12.7.1 Personnel screening
Potential personnel who will have access to the CDE are screened, within the constraints of local laws, to minimize the risk of attacks from internal sources.
5
artefacts
0
held by a system
0
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Background check policy · HR system / LMS
- Vendor reports for past hires · HR system / LMS
- Coverage list including contractors with CDE access · HR system / LMS
- Local law alignment documentation per jurisdiction · HR system / LMS
- Periodic re-screening procedure if applicable · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Contractors not screened
- Screening shallow
- No jurisdictional alignment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet12.6.3.2 Training on acceptable use of end-user technologies · 12.8.1 Third-party service provider inventory