Skip to main content
All measures

Measure · ISO 27001 and other standards

Plan personnel screening by role and risk

Add lawful checks before joining and at relevant changes to your existing personnel process. Resolve open results before assigning critical duties or access.

Accountable: Personnel lead and responsible business roleReviewed

Reuse existing records

Use the role description and existing hiring or change process. The short record structure in the example can supplement it; a new screening register is unnecessary.

What to do

  1. 1

    Determine the depth and lawful method

    Derive the required checks from duties, information access and criticality. Consider identity, relevant qualifications, employment history and suitable references where necessary for the role and legally permissible. Agree with the personnel function on legal, contractual and ethical limits, permissible evidence, access and retention. Define who performs the checks, how and when; include external personnel through their engagement process.

  2. 2

    Perform checks and decide on open points

    Perform the planned checks before the person takes up the duties. In the protected personnel record, note the role, checks, result status, reviewer, date and reasoned decision. Resolve missing or inconsistent information. If a necessary check remains open, decide on deferring duties, restricted activities or access and name the person following up.

  3. 3

    Base repeat checks on the trigger

    Define periodic or event-driven repeat checks according to duties and risk, such as a move into a critical role. Reassess the permissible scope. Record the result and subsequent decision in the existing record; remove information no longer needed under the existing retention and deletion rules.

Worked example

A new administrator has a missing qualification record

Fictional example: A new administrator will operate a critical customer system. Evidence required for this role is missing.

Checks and a restricted start
DecisionThe personnel function clarifies the evidence. Until then, the business owner does not assign unsupervised administration of the customer system.
EvidenceProtected hiring record with role, open check, reviewer, date, interim decision and subsequent result.

Record the result

  • Role-specific checks with a permissible method, responsibility and triggers for repeat checks.
  • Protected personnel record with result status and reasoned decision, including open points.

Common implementation mistakes

Collecting every background detail

Check only necessary and permissible information. A criminal record check for everyone is not a blanket requirement.

Sharing the personnel file widely

Restrict access to sensitive results. A protected reference or result status often suffices for coordination.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.6.1 · SicherheitsüberprüfungGerman guide

    The workflow defines role-based lawful checks before joining and during employment, handles open results and describes the required protected record. The organisation selects and performs the actual checks.

  • TISAX · 2.1.1

    VDA ISA 6.0.3 · Partial overlap

    The steps support identity checks, required qualifications and role-based suitability checks. Actual personnel decisions and all applicable ISA requirements remain organisation-specific.

    Reference

Templates for your implementation

Sources and further reading