Personnel Screening Procedure Template (ISO/IEC 27001 A.6.1)

Personnel Screening Procedure: [Organization name]

Procedure for risk-based background verification of candidates, employees, contractors and other personnel before they join and, where the role requires it, at intervals afterwards. It supports ISO/IEC 27001:2022 + Amd 1:2024, Annex A control A.6.1 (pre-employment screening), with guidance in ISO/IEC 27002:2022, and links to A.6.2 (security terms in employment contracts) and A.5.19 (security in supplier relationships) for contractor screening. It sets screening levels per role, the checks in each level, the legal limits that apply in each jurisdiction, how adverse findings are decided and how screening records are kept and deleted. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: screening law differs widely between countries, and some checks are prohibited or tightly restricted in some places.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Roles and responsibilities
3. Legal and ethical principles
4. Screening levels
5. Role-to-level mapping
6. Check catalogue
7. Screening process
8. Adverse findings and decisions
9. Contractors, agency staff and supplier personnel
10. Re-screening and role changes
11. Data protection, retention and deletion
12. Size tiers
13. Records and evidence
14. Metrics
15. References

1. Purpose and scope

This procedure makes sure that [Organization name] verifies the background of people before they are given access to information and systems in the ISMS scope (DOC-ISMS-002), and that the depth of the verification matches the risk of the role.

It applies to:

• candidates for employment, including internal candidates moving into a role with a higher screening level;
• contractors, consultants, interns and temporary or agency staff who receive an account, a badge or access to non-public information;
• personnel of suppliers who access in-scope systems or information, by flow-down of contract requirements (section 9);
• members of the board or advisory bodies who receive Confidential information, where local law allows screening of office holders.

It does not cover customer identity verification, physical visitor registration (see the physical security policy, DOC-ISMS-055) or screening for purposes unrelated to information security, such as workplace safety medicals.

2. Roles and responsibilities

3. Legal and ethical principles

3.1 Principles

1. Lawful in every country. A check is used only where it is lawful for that role in that country. Where law and this procedure differ, local law wins and the difference is recorded in section 3.3.
2. Proportionate. The depth of screening follows the screening level of the role, never the personal preference of a manager.
3. Transparent. Candidates are told before any check which checks will be done, by whom, why, and how long results are kept.
4. Consent where required, not as a default basis. In many jurisdictions consent in an employment context is not freely given; use the legal basis legal counsel confirms, and collect consent or written authorisation only where the law requires it (for example, some countries require written authorisation before a third-party background report is obtained).
5. Minimal. Collect only the result needed to decide. Do not keep copies of identity documents longer than local law requires.
6. Fair. Every adverse finding is assessed individually against the role (section 8), and the person can respond before a final decision.
7. Non-discriminatory. Screening never uses protected characteristics and is applied consistently to everyone in the same level.

3.2 Criminal records and other sensitive data

Criminal record checks are among the most restricted checks. As an international example, Article 10 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) allows processing of personal data relating to criminal convictions and offences only under the control of official authority or when authorised by EU or Member State law with appropriate safeguards. Many other countries have equivalent rules, spent-conviction regimes, "ban the box" style limits on when the question may be asked, or rules that permit checks only for listed professions.

Rules for this organization:

• request criminal record information only for roles mapped to a level that includes it, and only in countries listed as permitted in 3.3;
• ask only at the stage of the process the law allows (often after a conditional offer);
• obtain the record through the official channel for that country;
• never collect health data, union membership, religion or similar categories as part of security screening.

3.3 Jurisdiction table

4. Screening levels

Rules:

• A person may start work at S1 while S2 or S3 checks are pending only if the higher-risk access is withheld until clearance and the hiring manager and HR record the decision. Track these in the pending list (section 7.3).
• Where a check is not lawful in a country, the level is met by the remaining checks plus any compensating control approved by the ISMS manager (for example dual control or enhanced logging of privileged sessions, see security/privileged-access-standard).

