ISO 27001:2022 · People controls
ISO 27001:2022 6.1: Screening
ISO 27001:2022 6.1 covers Screening. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.6.1, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Contractors and temporary staff start work without any screening.
Every candidate who is to become personnel is to undergo background verification before joining and on a continuing basis, within applicable law, regulation and ethics, and in proportion to business needs, the classification of the information they will reach and the perceived risk. Purpose (stated in ISO/IEC 27002:2022): confirms personnel qualify for and fit their roles when appointed and for as long as they stay. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 6.1.
What evidence supports 6.1?
- Annex A people controlStatement of Applicability entry for control A.6.1, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A people controlA screening procedure defining criteria, depth by role and classification, who performs checks, and when and why they are done
- Annex A people controlScreening records for a sample of new joiners showing references, CV verification, qualification confirmation and identity checks
- Annex A people controlEvidence of enhanced checks such as criminal record or credit review for critical and security roles
- Annex A people controlSupplier contracts requiring screening of contracted personnel, and evidence it occurred
Where this requirement comes from
This is our own statement of ISO 27001:2022 6.1, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Contractors and temporary staff start work without any screening
- Access is granted in full before checks are completed and no mitigation is recorded
- Screening is never repeated for people who move into critical roles
- Checks are not proportionate, either excessive for low-risk roles or thin for high-risk ones
How it maps to SOC 2
- CC1.4 high Screening evidences the entity attracts individuals suited to their responsibilities.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.