ISO 27001 A.6.1: Screening

Quick Reference (60 Seconds)

What the Standard Actually Requires

ISO 27001:2022 Control Text

Annex A 6.1 asks organizations to carry out background verification checks on candidates proportionate to the role and applicable laws.

Implementation Guidance (ISO 27002:2022)

• Screening should be commensurate with the role and the sensitivity of information accessed
• Screening should include verification of identity, qualifications, employment history, and criminal record where permitted by law
• Screening should be carried out for contractors, temporary staff, and outsourced personnel as well as permanent employees
• Screening should be repeated periodically, especially for sensitive roles
• Screening should comply with all applicable legal and regulatory requirements
• Candidates should be informed about screening requirements
• Results should be handled confidentially and securely

"Shall" vs "Should" Analysis

• Shall: Background verification is mandatory for all candidates
• Should: The depth and method of screening are flexible based on role risk and legal requirements

Common Misinterpretations

Why Screening Matters

The Business Risk Narrative

Insider threats are a leading cause of security breaches. For Indian organizations, inadequate screening creates direct exposure:

• 68% of Indian organizations reported at least one insider incident in 2024 (Source: Verizon DBIR)
• 34% of breaches involve internal actors (malicious or negligent)
• Average impact of an insider incident in India: ****
• The impact of a bad hire (including security risk): -25 lakh for mid-level roles, + lakh for senior roles
• Criminal background check reveals issues in 8-12% of candidates in India (Source: AuthBridge)
• Fake credentials detected in 5-7% of resume screenings in India

Regulatory Landscape in India

Industry-Specific Consequences

impact of Non-Compliance Statistics

• impact of negligent hiring lawsuit in India: -75 lakh in settlement
• Average time to replace a bad hire: 6-9 months
• Revenue impact of insider fraud: -50 lakh per incident
• Reputational damage from insider incident: 30-40% customer trust reduction
• Screening overhead per candidate: - (depending on depth)
• ROI of proper screening: 15-25x (impact of screening vs. impact of bad hire/incident)

Scope and Applicability

What the Control Covers

• Pre-employment screening: All candidates before offer acceptance
• In-employment re-screening: Periodic re-screening for sensitive roles
• Post-employment verification: Reference checks for departing employees
• Contractor screening: Third-party staff, consultants, temporary workers
• Vendor personnel screening: Staff of outsourced vendors with access to systems/data
• Role-based screening: Different screening depth based on role risk
• Continuous monitoring: Ongoing monitoring for criminal records, sanctions, etc.
• International screening: Candidates with international backgrounds or for global roles

Who It Applies To

Who It Applies To (Roles)

What It Does NOT Cover

• General performance management (covered by HR processes)
• Security awareness training (covered by A.6.3)
• Disciplinary action (covered by A.6.4)
• Termination procedures (covered by A.6.5)
• Physical security of personnel (covered by A.7)

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Prerequisites)

Downstream Controls (Enabled By)

Parallel Controls (Work Alongside)

Implementation Roadmap (Week-by-Week)

Phase 1: Discovery & Assessment (Weeks 1-2)

Week 1: Current Screening Assessment

• Deliverable: Screening maturity assessment report
• Owner: HR + CISO
• Activities:
  1. Review current screening practices across all roles
  2. Identify gaps between current practice and ISO 27001 requirements
  3. Map all roles to information access levels
  4. Assess legal compliance of current screening (DPDP, labour law, privacy)
  5. Review existing vendor contracts and screening quality
  6. Interview hiring managers about screening concerns
  7. Document current screening overhead and turnaround times

Week 2: Risk-Based Screening Framework Design

• Deliverable: Role-risk mapping + screening tier definitions
• Owner: CISO + HR + Legal
• Activities:
  1. Define 4 screening tiers (Critical, High, Medium, Low)
  2. Map all organizational roles to screening tiers
  3. Define screening components for each tier
  4. Assess legal requirements for each check type
  5. Define re-screening frequency by tier
  6. Define continuous monitoring requirements
  7. Create screening vendor selection criteria

Phase 2: Design & Planning (Weeks 3-4)

