ISO 27001 Control 6.1: Screening

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 6.1, screening, requires background checks on candidates before they join, proportionate to the role, the information they will access and the law. For a small business that usually means verifying identity, right to work, employment history and qualifications, with enhanced checks only where a role justifies them.

Most small businesses do some screening without thinking of it as screening. They check a passport, they check the right to work in the UK, and they make an offer. The checks that used to follow, references in particular, are increasingly skipped.

I understand why. A lot of organisations have stopped valuing references, on the grounds that they are not worth the paper they are written on. Many former employers will only confirm dates and a job title, and nobody wants to delay a good hire chasing something that tells them little. Criminal record checks are rarer still, and in my experience are usually only done when a client’s security requirements make them mandatory.

Control 6.1 does not ask you to check everything about everyone. It asks for screening that is proportionate: matched to the role, the information the person will reach, and the risks that brings. This page covers what that means for a small business, and there is a free screening and onboarding checklist further down.

What control 6.1 actually asks for

The control requires background verification checks on all candidates before they join, and on an ongoing basis, taking into account applicable laws, regulations and ethics, and proportionate to the business requirements, the classification of the information they will access and the perceived risks. In practice:

• Checks before someone starts. Not in their second week. The point is to know before they have access.
• Proportionate to the role. A defined level of screening for each type of role, based on what it can access.
• Lawful and fair. Only the checks you are entitled to make, handled in line with employment and data protection law.
• Applied to everyone who gets access. Employees, and where relevant contractors and temporary staff, whether you check them yourself or require an agency to.
• Ongoing where the risk justifies it. Someone promoted into a privileged role may need checks they did not need when they joined.
• Recorded. Evidence of what was checked, for whom and when.

In the 2013 edition this was control A.7.1.1. The 2022 version adds the words “on an ongoing basis”, which is the part most organisations have not thought about.

What SMEs actually do

Here is the pattern I see in most small businesses:

• Identity checks: consistently done. Passports and driving licences are checked as a matter of routine.
• Right to work: consistently done. It is a legal requirement with real penalties, so it gets done, usually properly.
• References: increasingly skipped. Seen as low value, slow and often unhelpful.
• Criminal record checks: rare. Usually only when a client contract demands them.
• Contractors and freelancers: often not screened at all. Even when they get the same access as staff.

That baseline is not bad, and an auditor will not expect a twenty-person company to run enhanced vetting on everybody. What they will look for is a decision. Which checks do you do for which roles, and why? If the honest answer is “whatever we happened to do”, the control is not met, however good the individual checks were.

Are references still worth taking?

Yes, but with realistic expectations. A reference that only confirms dates and a job title still has value: it confirms the person actually worked where they said they did, in the role they claimed, for as long as they claimed. CV embellishment is common, and a factual reference catches the most blatant cases.

The fix is to stop expecting references to be character assessments and start treating them as verification. Ask former employers to confirm dates, job title and, if they will, whether they would re-employ. For roles with privileged access, a conversation with a former manager, with the candidate’s permission, is worth far more than a written form.

Proportionate screening for a small business

The practical way to make screening proportionate is to define two or three levels and attach each role to one. Here are the checks that are available and how they tend to be used.

Most small businesses need only two levels: a baseline for everyone, and a higher level for anyone with administrator access, access to sensitive personal or financial data, or authority to move money. Write the levels down once, in your screening procedure, and the decision for each new hire becomes quick and consistent.

Criminal record checks

A basic DBS check shows unspent convictions and any employer can request one, with the candidate’s consent. The Disclosure and Barring Service replaced the Criminal Records Bureau in 2012, though many people still call them CRB checks. In Scotland the equivalent service is Disclosure Scotland, and in Northern Ireland it is AccessNI. Standard and enhanced checks are only available for specific roles defined in law, so most SMEs cannot request them for ordinary jobs. Bear in mind the Rehabilitation of Offenders Act 1974: spent convictions generally do not have to be disclosed, and should not be taken into account.

Ongoing screening

The 2022 wording asks for screening on an ongoing basis. For a small business that rarely means re-checking everyone. It means two things: re-screening when someone moves into a higher-risk role, and repeating checks where a client contract requires it periodically. Both are easy to miss without a trigger, so tie them to your movers process under control 6.5.

