How do we decide which pre-employment screening and employment terms our ISMS needs?

Start

People join us and we need screening and terms the ISMS can stand on

Three Annex A controls meet here: screening of people before they get access, terms of employment that carry security duties, and confidentiality agreements. The auditor samples recent joiners, contractors included. The decisions are how deep the checks go for each kind of role, what the law lets you check, and who proves it was done before the first day of access.

• Then: Group roles by what they can reach

Step

Group roles by what they can reach

List the kinds of role and what each can see or do: customer data, privileged access, money, source code. Three or four groups are enough. This is the basis for proportionate checks, and it uses the same classification and access thinking as the rest of the ISMS.

• Then: Set the checks for each group

Step

Set the checks for each group

The pack's guidance is proportionate checks by role: identity and, where the law requires or allows, right to work for all, references and qualifications for most, deeper checks for privileged or finance roles. Write the levels down as a standard. A standard that applies the same check to everyone, or to no one, is hard to defend. Say when existing staff are checked again.

• Then: Does the law where each person works allow each check?

Decision

Does the law where each person works allow each check?

What you may ask about, check and keep differs by country and sometimes by role, and data protection and employment law both bite. CISO Times gives no country rules. Not known takes the no branch, because a check that breaks the law is worse than none.

• Yes: Do contractors and agency staff with access get equivalent checks?
• No, or not known: Ask HR and legal for each country, then adjust the standard

Step

Ask HR and legal for each country, then adjust the standard

Ask them which checks are allowed, what consent or notice is needed, how long results can be kept and who may see them. Drop or change a check that is not allowed and say so in the standard. Do not copy another country's practice.

• Then: Do contractors and agency staff with access get equivalent checks?

Decision

Do contractors and agency staff with access get equivalent checks?

The control covers people who are not on your payroll too. A common finding is contractors engaged on the agency's paperwork alone. Either the agency or supplier does the checks and shows evidence, or you do them.

• Yes: Is every check complete before access starts?
• No, or not known: Put the check in the agency or supplier contract; ask for evidence

Step

Put the check in the agency or supplier contract; ask for evidence

Say which checks are required for which kind of access, who does them, and that you may ask for confirmation. Keep the confirmation with the access request. If neither the agency nor the supplier will do them, do them yourselves or limit the access.

• Then: Is every check complete before access starts?

Decision

Is every check complete before access starts?

The common mistake in the pack's guidance is checks done after access is already granted. A rule on paper does not prevent that. Make completion a condition of the access request, so the account cannot be created without it.

• Yes: Do contracts state security duties, including after leaving?
• No, or not known: Make completion of the check a condition of the access request

Step

Make completion of the check a condition of the access request

Have HR or the agency confirm completion before the account is created. For an urgent start, agree a narrow route in advance: limited access until completion, approved by a named person and recorded. Treat it as an exception, not as the way things are done.

• Then: Do contracts state security duties, including after leaving?

Decision

Do contracts state security duties, including after leaving?

Employment contracts and contractor agreements should carry confidentiality and security responsibilities and refer to the policies. A common finding is old templates without security terms still in use. Sign before access, not after.

• Yes: Do outsiders sign a confidentiality agreement before they see secrets?
• No, or not known: Add the security terms to the templates with Legal

Step

Add the security terms to the templates with Legal

Include confidentiality, responsibility for following the security policies, and obligations that continue after the person leaves. Make sure the terms are signed before access. Fix current staff on old templates at the next change, as the law allows, and not only new joiners.

• Then: Do outsiders sign a confidentiality agreement before they see secrets?

Decision

Do outsiders sign a confidentiality agreement before they see secrets?

Third parties include customers, partners, consultants and suppliers before a full contract is signed. The usual mistake is information shared before the agreement exists, or agreements with no end date or return clause.

• Yes: Have people acknowledge the security policies and keep the record
• No, or not known: Keep standard agreements and record who has signed

Step

Keep standard agreements and record who has signed

Keep templates reviewed by Legal, with an end date and a return or destruction clause. Record who has signed and review the templates when needs change. The rule is simple: no confidential information goes out before the signature.

• Then: Have people acknowledge the security policies and keep the record

Step

Have people acknowledge the security policies and keep the record

The terms refer to the policies, so people must have seen them. Keep the acknowledgement with the personnel record, and use the induction material to explain what is expected.

• Then: Write the rule for adverse results before the first case

Step

Write the rule for adverse results before the first case

Decide who judges whether a result matters for the role, what the person can say in reply, and who decides. Local law may limit what you can take into account. The hiring decision stays with HR and the hiring manager. Security advises on the access risk. Write the rule now, even if no case has come up.

• Then: Does a check give an adverse or unclear result?

Decision

Does a check give an adverse or unclear result?

A result has come back that is adverse or unclear for the role. The rule you wrote decides what happens next. If no case has come up yet, the rule is still written and waiting.

• Yes, or not known: Follow the rule: judge relevance, hear the person, record the decision
• No: Sample recent joiners, contractors included

Step

Follow the rule: judge relevance, hear the person, record the decision

Judge the result against the role and its access, give the person a chance to explain where the law and fairness require it, and record who decided and why. Do not hold results longer than the law allows. Offer a lower-risk role or access where that is sensible.

• Then: Sample recent joiners, contractors included

Step

Sample recent joiners, contractors included

Take a sample of recent joiners and contractors and check each against the standard: the checks complete before access, the terms signed, the policies acknowledged. Include people who started in a hurry. This is what the auditor samples, and the usual finding is checks done for some roles and not others with no reason recorded.

• Then: Did the sample show someone without a completed check or signed terms?

Decision

Did the sample show someone without a completed check or signed terms?

Any gap is a finding about the process, not only about the person. Fix both: complete the check or remove the access, then fix the step that let it through.

• Yes: Complete the check or remove access, fix the gate and sample again
• No: Screening and terms set by role, applied before access and sampled

Step

Complete the check or remove access, fix the gate and sample again

Complete the missing check, or remove the access until it is done. Find why the gate failed and close it, whether it was a hurry, a missing HR step or an agency that did not confirm. Then take a fresh sample.

• Then: Sample recent joiners, contractors included (back to an earlier step)

Outcome

Screening and terms set by role, applied before access and sampled

Keep the standard, the legal advice on what you may check, the sample result and the signed terms. Do not say all staff are vetted if some roles are not checked, or that checks are the same in every country. Say what you do and where the law limits it.