HR-01 Verification of qualification and trustworthiness
Screen every internal and external worker who will access customer data or production system components before they start, checking identity documents, career history, claimed qualifications, police clearance or good con
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Screening file for a sample of recent joiners including the verified identity document · Identity provider / directory
- Police clearance or certificate of good conduct records showing issue dates · Document repository
periodic reviewEvidence produced at each review
- Staffing agency contract clause requiring equivalent checks, plus the agency attestations received · Vendor register / contract repository
governing documentDocuments that govern the control
- Confirmation that academic titles and degrees claimed for the role were verified · Policy repository / GRC workspace
- Legal opinion recording which checks each jurisdiction permits · Document repository
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Contractor personnel accepted on the agency word with no evidence retained by the provider
- Checks completed weeks after production access had already been granted
- Blackmail exposure never assessed for highly privileged administrators
- Screening evidence destroyed immediately so completion cannot be demonstrated
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDEV-10 Separation of environments · HR-02 Employment terms and conditions