ISO 27001:2022 Annex A 6.1 – Screening

• See ISO 27002:2022 Control 6.1 for more information.
• See ISO 27001:2013 Annex A 7.1.1 for more information.

What Is The Purpose of Annex A 6.1?

Annex A 6.1 of ISO 27001:2022 outlines the background checks required for employees and selected suppliers before they join the organisation.

Annex A 6.1 emphasises the importance of a proportionate approach to verification checks linked to the organisation’s unique requirements, as well as all relevant laws, regulations and ethical standards that the organisation adheres to, no matter where they operate.

Organisations should consider the type of information that employees/suppliers will come into contact with as part of their job roles, as well as the associated risks.

Ownership of Annex A 6.1

In ISO 27001:2022 Annex A 6.1, a screening process for full-time, part-time, casual/temporary staff and suppliers is established to ensure that information is only accessible to fit and proper people. Verification of employment is usually conducted before a person begins their job.

Annex A 6.1 should therefore be owned by the HR manager within the organisation.

General Guidance on Annex A 6.1

The following checks should be included in screening activities:

1. Attestations from both business and personal references.
2. The CV should be verified to ensure that the candidate has not omitted any relevant information and that the information is accurate and truthful.
3. The confirmation of professional, academic, and vocational qualifications.
4. Verification of identity through the use of a passport or driving license issued by a government agency or a public sector organisation.
5. Any role deemed suitable for enhanced vetting will undergo credit and criminal record checks.

It is common practice for background checks to collect, process and transfer personally identifiable information and protected characteristics (UK law). Therefore, wherever an organisation operates, it should adhere strictly to any prevailing employment legislation.

In most cases, this involves informing the candidate of the screening process (including what data is being processed and how it will be used) before the verification process begins.

It is essential that screening procedures clearly outline the personnel responsible for carrying out the screening on behalf of the organisation and why screening is being conducted in the first place.

The requirement for screening suppliers should be included in all contractual agreements before services are provided.

An organisation should ensure that once an employee/supplier has been vetted and hired, they have the capability to perform their duties as advertised, as well as have proven to be trustworthy, especially if their role includes any information security-related tasks.

Enhanced Vetting Annex A 6.1

In Annex A 6.1, organisations are given considerable flexibility in determining the circumstances for initiating enhanced vetting controls.

No distinction should be made between new employees or existing employees who have been promoted to roles with greater responsibility. Such procedures should be determined job by job. Enhanced screening is required for positions that deal with information processing on a daily basis (e.g. HR) or that handle or process personal information, financial information, or any other types of sensitive information.

Any organisation that employs personnel in critical roles should also consider ways to verify their ongoing suitability.

Incomplete Verifications Annex A 6.1

Sometimes screening cannot be completed in a timely manner (urgent hires, third-party delays, etc.).

An organisation should consider alternative courses of action when an unscreened member of staff is hired, including:

• A delayed onboarding process.
• System access is restricted.
• Equipment and assets of the company are withheld.
• The termination of employment.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022 Annex A 6.1 contains the same essential guidance points as 27001:2013 Annex A 7.1.1 regarding what information must be verified before an employee/supplier is hired (references, CVs, identities, etc.).

Additionally, ISO 27001:2022 Annex A 6.1 provides additional guidance on how organisations should deal with incomplete verifications, including potential termination.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

You can document, implement, maintain, and improve your information security management system (ISMS) and achieve ISO 27001 compliance using the ISMS.online platform.

Packed full of exclusive features.

Get in touch today and book a short 30-minute demo.