Control A.6.1Screening

Background verification checks on all candidates to become personnel must be carried out prior to joining the organisation and on an ongoing basis, taking into consideration applicable laws, regulations and ethics, and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.

Three qualifications are doing real work. Proportional — a general screening standard applied uniformly is either excessive for most roles or inadequate for the sensitive ones. Applicable laws — what may be checked, and what may be relied on, differs by jurisdiction, and employment and data protection law constrain both. And on an ongoing basis, which most organisations do not do at all: screening at hire says nothing about circumstances five years later, and roles change.

The control also reaches “all candidates to become personnel”, which includes contractors and temporary staff where they will hold comparable access. That is usually the gap — the permanent joiner is screened thoroughly and the contractor with the same access is screened by their agency, to a standard nobody has checked.

How to put this in place

People with access to your information are part of your risk, and an ISMS project needs to show that trust was checked before access was given. Without it, checks happen after the fact, vary by manager, or skip contractors.

Decide which checks suit each role, within the employment law of every country where you hire.
Write a short screening standard that sets deeper checks for privileged, finance and customer-data roles.
Make HR record completion before access is granted, for employees and contractors alike.
Agree with agencies and suppliers that they screen their own staff to the same level, and ask for confirmation.
Sample recent joiners each year to confirm the checks happened first.

Evidence an auditor usually looks for: the screening standard and completion records for a sample of recent joiners and contractors, with dates showing checks before access.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists records of background checks among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.