Week 3: Policy and Procedure Development

• Deliverable: Screening Policy + Screening Procedure + Consent Forms
• Owner: HR + Legal + CISO
• Activities:
  1. Draft Employee Screening Policy
  2. Create screening procedure (pre-hire, in-employment, post-hire)
  3. Create candidate consent forms (DPDP-compliant)
  4. Create adverse action procedure (rejection, remediation, appeal)
  5. Create re-screening trigger procedures (role change, incident, periodic)
  6. Create vendor screening requirements
  7. Create screening records management procedure

Week 4: Vendor Selection and Integration

• Deliverable: Screening vendor selected and contracted
• Owner: HR + Procurement + CISO
• Activities:
  1. Evaluate BGV vendors (AuthBridge, First Advantage, Sterling, HireRight, local vendors)
  2. Assess vendor capabilities (checks offered, turnaround time, technology, compliance)
  3. Conduct vendor security assessment
  4. Negotiate contract with security and privacy requirements
  5. Plan HRIS integration for automated screening triggers
  6. Define SLA (turnaround time, accuracy, dispute resolution)
  7. Conduct pilot screening with 5 candidates

Phase 3: Implementation (Weeks 5-8)

Week 5: Pre-Employment Screening Rollout

• Deliverable: All new hires screened according to tier
• Owner: HR + Screening Vendor
• Activities:
  1. Integrate screening into hiring workflow (ATS trigger)
  2. Train recruiters on screening requirements by role
  3. Implement screening for all new positions
  4. Create candidate communication templates (screening explanation)
  5. Establish screening results review process
  6. Define escalation for adverse findings
  7. Create conditional offer language (contingent on screening)

Week 6: In-Employment Re-Screening

• Deliverable: Re-screening program operational for sensitive roles
• Owner: HR + CISO + Security
• Activities:
  1. Identify all employees in Tier 1 and Tier 2 requiring re-screening
  2. Schedule re-screening (annual for Tier 1, bi-annual for Tier 2)
  3. Implement re-screening triggers (role change, access escalation, security incident)
  4. Create re-screening communication templates
  5. Establish re-screening results review process
  6. Define consequences for re-screening failures

Week 7: Contractor and Vendor Screening

• Deliverable: All contractors and vendor personnel screened
• Owner: HR + Vendor Management + CISO
• Activities:
  1. Extend screening requirements to all contractors
  2. Require screening certificates from staffing vendors
  3. Implement direct screening for critical vendor roles
  4. Create vendor screening attestation template
  5. Add screening clauses to vendor contracts
  6. Verify vendor screening quality through spot checks
  7. Create vendor personnel access approval workflow (screening gate)

Week 8: Continuous Monitoring Implementation

• Deliverable: Continuous monitoring alerts configured
• Owner: CISO + HR + Security Vendor
• Activities:
  1. Deploy continuous monitoring for Tier 1 roles (criminal records, sanctions)
  2. Configure alert thresholds (new criminal record, sanctions listing)
  3. Create incident response for monitoring alerts
  4. Integrate monitoring with HRIS and security systems
  5. Train security team on alert response
  6. Create employee notification procedure for monitoring
  7. Test monitoring system with mock alerts

Phase 4: Testing & Validation (Weeks 9-10)

Week 9: Screening Program Testing

• Deliverable: Testing report with validation results
• Owner: HR + Internal Audit + CISO
• Activities:
  1. Test screening workflow end-to-end (candidate to hire)
  2. Test adverse action procedure (mock adverse finding)
  3. Test re-screening workflow (mock role change)
  4. Test continuous monitoring alerts (mock alert)
  5. Test vendor screening compliance (audit vendor records)
  6. Test screening records security (access, encryption, retention)
  7. Test candidate consent and DPDP compliance

Week 10: Compliance Validation

• Deliverable: Compliance validation report
• Owner: Legal + Compliance Manager + HR
• Activities:
  1. Validate screening policy against DPDP Act 2023
  2. Validate screening against labour law requirements
  3. Validate consent forms for legal compliance
  4. Verify screening vendor compliance with contract
  5. Validate screening data protection (encryption, access, retention)
  6. Test adverse action fairness and appeal process
  7. Prepare compliance evidence package

Phase 5: Documentation & Certification Prep (Weeks 11-12)