Contractors, agencies and freelancers

The control covers candidates to become personnel, which includes anyone working for you with access to your information. A freelance developer with production access is as much a risk as an employee with the same access, and usually far less checked.

You do not have to run the checks yourself. Where people come through an agency or an outsourced provider, require the provider to screen them to a defined level, and make that a term of the contract under control 5.20. Where you engage individuals directly, apply the same levels you would to staff.

Doing it lawfully

Screening involves personal data, sometimes sensitive personal data, so the way you handle it matters as much as the checks themselves. The ICO’s employment guidance covers this in detail. The short version:

• Tell candidates what checks you will do and why, before you do them.
• Only check what is relevant to the role. A blanket criminal record check on every applicant is hard to justify.
• Do right to work checks on everyone, the same way, to avoid discrimination.
• Keep copies only as long as you need them. Right to work copies are kept for the duration of employment plus two years; other screening records should have a period in your retention schedule under control 5.33.
• Restrict access to screening records to HR.

What auditors will look for

For screening, I look at a recent starter’s file and compare it with the process on paper.

1. A screening procedure. Is there a defined set of checks for each type of role, and does it reflect what each role can access?
2. Recent starters, sampled. I will pick two or three people who joined in the last year and ask to see the evidence of their checks, and the dates.
3. Timing. Were the checks complete before the person was given access to systems? The start date on their account tells me.
4. Contractors. Pick one with system access. Who screened them, to what level, and where is the evidence?
5. Privileged roles. Do administrators and finance staff have the higher level of checks your procedure says they should?
6. Lawful handling. Are candidates told about checks, and are records kept securely and for a defined period?

Common issues

• No defined screening levels. Checks vary by who did the hiring.
• Accounts set up before checks are complete, because the start date was fixed.
• References abandoned entirely, with nothing to verify employment history.
• Contractors and freelancers with admin access and no screening at all.
• No re-screening when someone moves into a privileged role.
• Copies of passports kept forever in a shared folder or email.
• Criminal record checks done for everyone, or for nobody, without any reasoning.

The self-check

Pull up the file of your most recent starter before you answer these.

• Which checks do you do for an ordinary role, and which for someone with administrator access?
• For your last three starters, were all the checks complete before their accounts were created?
• Which of your contractors have system access, and who screened them?
• When someone was last promoted into a privileged role, were any further checks considered?
• Where are copies of passports and right to work documents kept, and for how long?

The second and third are the ones to sit with. They are where the gaps usually are.

What I actually see in audits

In audits I regularly find what I call the trailer before the truck. The onboarding process records that a reference check has been started, and in the same week the new starter is given accounts and access. I understand why: nobody can sit idle for a fortnight, and most of this happens inside a probation period. But it is a risk, and it should be recognised as one, ideally by limiting access until the checks come back.

Very few small businesses take references from previous employers at all. The common belief is that nobody can give a negative reference, so there is little faith that one would help. Right-to-work checks are done consistently, because the law requires them. In my experience only around one organisation in ten carries out criminal record checks (see my findings). A newer practice I have seen a couple of times recently is a review of public social media, using online tools that flag problematic views or affiliations. If you do this, keep it proportionate to the role, tell candidates in advance and cover it in your privacy notice.

How control 6.1 links to other clauses and controls

• Control 6.2, Terms and conditions of employment. Screening comes before the contract; the contract sets out responsibilities once they join.
• Control 6.6, Confidentiality or non-disclosure agreements. Signed as part of the same onboarding process.
• Control 6.5, Responsibilities after termination or change of employment. Role changes are the trigger for re-screening.
• Control 5.18, Access rights. Access should not be granted until screening is complete.
• Control 5.20, Addressing information security within supplier agreements. Where agencies or providers screen their people for you, require it in the contract.
• Control 5.34, Privacy and protection of PII. Screening records are personal data, sometimes sensitive.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• Right to work checks: an employer’s guide. Home Office guidance on right to work checks and how long to keep copies.
• Get a basic DBS check for an employee. GOV.UK guidance for employers requesting a basic criminal record check.
• Disclosure and Barring Service. The government body responsible for criminal record checks.
• Rehabilitation of Offenders Act 1974. The law on spent convictions.
• Employment screening. National Protective Security Authority guidance on pre-employment screening.
• Employment information. ICO guidance on handling candidates’ and workers’ personal data.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call