6.1 Screening
Requires background verification checks on all candidates for personnel before they join and on an ongoing basis afterwards, within the bounds of applicable laws, regulations and ethics, and proportionate to business req
5
artefacts
0
held by a system
4
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Completed screening records for personnel who joined in the period, including contractors and agency staff · HR system / LMS
- Evidence of the legal and regulatory limits applied in each jurisdiction, and of candidate consent where required · Data governance / DLP tooling
- Records of ongoing or repeat verification where the role warrants it, with the trigger and interval defined · Identity provider / directory
- Evidence of what happens when a check returns an adverse result, including the decision and who took it · Document repository
governing documentDocuments that govern the control
- The screening procedure, showing what checks are performed and how the level is set against the classification of information accessed and the perceived risk · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Contractors, temporary staff and outsourced personnel screened by their employer with no verification the check was performed to the required level
- Screening performed once at hire, with no rescreening for people who later move into privileged roles
- Proportionality claimed but not documented, so every role receives the same minimal check regardless of access
- Access granted before screening completes, with no record of the interim risk decision
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.37 Documented operating procedures · 6.2 Terms and conditions of employment