ISO 27001 Annex A 6.1 Personnel background verification
What it says
Background verification checks on all candidates to become personnel shall be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishConduct background checks on all job candidates before hiring to manage risks.
This control is about doing background checks on people before they start working for your organisation and making sure they stay suitable for their job. It matters because if the wrong person has access to your sensitive information or facilities, it could lead to data breaches or other security issues.
Free. Save your status, tasks and notes.
Why it matters
Poor background checks can grant untrustworthy individuals access to sensitive data, risking breaches and damaging the organisation's reputation.
How to implement
The HR department should conduct thorough background checks on all job candidates.
They can do this by verifying references, checking academic qualifications, and confirming their employment history. Be sure to inform candidates about the checks and comply with the Privacy Act 1988 in Australia.
The IT manager should work with HR to ensure all checks are done before granting access to sensitive information.
Implement processes to confirm checks are complete before new hires can access critical data systems.
The legal team should ensure that all background check processes comply with Australian laws and regulations.
They should review the procedures to ensure compliance with the Privacy Act 1988 and other relevant laws.
Managers responsible for hiring should identify which roles require more detailed checks, such as criminal record or financial reviews, especially for positions accessing sensitive data.
This can be based on the level of data access or risk associated with the role.
To maintain ongoing compliance, set up regular intervals where employee suitability is re-evaluated.
This ensures all personnel remain fit for their roles, especially if handling confidential or sensitive information.
Keep it running
Regularly review vetting processes to match evolving risks; tailor checks to role sensitivity, information classification, and applicable legal and ethical requirements.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's background check policy and procedure document.
Look at
How comprehensive the checks are and whether they cover all required aspects.
Good evidence
A clear, documented policy that aligns with legal requirements and includes detailed checks.
- Check 2 of 5What an auditor asks for
Ask for
Records of completed background checks for a selection of employees.
Look at
Whether checks were completed before the employee started work. GOOD means all necessary checks were completed and documented before access to sensitive systems was granted.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of legal compliance checks on the screening process.
Look at
Whether the organisation complies with privacy and employment laws, such as the Privacy Act 1988. GOOD compliance means all processes were evaluated and align with relevant legislation.
- Check 4 of 5What an auditor asks for
Ask for
To see the process for handling situations where checks cannot be completed on time.
Look at
Whether there are mitigating controls like limited access until checks are finalised. GOOD means that clear interim measures are documented to manage this risk.
- Check 5 of 5What an auditor asks for
Ask for
Documentation of periodic re-screenings, especially for critical roles.
Look at
Whether there are records showing regular re-evaluations. GOOD means ongoing suitability assessments are scheduled and documented.
Mappings
Closest match in ASD Information Security Manual: ISM-0613, Requirement for gateway system administrators nationality, which this control covers in full and more.
ASD Information Security Manual: 5 mappings
This control is broader than ISM-0613.
ISM-0613 requires that system administrators for gateways connecting to Australian Eyes Only or Releasable To networks are Australian nationals. Annex A 6.1 requires personnel background verification to be performed proportionate to information classification and risk, which can include verifying nationality/citizenship status where required. ISM-0613 is a specific, mandatory eligibility criterion for a particular high-risk admin role, whereas Annex A 6.1 is a broader screening control that does not inherently mandate Australian nationality.
This control is broader than ISM-1520.
Annex A 6.1 requires organisations to perform background verification for all candidates and personnel, including ongoing checks, aligned to legal/ethical requirements and the classification of information accessed. ISM-1520 applies the same concept of employment screening and (where necessary) security clearance, but only for gateway system administrators and ties it specifically to the sensitivity/classification of gateways. Therefore ISM-1520 is a role-specific subset that would be encompassed by implementing Annex A 6.1 organisation-wide.
This control is broader than ISM-1773.
ISM-1773 mandates that gateway system administrators for Australian Government Access Only networks be Australian nationals or seconded foreign nationals. Annex A 6.1 offers the personnel vetting mechanisms needed to confirm and document those eligibility attributes prior to and during employment. ISM-1773 specifies a key eligibility requirement for a high-trust role, while Annex A 6.1 ensures the verification process is in place, but does not mandate nationality or secondment status.
This control partially meets ISM-1625.
ISM-1625 requires an insider threat mitigation program to be developed, implemented and maintained. Background verification before engagement and on an ongoing basis, as required by Annex A 6.1, is one of the core preventive measures such a program relies on to reduce the risk of trusted insiders. ISM-1625 is a broader program that also includes detection and response, whereas Annex A 6.1 addresses only personnel screening.
This control partially overlaps ISM-0434.
Annex A 6.1 requires organisations to conduct background verification checks for all personnel before commencement and on an ongoing basis, proportionate to risk and information classification. ISM-0434 similarly requires appropriate employment screening and (where necessary) an appropriate security clearance before granting access to systems and resources. The overlap is in pre-engagement screening and risk-based assurance of trustworthiness, while Annex A 6.1 is broader in explicitly mandating ongoing re-screening and proportionality across all personnel, and ISM-0434 uniquely emphasises clearance as an access precondition.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.