Screening

What the control asks

Every candidate who is to become personnel is to undergo background verification before joining and on a continuing basis, within applicable law, regulation and ethics, and in proportion to business needs, the classification of the information they will reach and the perceived risk. Purpose: confirm that people qualify for and fit the jobs they are being considered for and stay so throughout their employment. Guidance: screen all personnel, full-time, part-time and temporary, and where people come through service suppliers, write screening requirements into the supplier contract. Candidate information is collected and handled under the law of the relevant jurisdiction, which may require candidates to be told in advance. Verification respects privacy, PII and employment law and, where allowed, includes satisfactory business and personal references, a check that the CV is complete and accurate, checking the degrees and professional credentials the person claims, independent identity verification using an official document, and deeper checks such as credit or criminal record review for critical roles. For information security roles, confirm the candidate is competent and trustworthy, especially where the role is critical. Where a job, on appointment or promotion, gives access to processing facilities and especially to confidential information such as financial, personal or health data, consider more detailed checks. Procedures define criteria and limits: who may screen, and how, when and why checks are done. If checks cannot be finished in time, apply mitigations until they are, such as delaying onboarding or the issue of corporate assets, onboarding with reduced access, or ending employment. Repeat checks periodically according to the criticality of the role.

Purpose in the standard’s terms, in our words: Confirms personnel qualify for and fit their roles when appointed and for as long as they stay.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Human resource security; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A screening procedure defining criteria, depth by role and classification, who performs checks, and when and why they are done
• Screening records for a sample of new joiners showing references, CV verification, qualification confirmation and identity checks
• Evidence of enhanced checks such as criminal record or credit review for critical and security roles
• Supplier contracts requiring screening of contracted personnel, and evidence it occurred
• Records of mitigations such as reduced access or delayed onboarding where screening was incomplete
• Periodic re-screening records for critical roles, and evidence candidates were informed where law requires

Where audits commonly find gaps

• Contractors and temporary staff start work without any screening
• Access is granted in full before checks are completed and no mitigation is recorded
• Screening is never repeated for people who move into critical roles
• Checks are not proportionate, either excessive for low-risk roles or thin for high-risk ones

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (07.1.1) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 6.2 Terms and conditions of employment
• 6.3 Information security awareness, education and training
• 6.4 Disciplinary process

Read the five attributes All 93 controls