Week 11: Documentation

• Deliverable: Complete screening program documentation
• Owner: HR + Compliance Manager
• Activities:
  1. Document all screening policies and procedures
  2. Create screening training materials for recruiters and managers
  3. Create candidate FAQ on screening
  4. Create screening metrics dashboard
  5. Create evidence repository for audits
  6. Document vendor management procedures

Week 12: Certification Readiness

• Deliverable: Audit-ready evidence package
• Owner: CISO + Compliance Manager
• Activities:
  1. Conduct internal audit of screening program
  2. Prepare evidence for external ISO 27001 auditor
  3. Remediate any gaps found
  4. Conduct management review
  5. Present program to certification body

Detailed Implementation Guidance

Figure · Tiers

Maturity levels for screening

Step-by-Step Implementation

Step 1: Establish Screening Governance

• Create Screening Committee (HR Head, CISO, Legal, Head of Recruitment)
• Define screening budget allocation
• Establish screening policy approval process
• Define screening dispute resolution (candidate appeals)
• Create screening metrics and reporting to management

Step 2: Define Screening Tiers

Step 3: Implement Identity Verification

• Verify government ID: Aadhaar (e-Aadhaar QR scan), PAN, Passport, Voter ID, Driving License
• Verify photo ID match with candidate
• Verify address through utility bill, bank statement, or physical verification
• Use liveness detection for remote verification (prevent deepfake/photo substitution)
• Cross-check ID numbers with government databases where permitted

Step 4: Implement Education Verification

• Verify highest degree and relevant certifications
• Contact university/college registrar directly or through vendor
• Verify through digital platforms (NAAC, UGC, AICTE databases)
• Check for fake universities (UGC blacklist)
• Verify professional certifications (certified, CISA, ISO Lead Auditor, etc.)
• For international degrees, verify through WES or equivalent

Step 5: Implement Employment Verification

• Verify last 2-5 employers (based on tier)
• Confirm: employment dates, designation, reason for leaving, eligibility for rehire
• Verify gaps in employment (candidate explanation, reference check)
• Verify self-employment or freelance work (client references, tax records)
• Use automated employment verification where available (The Work Number, etc.)
• For international employment, verify through local contacts or vendors

Step 6: Implement Criminal and Police Verification

• Police verification: Submit Form to local police station or online (state-specific portals)
• Criminal record check: Search court records, CCTNS (Crime and Criminal Tracking Network System)
• For Tier 1: Conduct address-based police verification (current + permanent address)
• For international candidates: Conduct criminal check in home country
• Note: DPDP Act 2023 and labour law restrictions on criminal record use in employment
• Ensure adverse action considers nature of offence, time elapsed, and role relevance

Step 7: Implement Reference Checks

• Contact professional references provided by candidate
• Ask structured questions: working relationship, reliability, integrity, security awareness, reason for leaving
• For Tier 1: Contact 3 references including at least 1 supervisor
• For sensitive roles: Contact unlisted references (backdoor references) if legally permitted
• Document all reference check conversations
• Verify reference identity (not fake references)

Step 8: Implement Credit and Financial Checks

• Conduct for roles with financial responsibility (finance, CFO, procurement, treasury)
• Check CIBIL score and credit history
• Look for patterns of financial distress (potential fraud risk factor)
• Ensure compliance with RBI and DPDP requirements for credit data access
• Candidate consent mandatory for credit checks

Step 9: Implement Sanctions and Watchlist Screening

• Screen against: UN sanctions, OFAC (US), EU sanctions, Indian government sanctions lists
• Screen against: terror watchlists, PEP (Politically Exposed Persons) lists
• For Tier 1 and financial roles: Mandatory sanctions screening
• Use automated screening tools for real-time updates
• Document screening results and any matches

Step 10: Implement Social Media and Online Screening

• Review public social media profiles (LinkedIn, Twitter/X, Facebook, Instagram)
• Look for: hate speech, violence, drug use, criminal activity, security violations, confidential information leaks
• Ensure screening is limited to public information
• Do not request social media passwords (illegal in many jurisdictions)
• Document findings and decision rationale
• Be aware of potential bias and discrimination risks

