ISO 27001 A.6.1: Make Personnel Screening Proportionate

What A.6.1 requires in practice

Control A.6.1 asks for background checks on every candidate for a role, carried out before they join and on an ongoing basis, taking account of applicable laws, regulations and ethics. The checks must be proportionate to business requirements, the classification of the information the person will access and the perceived risks.

In practice the control has several parts. The organisation decides what checks suit which roles, so a person with access to highly sensitive information may be checked more closely than one with none. It carries them out before access is given. It considers repeating or refreshing checks as roles and risks change. And it stays within the law, which varies by country and affects what may be checked and how data is handled. The standard names no particular check; the choice is a risk-based, lawful decision.

Start with the role and its consequences

Identify the responsibilities, information and access involved. A role administering sensitive systems presents different considerations from one with limited supervised access. The purpose is to select relevant verification, not to label one group of people as inherently untrustworthy.

Define criteria and limits before assessing individuals. Decide who may conduct checks, what sources are appropriate and who can evaluate the result. Use consistent, role-related decisions rather than improvising more intrusive checks because a manager feels uncertain about a particular person.

Verification can concern identity, relevant experience, qualifications or references where appropriate and permitted. More intrusive checks require particular care and justification. Do not treat examples in ISO 27002 as a universal instruction to obtain criminal or financial information for every candidate.

Include the people who enter through other routes

Temporary, part-time and supplier-provided personnel can have consequential access. Determine how screening responsibilities are addressed when another organisation employs the person. A contract saying “staff are checked” may not establish what was checked or whether it fits the assigned role.

Seek suitable assurance without demanding unnecessary personal records. Your organisation may need confirmation that agreed checks were completed and exceptions addressed, rather than copies of every underlying document. Connect the arrangement with supplier agreements and protect any screening information you receive.

Why proportionate screening matters to the business

Hiring is the moment when an organisation lets a new person into its information. Checks that are too light can admit risk, such as a false qualification in a sensitive role. Checks that are too heavy cost time, deter good candidates and may breach employment or privacy law. Proportionate screening balances these, and it protects clients who expect that people handling their information have been suitably vetted. It also leaves a defensible record if a problem arises later. Auditors look for sensible differences between roles and for evidence that checks happened before access was granted.

How to implement A.6.1

Agree the approach with HR and legal advisers so it is both effective and lawful in each country. One route is shown below. Screening touches people's personal lives, so involve HR early and keep a clear link between the check and the risk it addresses. Laws on what may be asked differ between countries, so do not copy one country's practice into another without advice. Explain to candidates what will be checked and why. Keep the results confidential and share them only with those who have a real need to know.

1. Group roles by the sensitivity of the information and systems they reach.
2. Decide which checks suit each group, within the law of each country.
3. Obtain candidates' agreement where the law or good practice requires it.
4. Carry out checks before access is granted, and record the outcome.
5. Define how to handle unfavourable or unclear results.
6. Decide when checks are repeated, for example on a change of role.
7. Protect the personal information gathered during screening.

Illustrative IT example: a role gains privileged access

Illustrative construction example: temporary project personnel

A hypothetical contractor brings in temporary document-control staff through an agency. They will access confidential project records, but the agency’s standard screening package was designed for a different type of work. The contractor initially assumes that supplier employment removes its need to consider the issue.

The parties clarify the role-related verification and the assurance the contractor needs before access is granted. Where a check remains incomplete, an authorised decision defines suitable restrictions or delays. The arrangement aligns responsibilities without transferring unnecessary candidate records into project folders.

Handle incomplete or uncertain results fairly

Define how missing information, discrepancies and delays are assessed. A discrepancy may require clarification rather than an immediate adverse conclusion. Appropriate decision-makers should evaluate relevant facts, the role and applicable requirements, with a route for resolving uncertainty.

Where verification cannot be completed before the intended start, decide what is permissible and proportionate. Options may include delayed access or limited duties under suitable controls, but they must fit the circumstances and legal framework. Avoid an informal exception that grants full access while the unfinished check is forgotten.

Maintain suitability without excessive collection

Determine ongoing review triggers and timing based on role risk and permitted practice. Significant changes in responsibility can justify reassessment. No universal annual screening package is mandated by A.6.1, and ongoing review should not become unjustified surveillance.

Protect screening records with restricted access, appropriate retention and secure disposition. Separate the evidence needed for an employment decision from general personnel information. Those checking completion should not automatically receive sensitive details irrelevant to their role.

Evidence and common weaknesses