Key takeaways
- Do background checks on candidates in line with law and the risk of the role.
- Background checks reduce the risk of hiring someone who poses a threat to your information.
- Start here: define screening levels based on role sensitivity and local law.
Purpose
Do background checks on candidates in line with law and the risk of the role.
Requirement
Requirement summaryBackground verification checks on all candidates to become personnel shall be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.
Why it matters
Background checks reduce the risk of hiring someone who poses a threat to your information.
How to implement
- Define screening levels based on role sensitivity and local law.
- Verify identity, right to work, references and, where justified, qualifications or criminal record.
- Apply screening to contractors too.
- Keep records of checks completed, stored securely.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your screening policy: what background checks you do for each type of role (for example identity, right to work, references, and criminal checks where the law allows).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.1 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of people who joined in the last 12 months with proof their checks were completed before they started.
- Records of extra checks for higher-risk roles, such as finance or system administrators.
- Records showing how delayed or failed checks were approved or handled.
Things you should be able to show or explain
- HR should be able to explain the screening steps and what happens if a check raises a concern.
How much to show: A handful of recent starters, including contractors.
Common mistakes
- Checks finished after the person had already started.
- Contractors not checked at all.
- Screening some hires but not others in similar roles.
- Checks that breach local employment or privacy law.
- Tip: Scale checks to the sensitivity of the role.
Policies & documents to have
- Human Resource Security Policy
FAQ
Is A.6.1 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.1?
Be ready to explain how the control works in your organisation and to provide things like: Your screening policy: what background checks you do for each type of role (for example identity, right to work, references, and criminal checks where the law a…