Step 11: Implement Drug and Substance Testing

• Only where legally permitted and role-relevant (safety-critical roles, financial roles)
• Common in manufacturing, transportation, aviation, some BFSI roles
• Must be with explicit consent and under medical supervision
• Follow MHA (Ministry of Home Affairs) and state-specific guidelines
• Ensure compliance with DPDP Act 2023 for health data processing

Step 12: Implement Continuous Monitoring

• Monitor for: new criminal records, sanctions listings, adverse media, regulatory actions
• For Tier 1: Real-time or daily monitoring
• For Tier 2: Monthly monitoring
• For Tier 3-4: Quarterly monitoring or event-based
• Create alert workflow: Alert → Security review → HR review → Decision → Action
• Ensure employee privacy rights are respected (DPDP compliance)

Step 13: Implement Re-Screening

• Annual re-screening for Tier 1 (criminal, sanctions, continuous monitoring)
• Bi-annual re-screening for Tier 2
• Trigger-based re-screening: role change, access escalation, security incident, whistleblower report, suspicious behavior
• Re-screening upon promotion to higher tier
• Re-screening after extended leave (maternity, sabbatical, medical leave >6 months)

Step 14: Implement Adverse Action Procedure

• If screening reveals adverse information:
  1. Review report for accuracy
  2. Consult Legal on employment law implications
  3. Give candidate/employee opportunity to explain
  4. Consider nature of issue, time elapsed, role relevance, candidate explanation
  5. Make decision: proceed, conditional offer, withdraw offer, terminate, or remediate
  6. Document decision rationale
  7. Communicate decision to candidate/employee
  8. Provide appeal mechanism
  9. Maintain confidentiality of screening results
• For DPDP compliance: Adverse action based on personal data must be documented and fair

Step 15: Implement Screening Records Management

• Store screening records securely (encrypted, access-controlled)
• Retain screening records for: 7 years or duration of employment + 7 years (whichever is longer)
• Maintain screening records separately from personnel files (confidential)
• Limit access to HR, Legal, and CISO (need-to-know)
• Secure disposal after retention period (cryptographic erasure)
• Ensure DPDP compliance for screening data (personal data)

Tools, Technologies, and Solutions

Complete Tool Comparison

Recommendations by Organization Size

Policy and Procedure Templates

Employee Screening Policy (Key Sections)

Screening Procedure

Risk Assessment and Treatment

Key Risks Addressed by This Control

Audit and Compliance Checklist

Audit Questions (25 Questions)

Metrics and KPIs

Key Metrics Dashboard

Common Pitfalls and How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Fintech Startup, Finova Payments

Company Profile:

• Size: 120 employees
• Industry: Fintech, Payment Gateway and Digital Lending
• Location: Bengaluru, India
• Customers: 800,000 users, 12,000 merchants
• Regulatory Scope: RBI, NPCI, DPDP Act 2023, PCI DSS

Challenge: Finova was growing rapidly but had minimal screening:

• No formal screening policy; only informal reference checks
• No police verification or criminal checks
• A developer hired without education verification was found to have fake engineering degree
• The developer had access to production payment database and stole over 6 months
• No re-screening of existing employees; a senior employee with access to UPI infrastructure had criminal fraud case pending (not discovered)
• Customer support staff (30 people) had no screening; one support agent sold customer data to competitor for
• RBI audit flagged lack of personnel screening as major concern
• NPCI threatened to suspend UPI integration
• Reputational damage: 15% customer churn in 2 months

Solution:

1. Week 1-2: Emergency Screening Implementation

   • Engaged Singahi for emergency screening program design
   • Conducted retrospective screening of all 120 employees
   • Found 8 employees with adverse findings (fake credentials, criminal history, undisclosed employment gaps)
   • Found 1 ongoing criminal case in senior employee
   • Terminated 3 employees with serious adverse findings; placed 5 on probation with restricted access
   • Implemented immediate access revocation for terminated employees

2. Week 3-4: Policy and Vendor

   • Created 4-tier screening policy (Critical, High, Medium, Low)
   • Selected AuthBridge as primary screening vendor
   • Integrated screening with HRIS (BambooHR) and ATS (Greenhouse)
   • Created candidate consent forms (DPDP-compliant)
   • Established adverse action procedure with Legal review

