screening for privileged or high-trust positions. For standard screening, cover identity verification (government-issued ID), right to work, employment history with previous employers, educational qualifications, and professional references. For enhanced screening, add criminal background checks (where legally permitted), credit checks for financial roles, professional licence verification, and social media review. Decide which checks you will run in-house versus outsourcing to specialist screening providers. Complete screening before the individual starts work, or at the very least before they get access to sensitive information or systems. Get the legal side right. Obtain informed consent from candidates before running checks. Comply with data protection laws for the personal data you collect. Follow equal opportunity laws and avoid discriminatory practices. Define clearly how screening results will be evaluated and what constitutes a failure. For high-sensitivity roles, implement ongoing screening - for example, annual criminal background re-checks. Watch for changes in circumstances that could affect risk, such as financial difficulties for staff handling money. Have clear procedures for what happens when an existing employee fails a re-screening check. Keep proper records of all screening conducted, stored securely with restricted access. Define retention periods based on legal requirements.