5. Role-to-level mapping

6. Check catalogue

Qualification checks feed the competence records kept under clause 7.2 in the competence and training matrix (DOC-ISMS-026).

7. Screening process

7.1 Steps

1. Requisition. The hiring manager opens the requisition with the role family; HR sets the screening level from section 5.
2. Notice. HR gives the candidate the screening notice (checks, purpose, provider, retention) at the point the law allows.
3. Checks. HR or the provider performs the checks for the level.
4. Assessment. HR records each check result. Any adverse or incomplete result goes to section 8.
5. Clearance. HR records the outcome: Cleared, Cleared with conditions, or Not cleared.
6. Contract and agreements. The person signs the employment or engagement contract with security terms (A.6.2) and the confidentiality agreement (isms/confidentiality-nda, DOC-ISMS-051).
7. Access. HR confirms clearance in the onboarding ticket; only then does the service desk grant access for the level (ops/onboarding-checklist).

7.2 Flow

The diagram shows the same seven steps; access is never granted on the "Not cleared" path.

7.3 Pending clearances

When a person starts before all checks are complete, record it here and withhold the higher-level access.

8. Adverse findings and decisions

An adverse finding is any result that is negative, inconsistent with what the candidate declared, or incomplete. HR assesses it with legal counsel using these criteria:

• relevance of the finding to the duties and access of the role;
• seriousness and age of the matter and any rehabilitation;
• whether the candidate declared it when asked;
• whether a condition (role restriction, supervision, dual control) would reduce the risk to an acceptable level.

Before a final negative decision, give the candidate the information the law requires (in some jurisdictions a copy of the report and a period to dispute it) and an opportunity to explain. Record the decision with its reasons in the screening file, not in the general HR file.

9. Contractors, agency staff and supplier personnel

Record each supplier's screening arrangement in the supplier register (DOC-ISMS-066).

10. Re-screening and role changes

Repeat or extend screening when:

• a person moves to a role with a higher screening level (internal move, promotion or temporary assignment): perform the missing checks before the new access is granted;
• the role is S3: re-screen every [3] years where lawful, or use an annual self-declaration where periodic checks are not lawful;
• credible information suggests a material change (for example a new conflict of interest), handled under HR policy with legal advice;
• a person returns after an absence of more than [12] months;
• staff join through an acquisition: perform a gap check against this procedure within [6] months of completion and restrict privileged access until gaps are closed.

11. Data protection, retention and deletion

• Store screening records in the HR system in a restricted area, with access limited to named HR staff and legal counsel.
• Keep the outcome record (level, checks done, dates, outcome, decided by) for the duration of employment plus [period set by the legal register, DOC-ISMS-014].
• Keep raw reports and certificates only as long as needed to decide and to defend the decision, then delete them. Example: delete within [6] months of the decision where the law of the country permits.
• Delete records of unsuccessful candidates after [period], unless legal proceedings are pending.
• Apply the deletion rules of data/data-retention-deletion-standard and record deletions.
• Screening providers process data only under a contract with data protection terms and deletion obligations.

12. Size tiers

Example level mapping for Quillmere Analytics Ltd:

13. Records and evidence

14. Metrics

15. References

Related templates: isms/confidentiality-nda, isms/security-disciplinary-process, isms/offboarding-security-checklist, ops/onboarding-checklist, isms/access-control-policy, isms/supplier-register, isms/supplier-security-agreement-27036, compliance/legal-register, compliance/gdpr-ropa, compliance/dpia, data/data-retention-deletion-standard, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024, Annex A control A.6.1, with guidance in ISO/IEC 27002:2022. The screening levels, checks, process, examples and guidance are original wording; no ISO or IEC text is reproduced. ISO and IEC standards are copyrighted: obtain the official standard from ISO or your national standards body (https://www.iso.org/standard/82875.html). Check the current edition and amendments, and the current law in each country, before use. This is a documentation format, not legal advice. Template licence: MIT.