3. Week 5-6: Full Screening Rollout

   • Implemented screening for all new hires (100% coverage)
   • Conducted police verification for all Tier 1 and Tier 2 roles
   • Implemented education verification for all technical roles
   • Created reference check procedure (minimum 2 references)
   • Implemented sanctions screening for all financial roles

4. Week 7-8: Re-Screening and Monitoring

   • Implemented annual re-screening for Tier 1 (20 employees)
   • Implemented bi-annual re-screening for Tier 2 (45 employees)
   • Deployed continuous monitoring for Tier 1 (criminal, sanctions)
   • Created re-screening trigger: role change, incident, suspicious behavior
   • Integrated screening clearance with IAM (no system access without clearance)

5. Week 9-12: Vendor and Contractor Screening

   • Extended screening to all 15 contractors
   • Required screening attestations from 8 vendor companies
   • Conducted direct screening for 12 vendor personnel with system access
   • Added screening clauses to all vendor contracts
   • Created vendor personnel access approval workflow

Results:

• Security incidents: Zero insider incidents in 12 months post-implementation
• Fraud prevention: loss prevented through screening (detected 1 attempted fraud)
• RBI compliance: Passed audit with commendation for screening program
• NPCI: UPI integration maintained; no regulatory action
• Customer trust: Churn stabilized; won 2 enterprise customers citing security program
• Screening ROI: annual screening overhead vs. prevented fraud + regulatory savings
• Hiring quality: 12% of candidates had adverse findings; improved overall hire quality
• Process maturity: Screening became a competitive advantage in talent acquisition

Illustrative Scenario 2: Large Enterprise, Bharat Defence Systems (BDS)

Company Profile:

• Size: 8,500 employees, 3,200 with security clearance
• Industry: Defence Manufacturing and R&D
• Location: Hyderabad (HQ), with facilities in 6 cities
• Customers: Indian Armed Forces, DRDO, ISRO, international defence clients
• Regulatory Scope: DPDP Act 2023, Official Secrets Act 1923, Defence Procurement Procedure, ISO 27001, CMMI
• Security Clearance: Government security clearance required for 3,200 employees

Challenge: BDS had government-mandated security clearance but significant gaps in broader screening:

• Government security clearance was slow (6-12 months) and did not cover all personnel
• 5,300 employees without security clearance had no formal screening
• Contractors (2,800) had minimal screening beyond basic identity check
• International hires (180) from 12 countries had no standardized screening
• No continuous monitoring, 3 employees developed criminal issues after hire that were not detected
• Re-screening was only for security clearance renewal (every 5 years), not for role changes
• A contractor with access to classified facility was found to have ties to foreign intelligence (discovered by accident, not screening)
• No social media screening; employee posted classified information on LinkedIn
• No adverse action procedure; screening results were ignored if employee was "valuable"
• Background check vendor was not security-cleared; vendor had access to sensitive employee data

Solution:

1. Months 1-2: Complete Screening Program

   • Established Security Screening Office (SSO) with 12 staff
   • Created complete screening policy (government + corporate standards)
   • Defined 5 tiers: Critical (security clearance + full screening), High, Medium, Low, Contractor
   • Selected multiple vendors: AuthBridge (India), Sterling (International), Dow Jones (Sanctions)
   • All vendors underwent security clearance and facility access review
   • Implemented air-gapped screening data storage (no internet access for screening records)

2. Months 3-4: Full Workforce Screening

   • Conducted retrospective screening of all 5,300 non-cleared employees
   • Found 47 adverse findings (criminal history, fake credentials, undisclosed foreign ties)
   • 12 employees required termination; 35 required remediation or role change
   • Implemented full screening for all 2,800 contractors
   • Found 23 contractors with adverse findings; 8 terminated, 15 restricted
   • Implemented international screening for 180 foreign nationals

3. Months 5-6: Continuous Monitoring and Re-Screening

   • Deployed continuous monitoring for all 8,500 employees (criminal, sanctions, adverse media)
   • Implemented quarterly monitoring for Tier 1 and 2
   • Implemented annual re-screening for all roles (supplementing 5-year security clearance renewal)
   • Created re-screening triggers: role change, access escalation, foreign travel, financial distress indicators
   • Implemented social media monitoring for Tier 1 (public posts only, privacy-compliant)

4. Months 7-9: Advanced Screening and Technology

   • Implemented biometric identity verification (fingerprint + iris) for all facility access
   • Deployed AI-driven risk scoring for screening results (pattern analysis, anomaly detection)
   • Implemented psychological assessment for Tier 1 roles (critical for defence)
   • Created insider threat program integrating screening with behavioral monitoring
   • Implemented polygraph for select critical roles (where legally permitted)
   • Created foreign influence screening for employees with foreign contacts

5. Months 10-12: Governance and Certification

   • Established Screening Board (monthly review of adverse findings, appeals, policy changes)
   • Created screening metrics dashboard for management and government liaison
   • Passed government security audit with zero findings
   • Achieved ISO 27001 certification with commendation for screening program
   • Created screening best practice guide shared with defence industry consortium

Results:

• Security clearance: 100% of eligible employees cleared; zero clearance revocations in 18 months
• Insider threat: Zero insider incidents; 3 potential threats detected through continuous monitoring and prevented
• Foreign influence: 2 employees with undisclosed foreign ties identified and reassigned
• Social media: 1 classified information leak prevented through social media monitoring
• Contractor security: 8 high-risk contractors removed; no contractor-related incidents
• Government audit: Passed all audits with commendation; became industry reference
• International hiring: Standardized screening for 12 countries; reduced international hiring risk
• overhead: annual screening program vs. potential national security breach + regulatory sanctions
• Industry recognition: BDS screening program won Defence Industry Security Excellence Award

Multi-Framework Mapping

Regulatory and Industry Context

India Regulatory Framework

International Regulations

Sector-Specific Requirements

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Required Documents

Continuous Improvement

Maturity Model (Level 1-5)

Improvement Cycle

• Plan: Annual screening program review; quarterly metrics; technology trend assessment; regulatory change monitoring
• Do: Deploy new tools; update tiers; train staff; enhance vendor management; improve integration
• Check: Measure effectiveness; benchmark against industry; audit; gather feedback
• Act: Standardize; communicate; update procedures; report to management; industry sharing

Technology Trends

• AI Risk Scoring: AI analyzing screening data + behavior for risk prediction
• Blockchain Credentials: Verifiable, tamper-proof academic and professional credentials
• Real-Time Monitoring: Continuous criminal, sanctions, and social media monitoring
• Biometric Verification: Advanced liveness detection, facial recognition, behavioral biometrics
• Remote Verification: AI-powered remote identity verification (no in-person required)
• Psychometric Screening: Behavioral and psychological risk assessment for sensitive roles
• Global Screening Networks: Cross-border screening data sharing (with privacy safeguards)
• Automated Adverse Action: AI-assisted fair adverse action decisions with bias mitigation

FAQ

Frequently Asked Questions (20 Questions)

Q1: Is screening mandatory for all employees under ISO 27001? A: Yes, ISO 27001 A.6.1 requires screening for all candidates. The depth varies by role, but some form of screening (identity, reference, employment) is expected for all.

Q2: Can we reject a candidate based on a criminal record? A: It depends. Under Indian law, you must consider the nature of the offence, time elapsed, and role relevance. Some roles (defence, government, financial) have legal restrictions. For other roles, a fair assessment is required. Consult Legal.

Q3: Do we need police verification for all employees? A: Police verification is recommended for Tier 1 and Tier 2 roles (access to sensitive data). For Tier 3 and 4, it may not be necessary unless required by specific regulations (e.g., security agencies, factories).

Q4: How long does screening take in India? A: Identity: 1-2 days. Education: 3-7 days. Employment: 3-7 days. Police verification: 7-15 days. Full Tier 1 screening: 2-3 weeks. Use vendor SLAs to manage timelines.

Q5: Can we screen existing employees? A: Yes, but with consent and notice. Re-screening should be part of employment terms. For sensitive roles, re-screening is best practice. For existing employees without prior consent, obtain fresh consent before re-screening.

Q6: What is continuous monitoring? A: Continuous monitoring is ongoing screening after employment. It alerts you to new criminal records, sanctions listings, or adverse media. It's recommended for Tier 1 roles and financial roles.

Q7: Do we need to screen interns and trainees? A: Yes, if they have access to information or systems. Screening depth may be lighter (identity, education, basic reference) but should still be conducted.

Q8: What if a candidate refuses screening? A: You can withdraw the offer. Screening is a condition of employment. However, ensure your policy and offer letter clearly state that employment is contingent on successful screening.

Q9: How do we handle screening for remote workers? A: Remote workers often have the same or greater access. Use remote identity verification (Onfido, Jumio), video interviews, and digital document verification. Ensure address verification is thorough.

Q10: What is the difference between police verification and criminal record check? A: Police verification is conducted by local police and covers the candidate's address. Criminal record check searches court and database records for criminal history. Both are important but cover different aspects.

Q11: Do we need to screen board members and directors? A: Yes, especially for listed companies and regulated entities. Directors have significant access and influence. DIN (Director Identification Number) verification is mandatory under Companies Act 2013.

Q12: How do we protect screening data under DPDP? A: Screening data is personal data. Obtain consent, limit access, encrypt, retain only as long as necessary, and dispose securely. Use DPDP-compliant consent forms.

Q13: Can we use social media for screening? A: Yes, but only public information. Do not request passwords or hack private accounts. Document what you review and ensure decisions are not discriminatory. Be aware of DPDP and labour law implications.

Q14: What is a backdoor reference check? A: Contacting references not provided by the candidate (e.g., former colleagues found through LinkedIn). This is common in Tier 1 roles but must be done discreetly and legally. Be transparent if required by law.

Q15: Do we need drug testing? A: Only for safety-critical roles (manufacturing, transportation, aviation) where legally permitted. Drug testing is not common in IT/services roles in India. Ensure legal compliance and explicit consent.

Q16: What is adverse action and how do we handle it? A: Adverse action is taking negative action (rejecting candidate, terminating employee) based on screening results. You must: verify accuracy, give opportunity to explain, document decision, provide appeal mechanism.

Q17: How do we screen international candidates? A: Use global screening vendors (Sterling, First Advantage). Verify international degrees through WES or equivalent. Conduct criminal checks in home country. Verify work permits and visa status.

Q18: What is the role of CISO in screening? A: CISO defines screening requirements based on information access risk, reviews security-relevant findings, approves access for screened personnel, and manages continuous monitoring.

Q19: Can we use AI for screening? A: AI can assist in risk scoring and pattern detection, but final decisions should involve human review. Be cautious of AI bias in screening decisions. Document AI use and ensure fairness.

Q20: What will an ISO 27001 auditor look for in A.6.1? A: The auditor will verify: (1) screening policy exists, (2) all roles have defined screening requirements, (3) candidates are screened before employment, (4) screening is commensurate with role, (5) contractors are screened, (6) re-screening is conducted, (7) records are maintained, (8) adverse action is handled fairly, and (9) compliance with legal requirements.

References and Further Reading

ISO Standards

• ISO 27001:2022, Information Security Management Systems
• ISO 27002:2022, Information Security Controls
• ISO 27036, Information Security for Supplier Relationships
• ISO 27701:2019, Privacy Information Management System

Indian Law

• DPDP Act 2023, Digital Personal Data Protection Act
• Information Technology Act 2000, Sections 43A, 66, 72
• Companies Act 2013, Director disqualification, DIN
• Factories Act 1948, Age verification, worker registration
• Contract Labour Act 1970, Contract worker registration
• Private Security Agencies Act 2005, Security personnel verification
• POSH Act 2013, Pre-employment sexual harassment inquiry
• Official Secrets Act 1923, Security clearance
• Aadhaar Act 2016, Aadhaar operator verification

International

• FCRA (US), Fair Credit Reporting Act
• GDPR (EU), Articles 5, 32, 28
• BS 7858 (UK), Security screening
• HMG Baseline Personnel Security Standard (UK), Government screening
• HIPAA (US), §164.308(a)(3)(ii)(B)**, Workforce clearance

Industry

• NASSCOM, IT industry personnel practices
• AuthBridge, Indian BGV research and reports
• Verizon DBIR, Data breach investigations report (insider threat data)
• ISACA, Screening and insider threat guidance

Screening for Specific Roles

Executive and Board-Level Screening

IT and Engineering Roles

Vendor and Contractor Screening

Continuous Screening and Re-Screening

Why Continuous Screening Matters

Initial screening is a point-in-time check. Employees' circumstances change over time:

• Financial stress increases insider threat risk
• Criminal convictions after hiring
• Changes in personal circumstances (divorce, addiction, gambling)
• Changes in political or ideological affiliations
• New conflicts of interest
• Moonlighting or side businesses competing with employer

Continuous Screening Program

Re-Screening Policy Template

RE-SCREENING POLICY

1. ANNUAL RE-SCREENING
   All employees undergo basic re-screening annually:
   - Criminal record check (last 12 months)
   - Address verification (if changed)
   - Employment verification (if changed)
   - Conflict of interest declaration

2. ROLE CHANGE RE-SCREENING
   Employees moving to higher-risk roles undergo enhanced re-screening:
   - Full background check as per new role requirements
   - Credit check (if role requires)
   - Enhanced reference checks
   - Media/social media screening

3. TRIGGERED RE-SCREENING
   Events triggering immediate re-screening:
   - Criminal conviction (any level)
   - Regulatory complaint or investigation
   - Security incident involvement
   - Financial irregularities
   - Conflict of interest concerns
   - Significant behavioral changes

4. VENDOR RE-SCREENING
   Critical vendors screened annually:
   - Company financial health
   - Key personnel criminal checks
   - Compliance certification validity
   - Security incident history

5. DOCUMENTATION
   All re-screening results documented in personnel file
   Adverse findings reviewed by HR + Security + Legal
   Decision matrix for adverse findings maintained
   Appeals process documented

Additional Illustrative Scenarios: Indian Screening Incidents

Illustrative Scenario 3: Indian IT Company, Fake Degree Scandal (2022)

What happened: A mid-sized IT company in Hyderabad discovered that 12 employees (including 3 team leads) had submitted fake degrees during hiring. The fake degrees were from universities that did not exist. The issue was discovered when a client requested degree verification for an onsite deployment.

Impact:

• 12 employees terminated immediately
• Client contract cancelled ( annual revenue lost)
• Reputational damage in client market
• Legal action from clients for misrepresentation
• Remediation overhead: (re-hiring, re-training, legal)
• Company implemented mandatory degree verification for all hires

Root causes:

• No mandatory degree verification during hiring
• HR relied on self-attested copies without verification
• No third-party verification vendor engaged
• No audit of screening process
• Pressure to hire quickly led to skipped checks

Lessons:

• Mandatory degree verification for all roles (not just claimed degrees)
• Use third-party verification vendors (AuthBridge, First Advantage)
• Verify all educational credentials directly with institutions
• Include degree verification clause in offer letter (termination if false)
• Audit screening process annually
• Never skip verification due to hiring pressure

Illustrative Scenario 4: Indian Bank, Employee with Criminal Record (2023)

What happened: A bank employee in Mumbai was arrested for involvement in a loan fraud scheme. The employee had a prior criminal record for financial fraud that was not discovered during hiring because the bank only conducted local police verification (in the employee's hometown, not the city where the fraud occurred). The employee used their position to approve fraudulent loans totaling .

Impact:

• Loan fraud: in fraudulent loans approved
• RBI penalty: for inadequate employee screening
• Customer trust erosion
• Employee arrested, bank named in criminal investigation
• Remediation overhead: (investigation, legal, system changes)
• Bank implemented nationwide criminal verification

Root causes:

• Local-only police verification (not nationwide)
• No criminal record check in the city where fraud occurred
• No credit check for financial roles
• No reference checks with previous employers
• No ongoing monitoring for financial stress indicators

Lessons:

• Nationwide criminal verification (not just local police station)
• Credit check mandatory for all financial roles
• Enhanced reference checks for financial roles (direct supervisor, not just HR)
• Ongoing monitoring for financial stress indicators
• Segregation of duties for loan approval (no single person can approve)
• Regular re-screening for financial roles (annual)
• Implement fraud detection systems that flag unusual patterns